AWS Certified Security - Specialty SCS-C02 — Topic 1 Question 251

Question

A company has configured an organization in AWS Organizations for its AWS accounts. AWS CloudTrail is enabled in all AWS Regions. A security engineer must implement a solution to prevent CloudTrail from being disabled. Which solution will meet this requirement?

Accepted Answer

Correct answer: C. The correct answer is C. Option C: Create an SCP that includes an explicit Deny rule for the StopLogging action and the DeleteTrail action. Attach the SCP to the root OU. Service Control Policies set guardrails on what accounts in an organization can do.

AWS Certified Security - Specialty SCS-C02 — Question 251