SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a production AWS account that contains sensitive data. The security team wants to ensure that no one can disable AWS CloudTrail or delete the CloudTrail S3 bucket. Which THREE actions should be taken to protect these resources? (Choose three.)
⚠ Common exam trap
The trap here is that candidates often overlook the need for multiple complementary controls (MFA delete, S3 Object Lock, and SCPs) and instead choose a single measure like IAM groups or cross-account storage, which do not fully address the requirement to prevent disabling or deletion of CloudTrail and its S3 bucket.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable multi-factor authentication (MFA) delete on the S3 bucket.
Enabling MFA delete on the S3 bucket adds an extra layer of security, requiring multi-factor authentication for any delete operations on the bucket or its objects. This prevents unauthorized or accidental deletion of the CloudTrail log bucket, even if an attacker gains full IAM permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use IAM groups to restrict access to CloudTrail and S3.
Why it's wrong here
IAM policies can be bypassed by users with higher privileges; SCPs are more effective.
- ✓
Enable multi-factor authentication (MFA) delete on the S3 bucket.
Why this is correct
MFA delete adds an extra layer of protection to prevent accidental or malicious deletion.
- ✓
Configure S3 bucket versioning and enable S3 Object Lock.
Why this is correct
Versioning preserves objects, and Object Lock prevents deletion or overwrite.
- ✓
Attach a service control policy (SCP) to the account that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.
Why this is correct
SCPs can block actions on CloudTrail even for the root user.
- ✗
Store CloudTrail logs in a separate account that only the security team can access.
Why it's wrong here
While this is a good practice, it does not protect the trail itself in the production account.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.