AWS Certified Solutions Architect - Associate SAA-C03 — Topic 1 Question 619

Question

A solutions architect is designing a security solution for a company that wants to provide developers with individual AWS accounts through AWS Organizations, while also maintaining standard security controls. Because the individual developers will have AWS account root user-level access to their own accounts, the solutions architect wants to ensure that the mandatory AWS CloudTrail configuration that is applied to new developer accounts is not modified. Which action meets these requirements?

Accepted Answer

Correct answer: C. The correct answer is C. Option C: Create a service control policy (SCP) that prohibits changes to CloudTrail, and attach it the developer accounts. Service Control Policies set guardrails on what accounts in an organization can do. AWS CloudTrail records API activity for auditing and governance.

AWS Certified Solutions Architect - Associate SAA-C03 — Question 619