SAP-C03 practice question: Centralized security logging (organization trails, Security Lake, GuardDuty) (1 of 2)
Security, Compliance, and Governance A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A streaming company runs about 60 AWS accounts across four Regions. The security team needs a record of every management event in every account and Region, kept in one bucket in a dedicated log archive account. Each account is owned by a product team that has its own administrators.
Administrators in the member accounts must not be able to stop the logging or change the bucket, and accounts created next quarter must be covered without anyone setting up a trail for them.
Which solution meets these requirements?
Choose one answer.
AA. Have each account create its own CloudTrail trail that writes to a bucket in that account, and set each bucket's policy to read-only for the account's administrators.
BB. Create a trail in each account, and configure S3 replication from each account's bucket to the log archive bucket, so that copies of all logs end up in one place.
CC. Create an organization trail in the management account that logs all Regions and writes to a bucket in the log archive account, with a bucket policy that only the security team can change.
DD. Turn on Amazon EventBridge in each account and forward every API call to an event bus in the security account, and keep the events there for the audit period.
Show the answer and explanation
Answer: C
A. Wrong: Each account administrator can still stop or change the local trail, and the logs are split across 60 buckets. New accounts also need their own trail set up by hand.
B. Wrong: Member administrators can stop the trail or delete the source logs before replication runs. Each new account still needs a trail created for it.
C. Right: Correct. An organization trail records management events for every member account and Region, and member account administrators cannot stop or change it. The bucket sits in the log archive account, outside the members' control, and new accounts are covered automatically.
D. Wrong: EventBridge routes events but does not keep the management event history the way a trail does. Member accounts can also change or disable the forwarding rules.
Explanation
An organization trail gives one centrally managed record of management events for all accounts and Regions, delivered to a bucket that member administrators cannot change. Per-account or replicated trails leave the logging in the members' control, and EventBridge is not an audit record.
Member administrators cannot change the trail or the bucket, so the security team keeps one trusted record of every account and Region.
Want more on Centralized security logging (organization trails, Security Lake, GuardDuty)? The 5 full-length practice sets have 7 more Centralized security logging (organization trails, Security Lake, GuardDuty) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →