← CLF-C02·Amazon Web Services

Question 980 of 1,024

Security and Compliance →mediumMultiple ChoiceObjective-mapped

Quick Answer

The answer is AWS CloudTrail, specifically when configured as an organization trail within AWS Organizations. This is correct because CloudTrail is the native AWS service designed to record all management events—such as creating EC2 instances, modifying security groups, or deleting S3 buckets—as API calls across every account in an organization. By enabling an organization trail, you automatically capture these events from all member accounts and deliver them to a single, centralized S3 bucket, which can be encrypted with an AWS KMS key and protected from modification using bucket policies and versioning. On the AWS Certified Cloud Practitioner CLF-C02 exam, this scenario tests your understanding of CloudTrail’s role in governance and auditing, often appearing as a straightforward “which service” question with a trap that confuses CloudTrail with CloudWatch or Config. Remember the memory tip: “CloudTrail tracks the trail of API calls,” so if the requirement involves logging management events across accounts, think CloudTrail first.

CLF-C02 Security and Compliance Practice Question

This CLF-C02 practice question tests your understanding of security and compliance. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A company operates multiple AWS accounts under AWS Organizations. The security team needs to record all management events (for example, creating Amazon EC2 instances, modifying security groups, and deleting Amazon S3 buckets) across all accounts. The logs must be delivered to a single Amazon S3 bucket that is encrypted with an AWS KMS key and protected from modification. Which AWS feature should the team enable to achieve this centralized logging requirement?

Question 1mediummultiple choice

Full question →

A
AWS CloudTrail
AWS CloudTrail records API calls and can be configured as an organization trail to log activity across all accounts in AWS Organizations. It delivers log files to a specified S3 bucket, where encryption and immutability can be applied.
B
AWS Config
Why wrong: AWS Config records configuration changes and evaluates resource compliance against rules, but it does not capture every API call. It can use CloudTrail as a data source, but it is not the primary service for recording API events.
C
Amazon CloudWatch Logs
Why wrong: Amazon CloudWatch Logs is used to collect, monitor, and store log files from applications and AWS services. It does not natively record AWS API calls; CloudTrail can stream events to CloudWatch Logs, but CloudTrail itself is the service that captures the API events.
D
AWS Audit Manager
Why wrong: AWS Audit Manager helps assess your usage of AWS services against compliance requirements and generates audit reports. It relies on evidence collected from services like CloudTrail, but it does not directly record API calls.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

AWS CloudTrail

AWS CloudTrail is the correct service because it records all management events (API calls) across AWS accounts, and when configured as an organization trail in AWS Organizations, it automatically logs events from all member accounts to a single S3 bucket. This meets the requirement for centralized logging with encryption using AWS KMS and protection from modification via S3 bucket policies and versioning.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
AWS CloudTrail
Why this is correct
AWS CloudTrail records API calls and can be configured as an organization trail to log activity across all accounts in AWS Organizations. It delivers log files to a specified S3 bucket, where encryption and immutability can be applied.
Related concept
Read the scenario before looking for a memorised answer.
✗
AWS Config
Why it's wrong here
AWS Config records configuration changes and evaluates resource compliance against rules, but it does not capture every API call. It can use CloudTrail as a data source, but it is not the primary service for recording API events.
✗
Amazon CloudWatch Logs
Why it's wrong here
Amazon CloudWatch Logs is used to collect, monitor, and store log files from applications and AWS services. It does not natively record AWS API calls; CloudTrail can stream events to CloudWatch Logs, but CloudTrail itself is the service that captures the API events.
✗
AWS Audit Manager
Why it's wrong here
AWS Audit Manager helps assess your usage of AWS services against compliance requirements and generates audit reports. It relies on evidence collected from services like CloudTrail, but it does not directly record API calls.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates often confuse CloudTrail for management events with AWS Config for configuration changes, or assume CloudWatch Logs can aggregate all account logs, but only CloudTrail provides the required centralized API activity logging across an organization.

Detailed technical explanation

How to think about this question

CloudTrail organization trails use a management account to create a trail that applies to all member accounts, with log delivery to a single S3 bucket that can be encrypted with a customer-managed KMS key. The bucket policy must grant the CloudTrail service principal (cloudtrail.amazonaws.com) write access, and enabling S3 bucket versioning and MFA delete protects logs from modification or deletion. This setup ensures immutable audit logs for compliance frameworks like PCI DSS or SOC 2.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related CLF-C02 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Cloud Concepts practice questions

Practise CLF-C02 questions linked to Cloud Concepts.

Security and Compliance practice questions

Practise CLF-C02 questions linked to Security and Compliance.

Cloud Technology and Services practice questions

Practise CLF-C02 questions linked to Cloud Technology and Services.

Billing, Pricing, and Support practice questions

Practise CLF-C02 questions linked to Billing, Pricing, and Support.

AWS shared responsibility model practice questions

Practise CLF-C02 questions linked to AWS shared responsibility model.

AWS IAM practice questions

Practise CLF-C02 questions linked to AWS IAM.

AWS pricing practice questions

Practise CLF-C02 questions linked to AWS pricing.

AWS support plans practice questions

Practise CLF-C02 questions linked to AWS support plans.

AWS S3 practice questions

Practise CLF-C02 questions linked to AWS S3.

AWS EC2 practice questions

Practise CLF-C02 questions linked to AWS EC2.

Practice this exam

Start a free CLF-C02 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

CLF-C02 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this CLF-C02 question test?

Security and Compliance — This question tests Security and Compliance — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: AWS CloudTrail — AWS CloudTrail is the correct service because it records all management events (API calls) across AWS accounts, and when configured as an organization trail in AWS Organizations, it automatically logs events from all member accounts to a single S3 bucket. This meets the requirement for centralized logging with encryption using AWS KMS and protection from modification via S3 bucket policies and versioning.

What should I do if I get this CLF-C02 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more ways this is tested on CLF-C02

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A company must maintain audit records of all user actions and configuration changes across their AWS accounts. Which AWS service should they enable to capture this information?

medium

A.Amazon CloudWatch Logs
B.AWS Config
✓ C.AWS CloudTrail
D.VPC Flow Logs

Why C: AWS CloudTrail is the correct service because it records API activity and user actions across AWS accounts, providing a complete audit trail of all management and data plane operations. This includes who made changes, what actions were performed, and when they occurred, which is essential for maintaining audit records of user actions and configuration changes.

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.