SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company uses AWS Organizations and wants to implement a policy that prevents any account from disabling AWS CloudTrail or deleting CloudTrail log files. The solution must be enforceable across all accounts. Which combination of actions should be taken?
⚠ Common exam trap
It's easy for candidates to assume an SCP alone is sufficient to protect CloudTrail logs, forgetting that SCPs do not protect the S3 bucket where logs are stored, and that IAM policies in individual accounts are ineffective against root user actions or privilege escalation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an SCP that denies cloudtrail:DeleteTrail, cloudtrail:StopLogging, and s3:DeleteObject on the log bucket. Also attach a bucket policy to the log bucket that denies s3:DeleteObject for all principals except the management account.
It combines an SCP that denies cloudtrail:DeleteTrail, cloudtrail:StopLogging, and s3:DeleteObject on the log bucket with a bucket policy that denies s3:DeleteObject for all principals except the management account. This layered approach ensures that even if an account has full administrative permissions, the SCP blocks the CloudTrail and S3 actions, while the bucket policy prevents any account (including the root user) from deleting log files, with the management account as the sole exception for recovery purposes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable CloudTrail with a trail that logs to a bucket in a separate account, and use IAM policies to deny CloudTrail deletion.
Why it's wrong here
IAM policies are not sufficient.
- ✗
Create an SCP that denies cloudtrail:DeleteTrail and cloudtrail:StopLogging, and rely on S3 versioning to recover deleted logs.
Why it's wrong here
SCP does not protect the S3 bucket.
- ✗
Create an IAM policy in each account that denies CloudTrail deletion and attach it to all IAM users and roles.
Why it's wrong here
Not centralized; may not cover all principals.
- ✓
Create an SCP that denies cloudtrail:DeleteTrail, cloudtrail:StopLogging, and s3:DeleteObject on the log bucket. Also attach a bucket policy to the log bucket that denies s3:DeleteObject for all principals except the management account.
Why this is correct
Combines SCP and bucket policy for comprehensive protection.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Organizations with multiple OUs. The security team wants to ensure that no account in the 'Production' OU can disable AWS CloudTrail or delete CloudTrail log files. Which two steps should be taken? (Choose TWO.)
medium- A.Enable AWS CloudTrail Insights to detect unusual activity.
- ✓ B.Create an SCP attached to the 'Production' OU that denies CloudTrail and S3 actions related to stopping or deleting trails and logs.
- C.Use IAM roles with a permissions boundary that restricts CloudTrail actions.
- ✓ D.Add an S3 bucket policy on the CloudTrail log bucket that denies s3:DeleteObject for all principals in the 'Production' OU.
Why B: Service Control Policies (SCPs) attached to an OU can deny specific AWS actions for all accounts within that OU, including actions like cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteObject on the CloudTrail log bucket. This ensures that no account in the 'Production' OU can disable CloudTrail or delete its log files, regardless of IAM permissions within the account. Option D is correct because an S3 bucket policy on the CloudTrail log bucket that explicitly denies s3:DeleteObject for all principals in the 'Production' OU adds a second layer of defense, preventing deletion of log files even if an account gains elevated privileges.
Variation 2. A company is using AWS Organizations with multiple OUs. The security team wants to ensure that no account can delete CloudTrail trails or S3 bucket policies. Which THREE SCP strategies should be combined?
medium- A.Use IAM policies with conditions to restrict deletion to certain IP addresses.
- ✓ B.Attach an SCP to the root that explicitly denies cloudtrail:DeleteTrail and s3:PutBucketPolicy.
- C.Attach an SCP to the root that allows all actions, and rely on IAM policies in each account.
- D.Ensure that the SCPs are evaluated in the correct order, with deny statements taking precedence.
- E.Attach an SCP that denies all actions except those necessary for CloudTrail and S3 operations.
Why B: The correct strategy is to attach an SCP to the root that explicitly denies the `cloudtrail:DeleteTrail` and `s3:PutBucketPolicy` actions. SCPs act as a service control boundary that overrides any IAM-based permissions, and explicit deny statements in SCPs cannot be overridden by any account within the organization. Option D is incorrect because SCP order does not affect evaluation; all applicable SCPs are evaluated and any explicit deny takes precedence. Option E is invalid as SCPs cannot use 'deny all except' logic; they must explicitly allow or deny specific actions.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.