CLF-C02 Cloud Technology and Services Practice Question
Which AWS service provides an immutable, cryptographically verifiable transaction log for tracking the complete history of changes to application data?
⚠ Common exam trap
A common mix-up: candidates confuse AWS CloudTrail's immutable logging of API calls with an application-level immutable transaction log, but CloudTrail does not track application data changes or provide a cryptographically verifiable ledger.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon QLDB (Quantum Ledger Database)
Amazon QLDB (Quantum Ledger Database) provides an immutable, append-only journal that records every change to application data. It uses cryptographic hashing to chain entries together, creating a verifiable history that cannot be altered or deleted, which is exactly what the question describes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon Managed Blockchain
Why it's wrong here
Amazon Managed Blockchain is a fully managed service for creating and managing decentralized blockchain networks (Hyperledger Fabric or Ethereum) shared across multiple organizations under consensus rules. In contrast, QLDB is a centralized ledger database with a trusted single authority (you) and does not require a distributed consensus protocol. For a use case that only needs a tamper-evident history without multi-party trust, QLDB is the right fit, making Managed Blockchain unnecessarily complex and incorrect here.
- ✗
Amazon RDS with point-in-time recovery
Why it's wrong here
Amazon RDS point-in-time recovery allows you to restore a relational database to a specific time, which is used for disaster recovery and data recovery, not for creating an immutable audit trail. With RDS, your application can still overwrite or delete records at any time, and there is no built-in hash-chained verification of every change. While you could add triggers or manual logging to mimic auditing, that is not a native, cryptographically verifiable ledger, so this option fails the requirement.
- ✓
Amazon QLDB (Quantum Ledger Database)
Why this is correct
Amazon QLDB is a purpose-built ledger database that maintains a complete, immutable history of every data change in an application's data, not just a simple audit log. It uses a cryptographic hash chain, where each journal block contains the hash of the previous block, making any tampering immediately discoverable. This is the correct choice because it directly provides a centrally owned, cryptographically verifiable and append-only transaction history for application data.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail is an API auditing service that records every AWS API call made on your account, such as who created or terminated a resource. While it supports log file integrity validation using hashes, it is designed to answer questions about AWS control-plane activity, not to track changes to data stored inside an application database. Therefore, it cannot provide a tamper-evident record of your application's data mutations, making it incorrect for this use case.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.