Apply | AWS Practice

Choose one answer

A security team needs persistent API audit records from every member account and enabled Region. Workload administrators must not be able to modify the trail or delete the only log copy. Which design is best?

Create a multi-Region organization trail that delivers to a protected SSE-KMS bucket in a log archive account with least-privilege bucket and key policies.Rely on the CloudTrail Event history page in each account.Let each workload administrator create a single-Region trail in the same workload account.Send only CloudWatch application metrics to the management account.