Which of the following is the most appropriate primary use case for AWS CloudTrail?

Explanation

CloudTrail records API operations and user activity performed within an AWS account, and the records can be used for auditing.

Per-choice explanations

Practical Use

AWS CloudTrail is a service that records API calls and management events that occur within an AWS account, and makes it possible to trace who performed which operation on which resource and when. Every operation that goes through an API is recorded, including operations from the AWS Management Console, AWS CLI, AWS SDK, and automatic calls between AWS services. Each event includes the IAM principal that performed the operation (user name or role name), the source IP address, the request parameters, and the response. It plays a central role in security incident investigations, compliance audits, and root-cause tracing of operational changes. CloudTrail has two main forms of use. One is the Event history, which lets you search management events for the past 90 days from the console without any additional configuration, and is used for initial investigations during incidents. The other is the trail, which is a setting that continuously writes logs to an Amazon S3 bucket for long-term retention at the organization or account level. It is required for production environments that have to meet compliance requirements for long-term storage. Another important point in practice is that data events (object-level operations in Amazon S3, Lambda function invocations, and so on) are not recorded by default and must be explicitly enabled. On CLF-C02, this content is asked as a question that requests the service that records the history of API operations within an AWS account, or the service that captures audit logs. Distractors include services whose purpose is different, such as Amazon S3 and CloudFront (static delivery), Amazon DynamoDB (NoSQL), and Amazon Route 53 (DNS). CloudTrail is easily confused with Amazon CloudWatch (metrics and log monitoring) and AWS Config (assessment of resource configuration state), but the coverage of each service is different. CloudTrail records API calls, CloudWatch handles metrics and application logs, and AWS Config tracks the state and change history of resource configurations. Telling the three apart is a recurring exam point.