Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 78 discussion

Exam question from Amazon's AWS Certified Security - Specialty SCS-C02

Question #: 78
Topic #: 1

[All AWS Certified Security - Specialty SCS-C02 Questions]

A company plans to create individual child accounts within an existing organization in AWS Organizations for each of its DevOps teams. AWS CloudTrail has been enabled and configured on all accounts to write audit logs to an Amazon S3 bucket in a centralized AWS account. A security engineer needs to ensure that DevOps team members are unable to modify or disable this configuration.

How can the security engineer meet these requirements?

A. Create an IAM policy that prohibits changes to the specific CloudTrail trail and apply the policy to the AWS account root user.
B. Create an S3 bucket policy in the specified destination account for the CloudTrail trail that prohibits configuration changes from the AWS account root user in the source account.
C. Create an SCP that prohibits changes to the specific CloudTrail trail and apply the SCP to the appropriate organizational unit or account in Organizations.
D. Create an IAM policy that prohibits changes to the specific CloudTrail trail and apply the policy to a new IAM group. Have team members use individual IAM accounts that are members of the new IAM group.

Show Suggested Answer

Suggested Answer: C 🗳️

by oioi at Nov. 23, 2023, 8:41 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

7c84836

11 months, 1 week ago

why not D?

upvoted 1 times

helloworldabc

9 months ago

just C

upvoted 1 times

...

Raphaello

1 year, 3 months ago

Selected Answer: C

Correct answer is C. Use SCP to deny changes to the specific trail, apply the policy to designated OU or accounts.

upvoted 3 times

...

vikasj1in

1 year, 5 months ago

SCPs in AWS Organizations are used to set fine-grained permissions and restrictions on AWS accounts within an organization. They operate at the root level or organizational unit level. the security engineer can enforce a policy at the organizational level, ensuring that no accounts under the specified organizational unit can make modifications or disable the CloudTrail configuration.While IAM policies and S3 bucket policies can control access to resources, they are typically more focused on granting permissions rather than restricting actions on CloudTrail trails globally across the organization. Option C, using an SCP, provides centralized control and is well-suited for enforcing organization-wide policies. It ensures that even if DevOps team members have administrative permissions in their individual accounts, they won't be able to modify or disable the specified CloudTrail trail due to the SCP restrictions.

upvoted 1 times

...