CLF-C02 Cloud Technology and Services Practice Question
A financial services company needs to maintain a tamper-proof audit log of all financial transactions for regulatory compliance. Which AWS service is most appropriate?
⚠ Common exam trap
Many exam-takers confuse AWS CloudTrail's log file integrity validation with a tamper-proof ledger, but CloudTrail is for API activity logging and does not provide the immutable, cryptographically chained journal that QLDB offers for application-level transaction records.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon QLDB
Amazon QLDB (Quantum Ledger Database) is purpose-built to provide a cryptographically verifiable, immutable, and tamper-proof transaction log. It uses a journal that stores every change as a series of entries, and each entry is chained using a hash, making it impossible to alter or delete past records without detection. This aligns directly with the financial services requirement for an audit log that must be tamper-proof for regulatory compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon RDS with transaction logging
Why it's wrong here
Amazon RDS with transaction logging (e.g., MySQL binlogs or PostgreSQL WAL) supports point-in-time recovery and replication, but it is not designed as a tamper-proof audit ledger. These logs are operational artifacts that can be overwritten, disabled, or purged by a database administrator, and they lack cryptographic hash-chaining to make historical modifications detectable. RDS provides no mathematical guarantee of data immutability, so it cannot satisfy strict financial regulatory requirements.
- ✗
Amazon DynamoDB with global tables
Why it's wrong here
Amazon DynamoDB with global tables replicates data across AWS Regions for low-latency access and high availability, but it does not provide an immutable journal. DynamoDB tables are freely updateable and deletable through normal APIs, and there is no built-in cryptographic proof that earlier versions of an item have remained unchanged. While you could implement custom versioning, DynamoDB's native features are about durability and availability, not tamper-evident audit history.
- ✓
Amazon QLDB
Why this is correct
Amazon QLDB is a purpose-built ledger database with an append-only journal that cryptographically chains every revision to the previous one, creating an immutable and mathematically verifiable history. Each stored document revision is hashed, and any alteration, insertion, or deletion in the journal can be detected by recomputing hashes and comparing against the digests. QLDB also supports SQL-like PartiQL queries and provides an audit trail that is verifiable by external parties, making it ideal for financial applications that must prove data integrity to regulators.
- ✗
AWS CloudTrail with log file integrity validation
Why it's wrong here
AWS CloudTrail with log file integrity validation records AWS API activity, not application-level business transactions. Its hash chaining only proves that CloudTrail's own log files haven't been altered after delivery, but it does not provide a tamper-evident, cryptographically verifiable history of data changes made by your application. The financial audit trail required here concerns your transaction data, not who called EC2 or S3 APIs, so CloudTrail's scope is fundamentally different.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.