A Company Has Several Accounts Between Different Teams and Wants

question 887

Multiple Choice

A company has several accounts between different teams and wants to increase its auditing and compliance capabilities. The accounts are managed through AWS Organizations. Management wants to provide the security team with secure access to the account logs while also restricting the possibility for the logs to be modified. How can a SysOps administrator achieve this is with the LEAST amount of operational overhead?

• A) Store AWS CloudTrail logs in Amazon S3 in each account. Create a new account to store compliance data and replicate the objects into the newly created account.
• B) Store AWS CloudTrail logs in Amazon S3 in each account. Create an IAM user with read-only access to the CloudTrail logs.
• C) From the master account, create an organization trail using AWS CloudTrail and apply it to all Regions. Use IAM roles to restrict access.
• D) Use an AWS CloudFormation stack set to create an AWS CloudTrail trail in every account and restrict permissions to modify the logs.

---

Definitions:

System Developers

Professionals who create and maintain computer systems by writing, updating, and testing software to meet specific requirements.

Operation Stage

A phase in the lifecycle of a process or project where the planned activities are being executed and managed towards achieving the desired outcome.

Testing Stage

A phase in the development process where the system or components are evaluated to determine if they meet the required specifications and function correctly.

Technical Specialists

Experts on a certain type of technology, such as databases or telecommunications.