Update _questionnaire.md

Author: iru

use-cases/_questionnaire.md

@@ -15,23 +15,17 @@ modules, and we also offer [AWS Cloudformation templates](https://github.com/sys
 
 ## Client Infrastructure
 
-- does your company work under an organization (AWS/GCP) or tenant (Azure)?
+- does your company work under an **organization** (AWS/GCP) or tenant (Azure)?
   - if so, how many member accounts (aws) /projects (gcp) /subscriptions (azure) does it have?
+- sysdig secure for cloud is presented in different **compute workload** flavors; ecs on aws, cloudrun on gcp or azure container instances on azure, plus a K8s deployment an all three clouds, plus apprunner on aws (less resource-demaing than ecs, but region limited) 
+    - in case of ECS or K8S, do you have an existing cluster you would like to re-use?
+- (aws-only) do you have ** existing aws cloudtrail**, is it an organizational cloudtrail?
+    - does the cloudtrail report to an SNS?
+    - if it's not organizational, does each trail report to the same s3 bucket?
 - how do you handle permissions? any restriction we may be aware of? do you want us to set them up for you or would you just require a guidance and you will set them yourself?
-
 - deployment type
   - are you familiar with the installation stack? Terraform, Cloudformation, AWS CDK, ...?
-  - if you want to use Kubernetes workload for Sysdig deployment, what's your current way of deploying helm charts?
-
-
-
-### AWS
-  - do you have an existing cloudtrail?
-    - if yes, is it an organizational cloudtrail?
-      - does the cloudtrail report to an SNS?
-    - if it's not organizational, does each trail report to the same s3 bucket?
-  - sysdig secure for cloud is presented in different workload flavor; ECS, K8S or Apprunner, would you have any preference?
-    - in case of ECS or K8S, do you have an existing cluster you would like to re-use?
+  - if you want to use Kubernetes compute for Sysdig deployment, what's your current way of deploying helm charts?
 
 
 ## Sysdig Features
@@ -52,8 +46,8 @@ In what [Sysdig For Cloud Features](https://docs.sysdig.com/en/docs/sysdig-secur
 
 |                   | Single                                                            |  Organizational |
 | --| -- | -- |
-| Deployment Type   | All Sysdig resources will be deployed within the selected account |  Most Sysdig resources will be deployed within the selected account, but some require to be deployed on member-accounts (for Compliance and Image Scanning)
+| Deployment Type   | All Sysdig resources will be deployed within the selected account |  Most Sysdig resources will be deployed within the selected account, but some require to be deployed on member-accounts (for Compliance and Image Scanning) and one role is needed on the management account for cloudtrail event access |
 | Benefits          | Will only analyse current account                                 |  Handles all accounts (managed and member)
-| Drawbacks         | Cannot re-use another account Cloudtrail data (unless its deployed on the same account where the sns/s3 bucket is) | --
+| Drawbacks         | Cannot re-use another account Cloudtrail data (unless its deployed on the same account where the sns/s3 bucket is) | for scanning, a per-member-account access role is required 
 
 With both examples `single` and `org`, you can customize the desired features to de deployed with the `deploy_*` input vars to avoid deploying more than wanted