SAA-C03 Design Secure Architectures Practice Question
A SOC analyst needs an immutable, centralized audit record of configuration and API changes across multiple AWS accounts. Recently, an operator changed an IAM role trust policy, and investigators must determine exactly which principal made the change and which parameters were used.
Your current setup sends application logs to CloudWatch Logs, but there is no organization-level API audit logging.
Which approach best satisfies the requirement?
⚠ Common exam trap
Watch out — candidates often confuse AWS Config's configuration tracking with CloudTrail's API-level auditing, or assume GuardDuty provides detailed request parameters, but only CloudTrail management events capture the full principal identity and API call details required for forensic analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable an AWS Organizations CloudTrail organization trail that delivers management event logs (including IAM) to a centralized S3 bucket in a dedicated audit account, for all regions.
An AWS Organizations CloudTrail organization trail captures management events (including IAM API calls like ChangeTrustPolicy) across all accounts and regions, storing immutable logs in a centralized S3 bucket in a dedicated audit account. This provides the exact principal ARN, source IP, and request parameters needed for forensic investigation, meeting the immutable and centralized audit requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable an AWS Organizations CloudTrail organization trail that delivers management event logs (including IAM) to a centralized S3 bucket in a dedicated audit account, for all regions.
Why this is correct
Enabling an AWS Organizations CloudTrail organization trail is the authoritative method for capturing all AWS API calls, including IAM policy changes, across all accounts within an organization. This trail delivers immutable management event logs to a centralized S3 bucket in a dedicated audit account, ensuring comprehensive, tamper-proof records for forensic analysis and compliance across all AWS regions. This provides the necessary "who, what, when, where" details for every API action.
- ✗
Use CloudWatch Logs metric filters on application logs to infer which principals changed trust policies.
Why it's wrong here
CloudWatch Logs metric filters operate on log data already ingested into CloudWatch Logs. While CloudWatch can ingest CloudTrail logs, relying on *application logs* to infer AWS management API calls for IAM changes is fundamentally flawed. Application logs typically record application-specific events, not AWS control plane actions, making this approach unreliable, incomplete, and not an authoritative source for auditing AWS service interactions like IAM policy modifications.
- ✗
Rely on GuardDuty alerts to provide the full request parameters for every IAM policy change.
Why it's wrong here
AWS GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior by analyzing various data sources, including CloudTrail events. However, GuardDuty focuses on identifying *suspicious patterns* and *potential threats*, not on providing a comprehensive, detailed audit trail of *every* IAM policy change, benign or otherwise. It does not consistently provide the full request parameters for all IAM policy modifications, which is crucial for a complete audit record.
- ✗
Enable AWS Config only and store periodic snapshots without CloudTrail management events.
Why it's wrong here
AWS Config records configuration changes and compliance status of AWS resources, providing a historical view of *what* a resource's configuration looked like at different points in time. While it tracks changes to IAM policies, it does not log the detailed *API call* that initiated the change, including the principal, source IP, and full request parameters. Without CloudTrail management events, the crucial audit trail of *who* performed the action and *how* is missing, making it insufficient for a complete audit record.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 302 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.