AWS Certified Cloud Practitioner (CLF-C02)Security and ComplianceMedium
A compliance analyst needs to view a timeline showing how the configuration of a specific Amazon EC2 security group changed over the past six months, including a snapshot of its settings at each point in time. Which AWS service provides this capability?
- AAWS Trusted Advisor
- BAWS CloudTrail
- CAWS Config
- DAmazon GuardDuty
Show answer & explanationAnswer & explanation
Correct answer: C. AWS Config
AWS Config continuously records resource configuration changes and maintains a configuration history/timeline, letting you view a resource's state at any past point in time. CloudTrail logs API calls (who did what) but does not store configuration snapshots over time.
Why the other options are wrong
- A. Trusted Advisor gives best-practice recommendations, not historical config tracking.
- B. CloudTrail records API activity, not historical configuration snapshots.
- D. GuardDuty detects threats, not configuration history.
AWS Config Configuration Timeline
AWS Config records resource configuration changes over time, enabling review of a resource's configuration history and compliance status.
- Config records configuration snapshots and change history
- Config Rules evaluate compliance continuously
- Different from CloudTrail, which logs API calls
Memory trick: Config = configuration snapshots; CloudTrail = call log