DOP-C02 Security and Compliance Practice Question
A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no member account can disable AWS CloudTrail or delete CloudTrail logs. What is the most effective way to enforce this control?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a Service Control Policy that denies cloudtrail:DeleteTrail and cloudtrail:StopLogging.
A Service Control Policy (SCP) can deny the cloudtrail:DeleteTrail and cloudtrail:StopLogging actions across all accounts in the organization, effectively preventing member accounts from disabling CloudTrail or deleting logs. Option A is incorrect because requiring all accounts to use the same trail does not prevent them from disabling or deleting that trail; they could still perform those actions. Option C is incorrect because IAM policies within each account are managed by the account administrator and can be overridden, so they are not a reliable control. Option D is incorrect because while logging to a centralized bucket helps protect logs, it does not prevent member accounts from disabling CloudTrail or deleting the trail itself in their own account; member accounts may still have permissions to modify or delete the trail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require all accounts to use the same CloudTrail trail.
Why it's wrong here
This approach is purely organizational and lacks any enforceable technical control. Even if every account is instructed to use one shared trail, an administrator in a member account can still call cloudtrail:StopLogging or cloudtrail:DeleteTrail on that trail if they have the necessary IAM permissions, or they can simply configure their own trail and ignore the requirement. Nothing in AWS prevents an account admin from modifying the trail configuration, so this is not a reliable way to guarantee continuous audit logging.
- ✓
Apply a Service Control Policy that denies cloudtrail:DeleteTrail and cloudtrail:StopLogging.
Why this is correct
A Service Control Policy (SCP) applied at the organization root or an organizational unit is the correct mechanism because it acts as a permission boundary that all IAM principals—including the account root user—cannot override. By explicitly denying cloudtrail:DeleteTrail and cloudtrail:StopLogging, the SCP ensures that even a full account administrator cannot disable the trail or stop event delivery. Since member account admins lack permission to modify or detach SCPs, this provides an immutable, centralized control that persists regardless of individual account settings.
- ✗
Create an IAM policy in each account that denies cloudtrail:DeleteTrail.
Why it's wrong here
An IAM policy placed in each account only restricts the specific IAM users or roles it is attached to, and it can be modified or removed by any account administrator with IAM access. Moreover, the account root user has full administrative permissions and is effectively not bound by an IAM deny policy unless the policy is explicitly attached, but even then, the admin can simply detach or edit it. Because the account owner must maintain the ability to troubleshoot, they can always revoke this self-imposed restriction, making this approach unsuitable for enforcing mandatory logging across the organization.
- ✗
Configure CloudTrail to log to an S3 bucket in a centralized logging account and deny access to the bucket from member accounts.
Why it's wrong here
Centralizing CloudTrail logs to an S3 bucket in a logging account protects the integrity of archived log files and restricts who can read them, but it does not protect the CloudTrail API operations themselves. A member account administrator can still call cloudtrail:StopLogging or cloudtrail:DeleteTrail on the trail that is delivering events to that bucket, which would immediately halt the flow of new log records. The S3 bucket policy only governs access to stored objects; it has no effect on whether CloudTrail continues to record events, so this solution fails to prevent an attacker or admin from disabling auditing.
Go deeper
Related to this question
About these practice questions
One of 1,013 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.