SCS-C02 · Question #233
A company has configured an organization in AWS Organizations for its AWS accounts. AWS CloudTrail is enabled in all AWS Regions. A security engineer must implement a solution to prevent CloudTrail fr
The correct answer is C. Create an SCP that includes an explicit Deny rule for the StopLogging action and the DeleteTrail. Service Control Policies (SCPs) in AWS Organizations allow you to set permissions guardrails for accounts within an organization. By creating an SCP with an explicit Deny rule for the StopLogging and DeleteTrail actions, the security engineer can ensure that no one in the organiz
Question
A company has configured an organization in AWS Organizations for its AWS accounts. AWS CloudTrail is enabled in all AWS Regions. A security engineer must implement a solution to prevent CloudTrail from being disabled. Which solution will meet this requirement?
Options
- AEnable CloudTrail log file integrity validation from the organization's management account.
- BEnable server-side encryption with AWS KMS keys (SSE-KMS) for CloudTrail logs. Create a
- CCreate an SCP that includes an explicit Deny rule for the StopLogging action and the DeleteTrail
- DCreate IAM policies for all the company's users to prevent the users from performing the
How the community answered
(27 responses)- A4% (1)
- B4% (1)
- C81% (22)
- D11% (3)
Explanation
Service Control Policies (SCPs) in AWS Organizations allow you to set permissions guardrails for accounts within an organization. By creating an SCP with an explicit Deny rule for the StopLogging and DeleteTrail actions, the security engineer can ensure that no one in the organization, regardless of their individual permissions, can stop or delete CloudTrail logs. Attaching this SCP to the root Organizational Unit (OU) will apply this restriction across all accounts, thereby preventing CloudTrail from being disabled.
Topics
Community Discussion
No community discussion yet for this question.