CLF-C02 Security and Compliance Practice Question
Which AWS service allows you to monitor API calls made in your AWS account, including who made the call, from which IP address, and when?
⚠ Common exam trap
Test-takers frequently confuse CloudWatch (for monitoring metrics and logs) with CloudTrail (for auditing API calls), because both involve logging, but CloudTrail is specifically designed for recording API activity with caller identity and source IP details.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail is the service that records API activity in your AWS account, capturing details such as the identity of the caller, the source IP address, and the timestamp of each API call. This makes it the correct choice for monitoring who made a call, from where, and when.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon CloudWatch
Why it's wrong here
Amazon CloudWatch is an operational monitoring service that collects and tracks metrics, logs, and alarms from AWS resources and applications. While it can display logs or metrics that indirectly reflect activity, it does not record the audit trail of who made an API call, from which source IP, or what parameters were used. CloudWatch Logs can ingest CloudTrail events if you configure streaming, but the event data originates from CloudTrail—not from CloudWatch's own capture.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail is the service that continuously records and stores every API call made on your account, including management events and select data events. For each event it captures the identity of the caller (IAM user/role), the source IP, the time of the call, the action taken, and the request/response details. This makes CloudTrail the authoritative source for auditing, compliance, and security investigation—exactly what the question is asking for.
- ✗
VPC Flow Logs
Why it's wrong here
VPC Flow Logs capture metadata about IP traffic flowing to and from network interfaces in a VPC, including source/destination IP, port, protocol, and whether the traffic was accepted or rejected. They are based on network packets, not AWS API activity, and therefore contain no information about IAM identities, API actions, or request parameters. A suspicious network flow does not reveal which user triggered that API call.
- ✗
AWS Config
Why it's wrong here
AWS Config provides a detailed inventory of your AWS resources and records their configuration states and changes over time. It evaluates those configurations against compliance rules, helping you understand what a resource looked like at a given moment. However, Config does not record the API call that initiated the change, nor does it capture the caller’s identity or source IP; that requires CloudTrail's API-level event history.
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.