SCS-C02 Question 151
Single answerAn organization uses AWS services for its workloads and wants to monitor and audit its infrastructure for security compliance. They require a solution that provides immutable logs, near real-time log updates, and detailed information about API activity across their AWS environment. Which service or combination of services should they use to meet these requirements?
- A
AWS CloudTrail
- B
Amazon CloudWatch Logs
- C
AWS Config
- D
AWS CloudTrail Lake
Show answer and explanation
Correct answer: A
Explanation
AWS CloudTrail is specifically designed to log all API calls made within an AWS environment, providing detailed, immutable logs for security auditing and compliance purposes. It is the best choice for the scenario described, as it meets the organization's need for immutable logs, near real-time updates, and API activity tracking. Other services, such as CloudWatch Logs or AWS Config, have complementary but distinct purposes that do not fully address the scenario's requirements.
- A. Correct.
AWS CloudTrail is the correct service for monitoring API activity across AWS accounts. It provides detailed logs of API calls, ensures immutability, and supports near real-time delivery when integrated with other services like Amazon CloudWatch.
- B. Incorrect.
Amazon CloudWatch Logs is a powerful tool for log monitoring and analysis but does not provide API activity details or immutability by itself. It is more focused on application and system logs.
- C. Incorrect.
AWS Config tracks configuration changes and compliance for AWS resources but does not provide detailed API activity logs or immutability of those logs.
- D. Incorrect.
AWS CloudTrail Lake is an advanced feature of CloudTrail that allows querying and analyzing logs but does not replace the foundational AWS CloudTrail service for API activity logging.