SAA-C03 practice question: Multi-account governance and auditing (2 of 2)

Design Secure Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A bank runs 60 accounts in AWS Organizations, and new accounts are added most months. Auditors require a record of every management API call in every account and Region, kept in one central location. Administrators of member accounts must not be able to stop or change the logging, and the bank must be able to prove later that no delivered log file was altered or removed. Which TWO actions meet these requirements? (Choose two.)

Choose two answers.

A. From the management account, create an all-Region organisation trail that delivers logs to an S3 bucket in a dedicated log archive account.
B. Turn on log file integrity validation for the trail, and keep the digest files in the log archive bucket together with the log files.
C. Use CloudFormation StackSets to create a multi-Region trail in each member account that delivers to an S3 bucket in the log archive account.
D. Turn on CloudTrail Insights for the trail so that unusual API call volumes and error rates in member accounts are flagged automatically.
E. Rely on CloudTrail event history in each account, and have the auditors use the console to search the last 90 days of management events.

Show the answer and explanation

Answers: A, B

A. Right: Correct. An organisation trail logs every member account, including accounts added later, to one bucket. Users in member accounts can see the trail but cannot delete it, turn logging off or change it. Learn more: Creating a trail for an organization (opens in a new tab)
B. Right: Correct. CloudTrail then delivers signed, hourly digest files that hold a SHA-256 hash of each log file. Validating against them shows whether any log file was changed or deleted after delivery. Learn more: Validating CloudTrail log file integrity (opens in a new tab)
C. Wrong: The logs would be central, but each trail belongs to its member account, so that account's administrators could stop logging or delete the trail. An organisation trail cannot be changed from member accounts. Learn more: Creating a trail for an organization (opens in a new tab)
D. Wrong: Insights spots unusual patterns in API call rates and error rates. It does not stop administrators from changing logging, and it cannot prove whether log files were altered. Integrity validation does that. Learn more: Working with CloudTrail Insights (opens in a new tab)
E. Wrong: Event history is kept per account and per Region for only 90 days, so it is neither central nor a lasting record. Auditors would have to search 60 accounts one by one. An organisation trail to a central bucket is needed. Learn more: Working with CloudTrail event history (opens in a new tab)

Explanation

An organisation trail created from the management account (or a delegated administrator) logs every member account, adds new accounts automatically, and cannot be changed from member accounts. Log file integrity validation adds signed digest files so you can prove whether any log file was modified or deleted after delivery.

SAA-C03 practice question: Multi-account governance and auditing (2 of 2)

Explanation

Study

Keep practising