SAA-C03 Design Secure Architectures Practice Question
A security team needs an audit trail to investigate suspicious API activity across multiple AWS accounts. Which AWS approach best provides centralized visibility into who did what, when, for service API calls?
⚠ Common exam trap
Many candidates confuse AWS Config (which tracks resource configuration changes) with CloudTrail (which records API calls), leading them to pick Option B, but Config does not provide the who, what, when details needed for an API audit trail.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an AWS CloudTrail organization trail that delivers logs to a centralized, access-controlled S3 bucket.
AWS CloudTrail organization trail is the correct approach because it captures all management and data events across multiple AWS accounts within an AWS Organizations structure, delivering them to a single, centralized S3 bucket. This provides a unified, immutable audit trail of who performed which API call, when, and from which source IP, enabling the security team to investigate suspicious activity with full visibility. The centralized bucket can be access-controlled with S3 bucket policies and IAM to ensure only authorized personnel can view the logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an AWS CloudTrail organization trail that delivers logs to a centralized, access-controlled S3 bucket.
Why this is correct
An AWS Organizations organization trail centralizes management and API activity logs across accounts. CloudTrail provides detailed event records including the requesting principal, source information, event time, and the specific API action, which supports forensic investigation.
- ✗
Enable AWS Config only for EC2 security groups and rely on it for API call auditing.
Why it's wrong here
AWS Config for EC2 security groups records resource configuration changes and can evaluate rules, but it does not capture the API caller, source IP, or request ID. Even when a security group rule is modified, Config stores the updated configuration state, not the IAM principal or credential context that made the change. This makes it inadequate as a general API audit trail across IAM, KMS, or other services.
- ✗
Turn on S3 server access logging for every bucket and assume it covers all AWS services.
Why it's wrong here
S3 server access logging provides detailed records only for requests made to S3 buckets, such as the requester, bucket, key, and response status. It captures nothing about API activity in services like IAM, KMS, Secrets Manager, or EC2, so it cannot serve as an organization-wide audit trail. Additionally, S3 access logs are delivered on a best-effort basis and are often incomplete or delayed, which further undermines their reliability for investigations.
- ✗
Use only Amazon CloudWatch alarms with no logging destination to reduce storage costs.
Why it's wrong here
Amazon CloudWatch alarms monitor metric thresholds and trigger actions such as notifications or Auto Scaling, but they do not record the API request context needed to answer 'who did what and when.' Without a durable logging destination like CloudTrail or S3, the alarm's alert data is ephemeral and lacks the request parameters, user identity, and response details required for forensics. Relying only on alarms leaves you with no historical record of the actual API calls that caused the behavior.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 935 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.