Organization-wide logging (CloudTrail organization trails, log archive account): SCS-C03 study notes and practice questions
What to know about Organization-wide logging (CloudTrail organization trails, log archive account) for the SCS-C03 exam, from the Detection domain (16% of the exam guide), then 2 free questions to test it. Part of the SCS-C03 study guide.
These questions describe a company that needs a complete, tamper-resistant record of API activity across every account and Region, including accounts created later. You choose the trail design, the storage account and the protections that let an auditor trust the record even after a workload account is compromised.
The organization trail
An organization trail logs activity from every member account to one destination. Create it in the management account, or delegate CloudTrail administration to a member account. Member accounts can see the trail but cannot stop, change or delete it.
Write the trail to a bucket in a separate log archive account, so the people and roles that run workloads cannot erase their own history.
A multi-Region trail captures activity in every Region, including Regions your team rarely uses.
Management events are logged by default. Data events such as S3 object reads and Lambda invocations cost more, so add them with selectors only where the requirement calls for them.
Protecting the log bucket
Use SSE-KMS with a customer managed key when the question asks for key-level control. The key policy must allow the CloudTrail service to encrypt log files, and it should limit who can decrypt them.
Add a bucket policy that denies deletes and requests that do not use TLS.
Turn on S3 Object Lock for write-once retention. In compliance mode, nobody, including the root user, can shorten or remove the retention period.
Enable log file integrity validation, which produces digest files that prove a log file was not changed after delivery.
Member accounts cannot change the organization trail itself. Add an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail so they cannot turn off trails of their own either, and keep the bucket and its KMS key in the log archive account, where workload administrators have no rights.
How to choose
Scenario wording
Pick
One tamper-resistant record of API calls from all accounts and Regions
Organization trail to a log archive bucket
A member account admin must not be able to stop logging
Central trail plus an SCP that denies StopLogging and DeleteTrail
Prove that log files were not altered
Log file integrity validation
Record object-level reads for one sensitive bucket
Data event selectors for that bucket only
Delegate day-to-day trail management to the security team
CloudTrail delegated administrator
Run SQL over months of API activity without building a pipeline
Athena on the trail’s S3 bucket
Query API activity together with other security sources in one schema
Amazon Security Lake
CloudTrail Lake event data stores let you run SQL over activity without a separate pipeline, and the exam guide may still mention them. CloudTrail Lake is closed to new customers from May 31, 2026, so for a new design query the trail’s S3 copy with Athena, send the trail to CloudWatch Logs for Logs Insights queries and alarms, or use Amazon Security Lake.
Common traps
A trail in each account, created by hand. A new account has no logging until someone creates a trail there.
A log bucket in a workload account, where its administrators can delete the evidence.
Data events for every bucket and function without a cost decision.
SSE-S3 when the question asks for key-level control. That needs SSE-KMS with a customer managed key and a key policy.
CloudTrail Lake for a new account. It is closed to new customers; use Athena, CloudWatch Logs or Security Lake.
Confusing CloudTrail with AWS Config. CloudTrail records who made an API call; Config records how a resource’s configuration looked over time.
A regional bank runs 45 AWS accounts in one organization. Its security team keeps a log archive account, and its central policy is that no member account may change or delete the organization's audit logs, even for an administrator in that account.
The management account must create one trail that covers every account and Region. The logs must be delivered to an Amazon S3 bucket in the log archive account, encrypted with a customer managed AWS KMS key. Only CloudTrail may write to the bucket, and only for this organization.
Which configuration meets these requirements MOST securely?
Choose one answer.
AA. Have each member account create its own trail that writes to the log archive bucket. Use default S3 encryption with Amazon S3 managed keys so that the trails need no key policy changes.
BB. Create one organization trail in the management account that delivers to the log archive bucket. Add a key policy statement for CloudTrail, and a bucket policy that limits writes with aws:SourceArn.
CC. Create one organization trail in the management account, but write it to a bucket in the management account so the security team does not need access to the log archive account.
DD. Create one organization trail in the management account that delivers to the log archive bucket. Grant the bucket policy a wildcard principal with no conditions, so that every account can write its trail.
Show the answer and explanation
Answer: B
A. Wrong: Per-account trails can write to the bucket, but member accounts can stop or change their own trails, which breaks the central control. S3 managed keys also do not meet the requirement for a customer managed KMS key. Learn more: Creating a trail for an organization (opens in a new tab)
B. Right: Correct. An organization trail covers every account and Region from one place, and member accounts cannot stop or change it. The key policy lets CloudTrail encrypt with the customer managed key, and the aws:SourceArn condition limits writes to this organization trail. Learn more: Creating a trail for an organization (opens in a new tab)
C. Wrong: The trail itself is correct, but the logs would sit in the management account. That breaks the central policy that the log archive account holds the audit logs and is the only place they are written.
D. Wrong: A wildcard principal with no conditions lets any AWS account write to the bucket, which breaks the rule that only this organization may write. The trail is correct, but the bucket would accept writes from anyone.
Explanation
An organization trail, created once in the management account, covers every account and Region, and member accounts cannot switch it off. The bucket and key policies must let CloudTrail write, with conditions that limit writes to the organization trail and encryption to the customer managed key. Per-account trails, a bucket in the wrong account and a wildcard principal each break a stated requirement.
The trail lives in the management account, so member accounts cannot turn it off, and the bucket and key policies allow only that trail.
A retailer runs 60 AWS accounts. Application teams write logs to CloudWatch Logs log groups in their own accounts, and the central security team needs every application log group streamed to its SIEM, which reads from one Amazon Data Firehose delivery stream in the logging account.
The logs must reach the SIEM within a few minutes, and the team does not want to maintain any forwarding code. Teams must not give the central team IAM access to their accounts, and the setup must be repeatable in all 60 accounts from one template, so that new accounts start streaming without help from the central team.
Which solution meets these requirements?
Choose one answer.
AA. Create a subscription filter in the logging account for each application log group in the other accounts, so that the central account pulls the logs from those groups.
BB. Run a Lambda function in each account that reads every new log event, batches it, retries failures, and forwards it to the Firehose stream in the logging account.
CC. In the logging account, create the Firehose stream, a Logs destination for it, and a destination policy for the organization. Create a subscription filter to that destination in each source account.
DD. Export each application log group to an Amazon S3 bucket once per day, using an export task scheduled in each account, and have the SIEM read the exported files from that bucket in batches.
Show the answer and explanation
Answer: C
A. Wrong: A subscription filter must be created in the account that owns the log group, and it cannot pull logs from other accounts. This option would also give the central team access into every application account.
B. Wrong: This can deliver the events, but the function is forwarding code that the team would maintain in 60 accounts, which it wants to avoid. A subscription filter sends the events without custom code.
C. Right: Correct. A cross-account destination lets each source account send log events to the logging account without any access into it, and the destination policy limits who may subscribe. The subscription filters deploy from one template, so new accounts start streaming without help from the central team. Learn more: Real-time subscriptions for CloudWatch Logs (opens in a new tab)
D. Wrong: Daily exports are far slower than the few-minute requirement. Export tasks also do not stream, so the SIEM would receive the logs late and in large batches.
Explanation
Real-time delivery across accounts uses a destination in the logging account, with a policy that names the accounts allowed to subscribe, and a subscription filter in each source account. The setup is repeatable from one template and needs no access into the application accounts. Subscriptions created in the wrong account, custom forwarders and daily exports each miss a requirement.
Want more on Organization-wide logging (CloudTrail organization trails, log archive account)? The 5 full-length practice sets have 7 more Organization-wide logging (CloudTrail organization trails, log archive account) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Organization-wide logging (CloudTrail organization trails, log archive account)