These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
CLF-040
Which service do you use to determine who performed which API action and when within an AWS account?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: C. AWS CloudTrail
Explanation
AWS CloudTrail is a service that records API activity in an AWS account. It is used for auditing, security investigations, and reviewing change history.
Per-choice explanations
A. Amazon S3
Incorrect. S3 is object storage. It can be used as a destination for storing logs, but the service that records the activity itself is CloudTrail.
B. Amazon CloudFront
Incorrect. CloudFront is a CDN service. Recording API activity is not its primary purpose.
C. AWS CloudTrail
Correct. CloudTrail records API activity history.
D. AWS Budgets
Incorrect. Budgets is a budget management and cost notification service. It is not used to review API activity.
Practical Use
AWS CloudTrail is a service that records the history of API actions performed within an AWS account. It records API calls made from the AWS Management Console, the AWS CLI, the SDKs, and from AWS services themselves as events (who performed which action, when, from which IP address, and on which resource), and you can search the most recent 90 days of event history from the console. By configuring a trail that delivers to an S3 bucket, you can retain logs for longer and run log analysis. On the exam, the typical question asks which service to use to determine who performed which API action and when within an AWS account, with CloudTrail as the correct answer. Distractors that frequently appear include Amazon CloudFront (CDN), Amazon S3 (object storage), and AWS Budgets (budget alerts). None of these are primarily for recording API activity, so as long as you understand the role of each service, you can rule them out. In practice, CloudTrail is used for auditing, security investigations, and reviewing change history. When an unintended resource change occurs, CloudTrail provides the foundation to trace who did what and when. CLF-C02 frequently tests the division of roles among CloudTrail (API activity history), Amazon CloudWatch (metrics, logs, and alarms), and AWS Config (resource configuration history and compliance evaluation). Remember that CloudTrail records who called which API, CloudWatch covers resource metrics and operational logs, and Config tracks resource configuration state and how it changes. With this framing, the three services do not get confused.