AWS Certified DevOps Engineer - Professional DOP-C02 — Topic 1 Question 292

Question

A security team wants to use AWS CloudTrail to monitor all actions and API calls in multiple accounts that are in the same organization in AWS Organizations. The security team needs to ensure that account users cannot turn off CloudTrail in the accounts. Which solution will meet this requirement?

Accepted Answer

Correct answer: A. The correct answer is A. Option A: Apply an SCP to all OUs to deny the cloudtrail:StopLogging action and the cloudtrail:DeleteTrail action. Service Control Policies set guardrails on what accounts in an organization can do. AWS CloudTrail records API activity for auditing and governance.

AWS Certified DevOps Engineer - Professional DOP-C02 — Question 292