Question 393 of 1,511
Enforce Organization-Wide CloudTrail Trails with SCP
A company uses AWS Organizations with multiple accounts. The security team needs to ensure that all CloudTrail trails across the organization are delivering events to a centralized S3 bucket in the management account. Currently, some member accounts have their own trails. Which THREE steps should the security team take to enforce this? (Choose three.)
Quick Answer
The correct answer involves three steps: creating an organization trail in the management account, enabling CloudTrail on the centralized S3 bucket, and using a service control policy (SCP) to deny the cloudtrail:CreateTrail and cloudtrail:UpdateTrail actions. This combination works because an organization trail automatically applies to all accounts in AWS Organizations, delivering logs to the specified bucket, while the SCP prevents member accounts from creating or modifying their own trails, thereby enforcing organization-wide CloudTrail trails. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this scenario tests your understanding of preventive versus detective controls—SCPs are preventive, whereas AWS Config rules (a common trap) can only detect non-compliance, not block it. A key memory tip is “SCP to stop, Org trail to drop”: the SCP stops rogue trails, and the organization trail drops logs into the central bucket.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an organization trail in the management account that applies to all accounts.
Creating an organization trail in the management account automatically applies to all accounts and delivers events to the specified S3 bucket. Option C is correct because AWS Config rules can detect non-compliant trails (e.g., trails not delivering to the central bucket) and trigger automatic remediation, such as disabling the non-compliant trail or applying a fix. Option E is correct because an SCP that denies 'cloudtrail:CreateTrail' and 'cloudtrail:UpdateTrail' prevents member accounts from creating or modifying their own trails, enforcing the use of the organization trail. Option A is incorrect because manually disabling CloudTrail in each member account is not scalable and does not prevent future trails. Option D is incorrect because enabling CloudTrail on the centralized S3 bucket (server access logging) logs access to the bucket itself, but does not ensure that CloudTrail trails deliver events to that bucket; it is not a necessary step for centralizing trail logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Manually disable CloudTrail in each member account.
Why it's wrong here
Incorrect: Manually disabling CloudTrail in each member account is not scalable and does not prevent future creation of trails.
- ✓
Create an organization trail in the management account that applies to all accounts.
Why this is correct
Correct: Creating an organization trail in the management account automatically applies to all accounts and delivers events to the central S3 bucket.
- ✓
Use AWS Config rules to detect non-compliant trails and trigger automatic remediation.
Why this is correct
Correct: AWS Config rules can detect non-compliant trails and trigger automatic remediation, helping to enforce centralized logging.
- ✗
Enable CloudTrail on the centralized S3 bucket to log access.
Why it's wrong here
Incorrect: Enabling CloudTrail on the centralized S3 bucket (server access logging) does not ensure that trails deliver events to that bucket; it is not a necessary step for centralization.
- ✓
Use a service control policy (SCP) to deny the 'cloudtrail:CreateTrail' and 'cloudtrail:UpdateTrail' actions.
Why this is correct
Correct: An SCP denying 'cloudtrail:CreateTrail' and 'cloudtrail:UpdateTrail' prevents member accounts from creating or modifying their own trails, enforcing use of the organization trail.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a multi-account strategy using AWS Organizations. The security team needs to respond to incidents across all accounts. They want to ensure that all CloudTrail trails are enabled and logging to a central S3 bucket in the management account. What is the MOST efficient way to monitor compliance?
hard- A.Create a CloudTrail organization trail and use CloudTrail Insights to detect configuration changes.
- ✓ B.Use AWS Config conformance packs with a managed rule to check CloudTrail is enabled.
- C.Set up CloudWatch Events rules in each account to detect trail disabling.
- D.Use AWS Trusted Advisor to check CloudTrail configuration in each account.
Why B: AWS Config conformance packs with managed rules can be deployed across multiple accounts using StackSets or directly via AWS Organizations to check that CloudTrail trails are enabled and logging to a central S3 bucket. This provides centralized, automated compliance monitoring without manual per-account setup. Option A is wrong because CloudTrail Insights detects unusual API activity, not configuration compliance. Option C is wrong because setting up CloudWatch Events rules in each account is less efficient and harder to maintain than Config conformance packs. Option D is wrong because Trusted Advisor checks are per-account and cannot be centrally enforced across an organization.
Last reviewed: Jun 20, 2026
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.