SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a multi-account AWS environment with hundreds of accounts. The central IT team needs to audit all API calls made in the organization. The solution must be cost-effective and capture events from all regions and accounts, including future accounts. Which solution should the company use?
⚠ Common exam trap
Test-takers frequently confuse AWS Config (resource configuration tracking) with CloudTrail (API call logging), or assume per-account trails are simpler, missing the cost and scalability benefits of an organization trail.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an organization trail in the management account that logs all events to an S3 bucket with a bucket policy granting access to all accounts.
An organization trail in the management account automatically applies to all existing and future accounts and regions within AWS Organizations, capturing all management events without per-account configuration. It delivers logs to a single S3 bucket, and the bucket policy grants read access to all accounts, making it cost-effective by avoiding duplicate trails and reducing storage overhead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an organization trail in the management account that logs all events to an S3 bucket with a bucket policy granting access to all accounts.
Why this is correct
Organization trail automatically captures all accounts and future accounts.
- ✗
Use AWS Config to record API calls and deliver to a central S3 bucket.
Why it's wrong here
AWS Config records configuration changes, not all API calls.
- ✗
Enable CloudTrail in each account and configure each trail to deliver logs to a central S3 bucket.
Why it's wrong here
Requires manual enablement and maintenance for each account.
- ✗
Use VPC Flow Logs to capture API calls and send to a central S3 bucket.
Why it's wrong here
VPC Flow Logs capture network traffic, not API calls.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.