A company needs to identify who accessed an AWS service and what action was performed for a given time period. Which AWS service should the company use to meet this requirement?

Question

Options

• AAmazon CloudWatch
• BAWS CloudTrail
• CAWS Security Hub
• DAmazon Inspector

• A
  2% (1)
• B
  87% (39)
• C
  9% (4)
• D
  2% (1)

Explanation

AWS CloudTrail is the correct choice because it records API calls and account activity across AWS services, capturing who made a request (user identity), what action was taken, when it occurred, and from where - exactly what the question asks for.

Why the distractors are wrong:

• A. Amazon CloudWatch monitors resource performance and metrics (CPU, logs, alarms) - it tracks how services are running, not who is accessing them.
• C. AWS Security Hub aggregates and prioritizes security findings from multiple AWS services - it's a dashboard for security posture, not an access audit trail.
• D. Amazon Inspector performs automated vulnerability assessments on EC2 instances and container images - it finds software weaknesses, not user access history.

Memory tip: Think of CloudTrail as the security camera footage of your AWS account - every API call is recorded like a timestamped log entry showing who did what and when. If you need to answer "who touched what?", CloudTrail is your answer.

No community discussion yet for this question.