A security team must ensure no member account can disable CloudTrail or remove itself from the organization. Which control enforces this at the organization level?
A.IAM policies in each account
Account admins can modify local IAM — not a guarantee.
B.An SCP denying cloudtrail:StopLogging/DeleteTrail and organizations:LeaveOrganization
Correct. SCPs are the enforcement boundary member accounts can't escape.
C.CloudWatch alarms on CloudTrail events
Alarms detect after the fact — and can themselves be disabled.
D.A tagging policy requiring audit tags
Tag policies govern tagging, not API permissions.
Why this answer
SCPs applied at the org/OU level set maximum permissions member accounts can exercise — including blocking tampering with audit trails and leaving the org. Local IAM can't override an SCP.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Security Governance practice session.
Practice Security Governance