SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company is implementing a multi-account strategy using AWS Organizations. They want to centralize CloudTrail logs from all accounts into a single S3 bucket in the management account. Which TWO steps are required to achieve this? (Choose two.)
⚠ Common exam trap
Many exam-takers assume cross-account access requires IAM roles (Option B) or replication (Option A), but CloudTrail's organization trail uses S3 bucket policies with the CloudTrail service principal, not IAM roles, to enable direct log delivery from all member accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a CloudTrail trail in the management account with the 'Enable for all accounts in my organization' option.
The 'Enable for all accounts in my organization' option in CloudTrail automatically creates a trail that applies to all accounts in the AWS Organization, delivering logs from every account to the specified S3 bucket in the management account without requiring per-account configuration. Option E is correct because the S3 bucket policy must explicitly grant the CloudTrail service principal (cloudtrail.amazonaws.com) permission to write objects from any AWS account in the organization, ensuring cross-account delivery succeeds.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use S3 replication to copy logs from member account buckets to the central bucket.
Why it's wrong here
Replication adds complexity and is not the recommended method.
- ✗
Create an IAM role in each member account that allows CloudTrail to write to the central bucket.
Why it's wrong here
CloudTrail uses the bucket policy, not an IAM role, for cross-account delivery.
- ✗
Enable AWS Config in each member account to forward logs to the central bucket.
Why it's wrong here
AWS Config does not forward CloudTrail logs.
- ✓
Create a CloudTrail trail in the management account with the 'Enable for all accounts in my organization' option.
Why this is correct
This allows CloudTrail to deliver logs from all accounts to the management account's bucket.
- ✓
Configure the S3 bucket policy to grant the CloudTrail service principal write access from all accounts.
Why this is correct
The bucket policy must allow 'cloudtrail.amazonaws.com' to write objects from any account in the organization.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A global company is using a multi-account AWS Organizations setup with a centralized logging account. They want to aggregate CloudTrail logs from all accounts into a single S3 bucket in the logging account. Which combination of steps will meet this requirement?
medium- A.Create an IAM role in each account that allows the logging account to assume and copy logs. Schedule a Lambda function to copy logs hourly.
- B.Create an S3 bucket in the logging account with a bucket policy that grants read/write access to all accounts. Configure each account's CloudTrail to deliver to that bucket.
- ✓ C.Create a CloudTrail trail in the management account that applies to all accounts in the organization, and specify the S3 bucket in the logging account as the destination.
- D.Enable AWS Config in each account and stream configuration history to a centralized S3 bucket.
Why C: AWS Organizations allows you to create a single CloudTrail trail in the management account that automatically applies to all member accounts. By specifying the S3 bucket in the centralized logging account as the destination, CloudTrail delivers logs from every account directly to that bucket without needing cross-account IAM roles or manual copying. This leverages the organization trail feature, which simplifies log aggregation and ensures consistent logging across the entire organization.
Variation 2. A company is implementing a multi-account strategy using AWS Organizations. They need to centralize logging of all API calls across accounts. Which solution meets this requirement with the least operational overhead?
medium- A.Enable CloudWatch Logs in each account and stream to a central log group.
- B.Create a CloudTrail trail in each account and aggregate logs to a central S3 bucket.
- ✓ C.Create an organization trail in the management account with CloudTrail.
- D.Enable S3 server access logs on all accounts and send to a central bucket.
Why C: AWS Organizations supports creating an organization trail in the management account that automatically logs API calls for all member accounts without requiring per-account configuration. This centralizes logging with minimal operational overhead, as CloudTrail handles the aggregation across the organization.
Variation 3. A company uses AWS Organizations with a management account and several member accounts. The security team wants to ensure that all member accounts have AWS CloudTrail enabled and that logs are delivered to a centralized S3 bucket in the management account. What should they do?
easy- ✓ A.Create a CloudTrail trail in the management account that applies to all accounts in the organization.
- B.Use AWS CloudFormation StackSets to deploy a CloudTrail configuration to all accounts.
- C.Enable CloudTrail in each member account and configure it to deliver logs to the management account's S3 bucket.
- D.Apply an SCP to require CloudTrail to be enabled in all accounts.
Why A: AWS CloudTrail supports organization trails, which can be created in the management account and automatically apply to all member accounts within the AWS Organization. This ensures that all accounts have CloudTrail enabled and logs are delivered to a centralized S3 bucket in the management account without requiring per-account configuration.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.