SAP-C02 Practice Question: Design Solutions for Organizational Complexity

A financial services company has an AWS Organizations structure with production and development OUs. The security team wants to prevent any IAM principal in the development OU from disabling AWS CloudTrail logging, even if an account administrator attempts it. They need a solution that applies automatically to all existing and future accounts in the development OU. What should they do?

⚠ Common exam trap

The trap here is assuming that an organization trail alone prevents disabling, when in fact it only centralizes logging and does not block account-level trail modifications.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create an SCP that denies the cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail actions, and attach it to the development OU.

Service control policies (SCPs) are the only AWS Organizations mechanism that can enforce preventive guardrails across all accounts in an OU, including future accounts. By denying the specific CloudTrail actions that stop, delete, or modify a trail, the SCP ensures that even account administrators cannot disable logging. This meets the requirement for automatic, centralized enforcement without per-account configuration.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Attach an IAM policy to each account's administrator role that denies CloudTrail stop and delete actions, and use AWS CloudFormation StackSets to deploy it.
Why it's wrong here
IAM policies attached to a role can be modified or detached by an account administrator with sufficient permissions, so they do not provide a hard boundary. StackSets can deploy policies across accounts, but they do not automatically apply to new accounts unless configured with auto-deployment, and even then, an administrator could alter the policy. This does not prevent the action at the organization level.
✓
Create an SCP that denies the cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail actions, and attach it to the development OU.
Why this is correct
SCPs attached to an OU apply to all member accounts, including future ones, and restrict the maximum permissions for all principals in those accounts. Denying StopLogging, DeleteTrail, and UpdateTrail prevents any IAM principal, including account administrators, from disabling or altering CloudTrail, satisfying the requirement without per-account changes.
✗
Enable AWS CloudTrail organization trail in the management account and configure S3 bucket policies to deny trail modifications.
Why it's wrong here
An organization trail logs activity across accounts but does not prevent an account administrator from stopping or deleting a trail within their own account. S3 bucket policies control access to log storage, not the trail configuration itself. This approach does not enforce the preventive control required, and it also does not automatically apply to future accounts in the OU.
✗
Use AWS Config rules in each account to detect when CloudTrail is disabled and trigger an AWS Lambda function to re-enable it.
Why it's wrong here
AWS Config rules are detective, not preventive; they evaluate configuration after a change and can trigger remediation, but there is a delay during which logging is off. This does not meet the requirement to prevent disabling. Additionally, deploying and maintaining Config rules and Lambda functions in every account adds operational overhead and does not automatically cover future accounts.

Go deeper

SAP-C02 Practice Question: Design Solutions for Organizational Complexity

Why each option matters

Option-by-option breakdown

Related to this question