A company uses an organization in AWS Organizations with a dedicated security account. All activity across all member accounts must be logged centrally to the dedicated security account and retained securely for 2 years with no deletions or modifications allowed. Which combination of steps meets these requirements with the least operational overhead? (Choose two.)

Creating an AWS CloudTrail organization trail is the most efficient way to centralize logging from all member accounts with minimal operational overhead. This single trail automatically logs activity from all current and future accounts in the organization. Delivering these logs to an S3 bucket in the dedicated security account centralizes them. Enabling S3 Object Lock in compliance mode on this S3 bucket with a 2-year retention period ensures logs cannot be deleted or modified for the required duration, meeting the immutability requirement. The bucket policy must allow member accounts (or the CloudTrail service acting on their behalf) to write to the bucket. The incorrect option suggesting a bucket policy allowing only the management account to write is wrong because CloudTrail organization trails deliver logs from all member accounts. An S3 Lifecycle configuration only expires objects; it doesn't prevent deletion or modification, failing the immutability requirement. Enabling CloudTrail in each account and using Lambda/Kinesis Data Firehose is overly complex and has higher operational overhead than an organization trail.