An auditor needs a record of who queried or changed resources. What provides this?
Why C is the answer
AWS CloudTrail logs
CloudTrail records API activity.
In detail
- CloudTrail records who made API calls.
- Store logs where they cannot be altered.
Use case
An illustrative scenario, not a real incident.
An auditor asks who changed a bucket policy, and CloudTrail shows the identity and the time.
See it in different ways
flowchart TD A["Who called the API?"] --> B["AWS CloudTrail"] C["Is there personal data in S3?"] --> D["Amazon Macie"] E["Are resources compliant?"] --> F["AWS Config"]
mindmap
root((Data security))
Identity
IAM roles
Secrets Manager
Fine-grained access
Lake Formation
Column grants
Encryption
SSE-KMS
Discovery
Macie
Audit
CloudTrailflowchart LR S0["API call"] --> S1["CloudTrail logs it"] --> S2["Auditor reviews"]
Key point: CloudTrail records API activity.
Why the other options are wrong
- A. AWS Glue crawlers
- Crawlers read metadata.
- B. S3 Lifecycle rules
- Lifecycle rules move objects.
- D. Amazon Quick Sight dashboards
- Dashboards show data.