A security engineer needs to configure monitonng and auditing for AWS Lambda. Which combination of actions using AWS services should the security engineer take to accomplish this goal? (Choose two.)

Question

Options

• AUse AWS Config to track configuration changes to Lambda functions, runtime environments,
• BUse AWS CloudTrail to implement governance, compliance, operational, and risk auditing for
• CUse Amazon Inspector to automatically monitor for vulnerabilities and perform governance,
• DUse AWS Resource Access Manager to track configuration changes to Lambda functions,
• EUse Amazon Macie to discover, classify, and protect sensitive data being executed inside the

• A
  87% (20)
• C
  4% (1)
• E
  9% (2)

Explanation

AWS Config (A) tracks configuration changes to Lambda functions over time - recording when runtime environments, IAM roles, memory settings, or other attributes change - making it ideal for configuration auditing and compliance drift detection. AWS CloudTrail (B) logs all API calls made to Lambda (who invoked it, when, from where), directly satisfying governance, compliance, and operational auditing requirements. Together, these two services form the standard AWS monitoring-and-auditing pair for Lambda.

Why the distractors are wrong:

• C (Inspector): Amazon Inspector scans for software vulnerabilities and network exposure in EC2 and container workloads - it does not perform governance or configuration auditing for Lambda.
• D (Resource Access Manager): RAM is for sharing AWS resources across accounts, not tracking configuration changes.
• E (Macie): Macie discovers and classifies sensitive data in S3 - it has no visibility into Lambda execution or configuration.

Memory tip: Think "Config = What changed, CloudTrail = Who did what." For any AWS auditing question, if the scenario involves configuration drift → Config, and API activity/governance → CloudTrail. These two almost always appear together as the correct auditing combo on the exam.

No community discussion yet for this question.