SCS-C02 Management and Security Governance Practice Question
A company has an AWS Organization with hundreds of accounts. The security team wants to enforce that no account can disable AWS CloudTrail logging. Which TWO approaches can achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable CloudTrail as a trusted service and create an organization trail.
Options A and C are correct. An SCP can deny the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions (C), and enabling CloudTrail as a trusted service with an organization trail (A) prevents individual accounts from stopping or modifying the trail. Option B is wrong because IAM policies are account-specific and cannot be enforced across all accounts. Option D is wrong because AWS Config can detect and remediate, but cannot prevent the initial disabling. Option E is wrong because CloudWatch Logs alerts do not prevent disabling CloudTrail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable CloudTrail as a trusted service and create an organization trail.
Why this is correct
Organization trails cannot be stopped or deleted by member accounts.
- ✗
Apply an IAM policy to each account's root user to prevent disabling CloudTrail.
Why it's wrong here
IAM policies cannot be applied to the root user in a way that prevents all users in the account.
- ✓
Create an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.
Why this is correct
SCPs can deny these actions to all accounts.
- ✗
Use AWS Config to automatically re-enable CloudTrail if it is disabled.
Why it's wrong here
Config can remediate but not prevent the disable action.
- ✗
Configure CloudWatch Logs to monitor CloudTrail logs and alert if logging stops.
Why it's wrong here
Alerts do not prevent disabling.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.