A company has configured an organization in AWS Organizations for its AWS accounts. AWS CloudTrail is enabled in all AWS Regions. A security engineer must implement a solution to prevent CloudTrail fr

Question

Options

• AEnable CloudTrail log file integrity validation from the organization's management account.
• BEnable server-side encryption with AWS KMS keys (SSE-KMS) for CloudTrail logs. Create a
• CCreate a service control policy (SCP) that includes an explicit Deny rule for the
• DCreate IAM policies for all the company's users to prevent the users from performing the

• A
  7% (2)
• B
  10% (3)
• C
  79% (23)
• D
  3% (1)

Explanation

AWS CloudTrail is a foundational security service that records API activity and account events. According to the AWS Certified Security - Specialty Official Study Guide, the only way to centrally and reliably prevent CloudTrail from being disabled across multiple AWS accounts is by using AWS Organizations service control policies (SCPs). SCPs define the maximum available permissions for all accounts in an organization or organizational unit. By creating an SCP with an explicit Deny for the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions and attaching it to the root OU, the security engineer ensures that no principal in any member account--including administrators--can stop or delete CloudTrail trails. Explicit denies in SCPs cannot be overridden by IAM permissions.

No community discussion yet for this question.