SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company uses AWS Organizations with hundreds of accounts. The security team wants to ensure that no account can disable AWS CloudTrail or delete CloudTrail log files. Which preventive control should be implemented?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a service control policy (SCP) that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.
Service control policies (SCPs) are the only preventive control that can centrally deny actions across all accounts in an AWS Organization. SCPs affect all users and roles, including the root user, and can block the ability to stop CloudTrail logging or delete trails. Option A (AWS Config rules) is detective and can trigger remediation, but it is not preventive; remediation can fail or be bypassed. Option C (IAM policy) only applies within an account and does not prevent actions by the root user or external roles. Option D (resource-based policy) cannot be applied to CloudTrail trails to deny actions; CloudTrail supports resource-based policies for delivery notifications (SNS) but not to control trail management actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Config rules to detect and remediate any changes to CloudTrail configurations.
Why it's wrong here
AWS Config rules are detective, not preventive. They can detect changes and trigger remediation, but they cannot prevent the initial action from occurring.
- ✓
Apply a service control policy (SCP) that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.
Why this is correct
Correct. A service control policy (SCP) can deny the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions across all accounts in the organization, providing a preventive control that applies to all principals including the root user.
- ✗
Create an IAM policy that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail for all IAM users.
Why it's wrong here
IAM policies are account-specific and do not apply to the root user or to actions performed via assumed roles. They are not a centralized preventive control across all accounts.
- ✗
Apply a resource-based policy to the CloudTrail trail that denies these actions.
Why it's wrong here
CloudTrail trails do not support resource-based policies that control who can stop logging or delete the trail. Resource-based policies are used for other AWS services such as S3 buckets or SNS topics.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using AWS Organizations to manage multiple accounts. The security team wants to ensure that no one can disable AWS CloudTrail or delete CloudTrail log files across any account. What is the most effective way to enforce this?
easy- A.Use an SCP to require that CloudTrail is enabled.
- B.Use IAM policies in each account to deny the same actions.
- C.Use AWS Config rules to detect and remediate changes.
- ✓ D.Attach an SCP to the root OU that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteObject actions for the CloudTrail S3 bucket.
Why D: Service Control Policies (SCPs) in AWS Organizations can be attached to the root organizational unit (OU) to centrally deny specific actions across all accounts, including the management account. By denying `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`, and `s3:DeleteObject` on the CloudTrail S3 bucket, the security team ensures that no principal in any account can disable CloudTrail or delete log files, regardless of their IAM permissions. SCPs are the only mechanism that can enforce such guardrails across all accounts in an organization without requiring per-account configuration.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.