SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company wants to centralize logging from multiple AWS accounts into a single Amazon S3 bucket. The logging accounts are part of an AWS Organization. Which approach should be used to allow CloudTrail to deliver logs from all accounts to the central bucket?
⚠ Common exam trap
Candidates often confuse SCPs with resource-based policies, thinking an SCP can grant cross-account write access to an S3 bucket, when in reality only the bucket policy (or a combination of bucket policy and IAM) can authorize CloudTrail's service principal from another account.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the central S3 bucket policy to allow CloudTrail from all accounts in the organization to write logs.
CloudTrail can deliver logs from all accounts in an AWS Organization to a single central S3 bucket by configuring the bucket policy to grant the CloudTrail service principal (cloudtrail.amazonaws.com) from each member account the s3:PutObject permission. This approach leverages the organization's trusted access, eliminating the need for individual IAM roles or cross-account assumptions, as CloudTrail automatically uses the organization's management account to validate member account identities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the central S3 bucket policy to allow CloudTrail from all accounts in the organization to write logs.
Why this is correct
A bucket policy with a condition for AWS:SourceOrgID allows all accounts in the organization.
- ✗
Use a VPC endpoint and route logs through a central VPC.
Why it's wrong here
CloudTrail logging does not require VPC endpoints.
- ✗
Attach an SCP to allow CloudTrail to write to the central bucket.
Why it's wrong here
Attaching an SCP is incorrect because Service Control Policies enforce permission guardrails on principals *within* member accounts, not on cross-account resource access. SCPs cannot grant CloudTrail the necessary write permissions to a central S3 bucket in another account; that requires a specific S3 bucket policy. This option is tempting as SCPs are crucial for centrally governing maximum permissions across an AWS Organisation, for example, preventing accounts from disabling CloudTrail or restricting resource creation.
- ✗
Create an IAM role in each member account and allow the central account to assume it.
Why it's wrong here
CloudTrail does not use IAM roles to deliver logs; it uses resource-based policies.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.