AWS Certified Cloud Practitioner (CLF-C02)Security and ComplianceEasy
A new cloud administrator wants to know which AWS service records the API calls made within an AWS account, including which IAM identity made each call, the source IP address, and the timestamp, for auditing purposes.
- AAWS CloudTrail
- BAmazon Inspector
- CAWS Config
- DAmazon CloudWatch
Show answer & explanationAnswer & explanation
Correct answer: A. AWS CloudTrail
AWS CloudTrail records API activity across an AWS account, capturing who made a call, what action was taken, and when it occurred. CloudWatch monitors performance metrics and logs, while Config tracks resource configuration state, not API call history.
Why the other options are wrong
- B. Inspector scans for vulnerabilities, unrelated to API auditing.
- C. Config tracks resource configuration changes, not who called which API.
- D. CloudWatch monitors metrics, logs, and alarms, not API call history.
AWS CloudTrail
A service that logs and retains account activity, recording API calls made through the console, SDKs, CLI, and other AWS services.
- Captures who, what, when, and source IP of API calls
- Enabled by default for the last 90 days of management events
- Can deliver logs to S3 for long-term retention and analysis
Memory trick: CloudTrail = the trail of footprints left by every API call.