A company uses AWS Organizations and has separate development, test, and production accounts. The security team wants to ensure that no one in the sandbox organizational unit can disable AWS CloudTrail or delete the central audit bucket, even if an account administrator creates permissive IAM policies later. Which control should they use?

Attach an identity-based policy in each account that denies CloudTrail changes.

Identity policies are easy to bypass if account admins can create other roles or policies within the same account.

Create an S3 bucket policy that allows only the audit team role to delete objects.

A bucket policy can protect the bucket itself, but it does not stop CloudTrail from being disabled in the account.

Apply a permission boundary to each IAM user in the sandbox accounts.

Permission boundaries help control specific IAM principals, but they do not provide a broad account-level guardrail across all principals and services.

What does this SAA-C03 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Use a service control policy on the sandbox organizational unit to deny the prohibited actions. — An SCP is the best control because it sets an upper bound on permissions for every principal in the affected accounts or OU. This is exactly what organizations use when they need centralized guardrails that local administrators cannot override. By denying CloudTrail tampering and audit bucket deletion at the OU level, security preserves logging integrity across all accounts, regardless of permissions created inside each account. Why others are wrong: Identity policies can be overridden by other local roles and do not enforce organization-wide guardrails. A bucket policy protects only that bucket and does not stop CloudTrail from being turned off. Permission boundaries are useful for a specific principal, but they do not scale as an account-level governance control across every user and role.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.