SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company uses AWS Organizations with a management account and several member accounts. The security team wants to ensure that all member accounts have AWS CloudTrail enabled and that logs are delivered to a centralized S3 bucket in the management account. What should they do?
⚠ Common exam trap
Test-takers frequently think SCPs can enforce positive actions like enabling a service, but SCPs only deny or allow actions and cannot proactively configure resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a CloudTrail trail in the management account that applies to all accounts in the organization.
AWS CloudTrail supports organization trails, which can be created in the management account and automatically apply to all member accounts within the AWS Organization. This ensures that all accounts have CloudTrail enabled and logs are delivered to a centralized S3 bucket in the management account without requiring per-account configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a CloudTrail trail in the management account that applies to all accounts in the organization.
Why this is correct
Organization trail simplifies management.
- ✗
Use AWS CloudFormation StackSets to deploy a CloudTrail configuration to all accounts.
Why it's wrong here
CloudFormation StackSets are incorrect because they deploy individual CloudTrail configurations within each member account, rather than establishing a single organisation trail managed centrally from the management account. This means StackSets do not inherently enforce that all logs are aggregated to a specific S3 bucket in the management account as an organisation-wide trail does. It is tempting because StackSets are ideal for deploying and standardising common resources, such as IAM roles or specific monitoring configurations, across multiple accounts and regions from a central point.
- ✗
Enable CloudTrail in each member account and configure it to deliver logs to the management account's S3 bucket.
Why it's wrong here
Cross-account delivery is not directly supported without additional setup.
- ✗
Apply an SCP to require CloudTrail to be enabled in all accounts.
Why it's wrong here
SCPs cannot enable services.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.