DOP-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Config aggregated rules

  Why it's wrong here

  AWS Config aggregated rules evaluate resource configurations against desired policies—for example, checking whether an S3 bucket has encryption or a security group allows a certain port. They do not record who performed an API call, when it happened, or from which identity, because that is activity auditing rather than configuration assessment. Even when Config rules are aggregated across accounts and regions via an aggregator, they only consolidate compliance statuses, not operational access logs, so they cannot meet the requirement to audit access.

• ✗

  Cross-account IAM roles

  Why it's wrong here

  Cross-account IAM roles let principals in one account assume a role in another account using AWS STS, granting them permissions but not creating any audit record of what they do after assuming the role. The act of assuming the role and subsequent API actions are logged by AWS CloudTrail, not by IAM itself. IAM roles and trust policies merely define authorization boundaries; they provide no centralized visibility into usage, so relying solely on them fails the audit requirement.

• ✓

  AWS CloudTrail with organization trail

  Why this is correct

  An organization trail in AWS CloudTrail is created once in the management account of AWS Organizations and automatically delivers management events from every member account to a single central S3 bucket, with optional CloudWatch Logs delivery for real-time monitoring. This gives a centralized, near-complete audit record of who made API calls, the service called, source IP, and timestamp across all accounts, which directly satisfies both central management and audit requirements. Because the trail is organization-scoped, it captures activity for existing and future accounts, making it the native AWS solution for cross-account audit logging.

• ✗

  AWS Organizations tag policies

  Why it's wrong here

  AWS Organizations tag policies are rules that enforce consistent tagging conventions—for instance, requiring a CostCenter tag on all supported resources—to improve governance and cost allocation. They are a configuration and compliance control, not an audit mechanism, because they do not log API calls, identity usage, or access events. While tag policies can be managed centrally from the organization management account, they can never reveal who accessed a resource or what actions were taken, so they do not help audit access.

Go deeper

Related to this question