These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
SAA-006
You operate multiple AWS accounts. You want to centrally review the configuration change history of each account from an audit account. Which service is the most appropriate?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: A. AWS CloudTrail
Explanation
AWS CloudTrail records the API operation history within an AWS account. By aggregating trails across an organization, it can be used for auditing.
Per-choice explanations
A. AWS CloudTrail
Correct. It is used to track API operation history and configuration changes.
B. Amazon ElastiCache
Incorrect. ElastiCache is an in-memory cache.
C. Amazon EFS
Incorrect. EFS is shared file storage.
D. Amazon SQS
Incorrect. SQS is a message queue and is not primarily an audit log service.
Practical Use
AWS CloudTrail is an audit log service that records API operations, console operations, and SDK operations within an AWS account. Management events (such as creating an IAM user, launching an EC2 instance, or deleting an S3 bucket) are retained by default for 90 days. By creating an additional Trail that stores them in an S3 bucket for the long term, you can meet longer-term audit requirements. When combined with AWS Organizations to enable an Organization Trail, you can aggregate trails from all accounts under the organization into a single S3 bucket (in the management account or delegated administrator account) and review them across accounts from the audit account. The distinction from similar services is a frequent topic. CloudWatch's main purpose is collecting and visualizing metrics and logs (application logs, system logs); AWS Config's main purpose is the change history of resource configurations and continuous evaluation of whether the configuration meets compliance rules; CloudTrail's main purpose is the operational trail of "who called what API, and when." Combining the three to compose detection (CloudWatch Logs Insights / EventBridge rules), evaluation (Config Rules), and tracking (CloudTrail) is the basic shape of enterprise auditing. On SAA-C03, CloudTrail (Organization Trail) is the correct answer for requirements such as "centrally review the operation history of multiple accounts" or "aggregate API call trails for auditing." Distractors often try to create confusion with CloudWatch or Config. In particular, the phrase "configuration change history" can evoke Config, but when you want to track changes including API calls, CloudTrail is required.