SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company uses AWS Organizations and wants to ensure that all member accounts have AWS CloudTrail enabled and logs are delivered to a central S3 bucket in the management account. Which approach is MOST efficient?
⚠ Common exam trap
Many candidates confuse the capabilities of SCPs (which only control permissions) with resource enforcement, leading them to incorrectly select Option D, not realizing that SCPs cannot create or enable resources like CloudTrail.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS CloudFormation StackSets to deploy a CloudTrail template to all accounts.
AWS CloudFormation StackSets allow you to deploy a single CloudTrail template across all member accounts in an AWS Organization from a central management account. This approach is the most efficient as it automates the deployment, ensures consistent configuration, and delivers logs to the specified central S3 bucket without requiring manual intervention or per-account scripting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Config rules to detect accounts without CloudTrail and auto-remediate.
Why it's wrong here
This is reactive and may have a delay; also Config rules require existing trails.
- ✗
Manually enable CloudTrail in each account by logging into every account.
Why it's wrong here
Not scalable for many accounts.
- ✓
Use AWS CloudFormation StackSets to deploy a CloudTrail template to all accounts.
Why this is correct
StackSets allow centralized, automated deployment of CloudTrail across accounts.
- ✗
Create an SCP that requires CloudTrail to be enabled in each account.
Why it's wrong here
SCPs can only deny or allow actions; they cannot enable services.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.