A retail enterprise with 45 AWS accounts in Organizations needs tamper-evident audit trails for all Regions, centralized in a log archive account, with KMS encryption and log file validation enabled. Security requires no gaps from new accounts or Regions. Which CloudTrail logging design ensures complete organization coverage?
Select an answer to reveal the explanation.
Short Explanation
You need one net that catches every account and Region, not scattered trails. An organization trail automatically covers new accounts, while validation and KMS encryption make the central archive tamper-evident and protected.
Full Explanation
A multi-Region organization trail with log file validation and KMS encryption meets the requirements together: created from the management or delegated administrator account, it covers current and future organization accounts across Regions and sends validated, KMS-encrypted logs to one central archive bucket. An organization trail with KMS encryption across all Regions provides centralization, encryption, and broad coverage, but without log file validation it lacks signed digest files to help prove logs were not modified after delivery. An organization trail with validation across all Regions provides coverage and integrity, but without the specified KMS encryption it does not meet the customer-managed-key requirement for key-policy auditing and regulatory separation. Account trails with validation and KMS encryption can send logs to a central bucket, but new accounts and Regions require manual enrollment, so delays or missed setup can leave gaps. As an exam caveat, assess scope, integrity, and encryption independently; meeting two does not satisfy the third, and Insights or data events are not substitutes for the required management-event trail. As a practical check, confirm logging is on and validation is enabled, verify fresh digest files and KMS-encrypted objects arrive in the archive bucket, and review bucket and key policies for least privilege.