A company is using AWS Organizations. The security team wants to ensure that no one, including the root user of member accounts, can disable AWS CloudTrail. They have applied a Service Control Policy (SCP) to the root of the organization denying the `cloudtrail:StopLogging` action. However, during an audit, they discover that an administrator in a member account was able to disable CloudTrail. What is the MOST likely reason for this?

Answer options:

The CloudTrail trail was created locally in the member account, and the administrator deleted the trail instead of stopping it.

The administrator used the AWS root user credentials of the member account, which bypasses SCPs.

The member account had an IAM policy with an explicit Allow for cloudtrail:StopLogging, which overrides the SCP.

The SCP was attached to the Workloads OU, but the member account was in the Security OU.

How to approach this question

Analyze how SCPs work and identify missing actions in the policy.

Full Answer

A.The CloudTrail trail was created locally in the member account, and the administrator deleted the trail instead of stopping it.✓ Correct

SCPs are evaluated using a default deny posture, but explicit denies override any allows. If the SCP only explicitly denies `cloudtrail:StopLogging`, an administrator with full IAM permissions can simply call `cloudtrail:DeleteTrail` or `cloudtrail:UpdateTrail` to disable logging. To properly secure CloudTrail, you should use an Organization Trail (which cannot be modified by member accounts) or deny all modification actions in the SCP.

Common mistakes

Believing the root user of a member account can bypass SCPs.

Question 32 All questions Question 34

Practice the full AWS Solutions Architect Professional SAP-C02 Practice Exam 5

75 questions · hints · full answers · grading

More questions from this exam

Q01A global enterprise is redesigning its AWS network architecture across 50 AWS accounts and 3 AWS ...Hard Q02A company uses AWS Organizations to manage multiple accounts. The security team mandates that no ...Medium Q03A financial institution requires a disaster recovery strategy for its critical trading applicatio...Hard Q04An enterprise is setting up a new multi-account AWS environment using AWS Control Tower. They nee...Medium Q05A company has a complex AWS environment with hundreds of linked accounts under AWS Organizations....Hard

View all 75 questions →