AWS SAP-C02 · Question 28 · Domain 1.4: Multi-Account Environment
A company has a centralized logging account. They want to ensure that AWS CloudTrail logs from all 100 member accounts in their Organization are sent to an S3 bucket in the logging account, and member account admins cannot disable this. What is the BEST solution?
Answer options:
Create a CloudTrail trail in each account and configure cross-account S3 permissions.
Create an Organization Trail in the management account.
Use AWS Config to enforce CloudTrail enablement.
Use an SCP to deny the cloudtrail:StopLogging action.
75 questions · hints · full answers · grading
Expert