nerdexam
Amazon

SAP-C02 · Question #622

A financial services company sells its software-as-a-service (SaaS) platform for application compliance to large global banks. The SaaS platform runs on AWS and uses multiple AWS accounts that are…

The correct answer is C. Create a new AWS CloudTrail trail in the organization's management account. Create a new. To audit and track all AWS API calls across multiple accounts in an AWS Organization with the least operational overhead, create a single AWS CloudTrail organization trail in the management account.

Submitted by luis.pe· Mar 6, 2026Design Solutions for Organizational Complexity

Question

A financial services company sells its software-as-a-service (SaaS) platform for application compliance to large global banks. The SaaS platform runs on AWS and uses multiple AWS accounts that are managed in an organization in AWS Organizations. The SaaS platform uses many AWS resources globally. For regulatory compliance, all API calls to AWS resources must be audited, tracked for changes, and stored in a durable and secure data store. Which solution will meet these requirements with the LEAST operational overhead?

Options

  • ACreate a new AWS CloudTrail trail. Use an existing Amazon S3 bucket in the organization's
  • BCreate a new AWS CloudTrail trail in each member account of the organization. Create new
  • CCreate a new AWS CloudTrail trail in the organization's management account. Create a new
  • DCreate a new AWS CloudTrail trail in the organization's management account. Create a new

How the community answered

(57 responses)
  • A
    5% (3)
  • B
    11% (6)
  • C
    81% (46)
  • D
    4% (2)

Why each option

To audit and track all AWS API calls across multiple accounts in an AWS Organization with the least operational overhead, create a single AWS CloudTrail organization trail in the management account.

ACreate a new AWS CloudTrail trail. Use an existing Amazon S3 bucket in the organization's

A single CloudTrail trail not configured as an organization trail would only log events for the specific account it's created in, failing to audit all API calls across 'multiple AWS accounts' in the organization.

BCreate a new AWS CloudTrail trail in each member account of the organization. Create new

Creating a separate CloudTrail trail in each member account would achieve the logging, but it drastically increases operational overhead due to the need for individual management and configuration across numerous accounts, contradicting the 'LEAST operational overhead' requirement.

CCreate a new AWS CloudTrail trail in the organization's management account. Create a newCorrect

Creating an AWS CloudTrail organization trail in the management account allows it to automatically capture all API activity from all member accounts within the organization into a single Amazon S3 bucket. This centralized approach significantly reduces operational overhead for auditing, change tracking, and secure storage compared to managing individual trails in each account, ensuring comprehensive compliance.

DCreate a new AWS CloudTrail trail in the organization's management account. Create a new

This option is identical to C and provides the same correct solution to the problem.

Concept tested: Centralized AWS CloudTrail organization trails

Source: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-an-organization-trail-by-console.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SAP-C02 Practice