SCS-C03 Identity and Access Management Practice Question
A security engineer needs to prevent IAM users from disabling CloudTrail. Which policy element is most appropriate?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an SCP to explicitly deny 'cloudtrail:StopLogging' for the organization.
Using an explicit 'Deny' on the 'cloudtrail:StopLogging' action in a Service Control Policy (SCP) or a Permission Boundary is the most effective way to prevent even administrators from disabling logging. By applying this as a guardrail, you ensure that audit integrity is maintained regardless of individual user privileges. This is crucial for compliance, as it creates an immutable audit trail that security teams can rely on during incident investigations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an IAM policy that denies 'cloudtrail:StopLogging' to all users.
Why it's wrong here
An IAM policy attached to a user cannot prevent them from modifying their own policy if they have 'iam:PutUserPolicy' permissions. To be truly effective, the 'Deny' must be placed in an SCP or a Permission Boundary that the user cannot modify, ensuring the guardrail is truly enforced.
- ✓
Use an SCP to explicitly deny 'cloudtrail:StopLogging' for the organization.
Why this is correct
SCPs are the perfect tool for organizational-wide guardrails. By applying a 'Deny' on 'cloudtrail:StopLogging' at the organization level, you ensure that no user or role, including administrative roles, can disable CloudTrail. This provides a central, immutable security control that meets stringent regulatory requirements for consistent logging across the entire enterprise.
- ✗
Enable MFA Delete on all CloudTrail S3 buckets.
Why it's wrong here
MFA Delete is for preventing the deletion of objects within an S3 bucket, not for preventing the disabling of the CloudTrail service itself. While important for log integrity, it does not stop a user from calling the 'StopLogging' API, which would halt the collection of new logs.
- ✗
Restrict access to the CloudTrail console via IAM groups.
Why it's wrong here
Restricting console access is insufficient, as the user could still use the AWS CLI or SDK to stop logging. Effective security controls must be applied at the API level using policies, not just by hiding console UI elements, which provides a false sense of security while leaving the back door open.
About these practice questions
Courseiva writes every SCS-C03 question from scratch — 99 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.