A CloudSec-Pro administrator needs to ensure that all API activity across an AWS organization is captured for security analysis and cannot be disabled by a compromised account. The organization has 50 accounts and requires a single, immutable log destination. Which AWS service should be configured as the primary audit log source?
An organization trail applies to all accounts in the AWS Organization and delivers events to a central S3 bucket, typically in a dedicated logging account. This prevents individual account administrators from disabling logging, providing immutable, centralized audit records that CloudSec-Pro can ingest and analyze.
Why this answer
An AWS CloudTrail organization trail is the correct choice because it automatically applies to all accounts in the organization and delivers events to a central S3 bucket that can be protected with bucket policies and S3 Object Lock. This ensures comprehensive, tamper-resistant API audit logging across the entire AWS Organization.
Exam trap
The trap here is assuming that any logging service can serve as an audit log, when only CloudTrail records API activity and supports organization-wide, immutable delivery.