SCS-C02 Question 132
Single answerA company wants to monitor and troubleshoot issues related to unauthorized API calls and suspicious activity in their AWS environment. They also want to ensure compliance by maintaining a history of API calls across all AWS accounts in the organization. Which AWS service or feature would BEST meet this requirement?
- A
AWS CloudTrail
- B
VPC Flow Logs
- C
Amazon CloudWatch Logs
- D
AWS Config
Show answer and explanation
Correct answer: A
Explanation
AWS CloudTrail is the most suitable service for this scenario because it provides a history of API calls and user activity across all AWS accounts, enabling the company to monitor unauthorized access, detect suspicious behavior, and meet compliance requirements. Other services like VPC Flow Logs, Amazon CloudWatch Logs, and AWS Config have specific use cases, but they do not fulfill the requirement of tracking API calls across the environment.
- A. Correct.
AWS CloudTrail is specifically designed to log API calls, making it the best choice for monitoring unauthorized API calls, suspicious activity, and compliance purposes. It provides a history of all API requests made within the AWS environment.
- B. Incorrect.
VPC Flow Logs capture information about IP traffic going to and from network interfaces in a VPC. While useful for network-level troubleshooting, they do not log AWS API calls or provide compliance-related call history.
- C. Incorrect.
Amazon CloudWatch Logs is a monitoring and logging service that collects log data from various sources. However, it does not natively provide a complete history of AWS API calls across accounts.
- D. Incorrect.
AWS Config tracks configuration changes and compliance of AWS resources but does not provide logging of API calls or suspicious activity detection.