SAA-C03 Design Secure Architectures Practice Question

A SOC analyst needs an immutable, centralized audit record of configuration and API changes across multiple AWS accounts. Recently, an operator changed an IAM role trust policy, and investigators must determine exactly which principal made the change and which parameters were used.

Your current setup sends application logs to CloudWatch Logs, but there is no organization-level API audit logging.

Which approach best satisfies the requirement?

⚠ Common exam trap

Candidates often confuse AWS Config's resource tracking with CloudTrail's API-level auditing, failing to realize that only CloudTrail captures the 'who' and 'how' (principal and parameters) of a change, while Config only records the 'what' (state after change).

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable an AWS Organizations CloudTrail organization trail that delivers management event logs (including IAM) to a centralized S3 bucket in a dedicated audit account, for all regions.

An AWS Organizations CloudTrail organization trail captures management events (including IAM API calls like 'UpdateAssumeRolePolicy') across all accounts in the organization, delivering immutable logs to a centralized S3 bucket in a dedicated audit account. This provides the exact principal ARN, source IP, user agent, and request parameters for every API call, meeting the requirement for a centralized, immutable audit record of configuration and API changes.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Enable an AWS Organizations CloudTrail organization trail that delivers management event logs (including IAM) to a centralized S3 bucket in a dedicated audit account, for all regions.
Why this is correct
An organisation trail captures management events, including IAM trust policy changes, across every account and region, recording the principal identity and request parameters. Delivering to a centralised S3 bucket in a dedicated audit account provides the immutable, organisation-wide record investigators require.
✗
Use CloudWatch Logs metric filters on application logs to infer which principals changed trust policies.
Why it's wrong here
Application logs in CloudWatch contain no IAM control-plane events, so metric filters cannot reveal trust policy changes or the calling principal. Metric filters suit counting patterns in logs you already emit, not auditing API activity that was never captured.
When this WOULD be correct
A SOC analyst needs to monitor application-level errors or specific patterns (e.g., failed login attempts) across multiple accounts and trigger alarms. In that scenario, CloudWatch Logs metric filters on centralized application logs would be appropriate for real-time alerting, not for immutable audit trails of API changes.
✗
Rely on GuardDuty alerts to provide the full request parameters for every IAM policy change.
Why it's wrong here
GuardDuty is a threat-detection service that raises findings from behavioural signals; it does not retain a complete, immutable record of every API call with request parameters. It would suit identifying anomalous IAM activity, not forensic reconstruction of a specific trust policy edit.
✗
Enable AWS Config only and store periodic snapshots without CloudTrail management events.
Why it's wrong here
AWS Config records resource configuration state and changes, not the API request parameters or calling principal. Without CloudTrail management events there is no actor identity or request detail. Config alone suits compliance drift detection, not attribution of who edited a trust policy.
When this WOULD be correct
A question that asks for a solution to track resource configuration changes over time and detect drift, without needing to capture API caller identity or request parameters, would make AWS Config the correct answer.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.

✓Enable an AWS Organizations CloudTrail organization trail that delivers management event logs (including IAM) to a centralized S3 bucket in a dedicated audit account, for all regions.Correct answer▾

Why this is correct

An organisation trail captures management events, including IAM trust policy changes, across every account and region, recording the principal identity and request parameters. Delivering to a centralised S3 bucket in a dedicated audit account provides the immutable, organisation-wide record investigators require.

✗Use CloudWatch Logs metric filters on application logs to infer which principals changed trust policies.Wrong answer — click to see why▾

Why this is wrong here

CloudWatch Logs metric filters on application logs cannot capture the full API request parameters (e.g., which principal made the change and the exact parameters used) because application logs are not authoritative for IAM changes and lack the detailed API call context required for immutable audit records.

★ When this WOULD be the correct answer

A SOC analyst needs to monitor application-level errors or specific patterns (e.g., failed login attempts) across multiple accounts and trigger alarms. In that scenario, CloudWatch Logs metric filters on centralized application logs would be appropriate for real-time alerting, not for immutable audit trails of API changes.

Why candidates choose this

Candidates may think CloudWatch Logs can serve as a centralized audit tool because it aggregates logs, but they overlook that application logs do not capture the full API request/response details needed for IAM policy changes, and they are not immutable.

✗Enable AWS Config only and store periodic snapshots without CloudTrail management events.Wrong answer — click to see why▾

Why this is wrong here

AWS Config stores resource configuration changes but does not capture the full API request parameters (e.g., which principal made the change or the exact parameters used), so it cannot provide the immutable audit record of API calls required for forensic investigation.

★ When this WOULD be the correct answer

A question that asks for a solution to track resource configuration changes over time and detect drift, without needing to capture API caller identity or request parameters, would make AWS Config the correct answer.

Why candidates choose this

Candidates may confuse AWS Config's configuration history with API audit logging, assuming it captures who made changes, when it only records the resulting state of resources.

Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAA-C03 Design Secure Architectures Practice Question

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

AWS S3 Storage Class Comparison

Related to this question