CLF-C02 Security and Compliance Practice Question
A company must maintain audit records of all user actions and configuration changes across their AWS accounts. Which AWS service should they enable to capture this information?
⚠ Common exam trap
Watch out — candidates often confuse AWS Config's resource configuration tracking with CloudTrail's API activity logging, but Config records the 'what' (resource state) while CloudTrail records the 'who, what, when, and how' (API calls and user identity).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail is the correct service because it records API activity and user actions across AWS accounts, providing a complete audit trail of all management and data plane operations. This includes who made changes, what actions were performed, and when they occurred, which is essential for maintaining audit records of user actions and configuration changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon CloudWatch Logs
Why it's wrong here
Amazon CloudWatch Logs is a service for aggregating, monitoring, and storing log files from applications, EC2 instances, and AWS services. It does not natively record AWS API calls or capture the identity of the principal who performed an action; it is a destination for logs you choose to send, such as application logs or even CloudTrail events if explicitly configured. Without that integration, CloudWatch Logs alone cannot reconstruct an audit trail of who made which API call at what time.
- ✗
AWS Config
Why it's wrong here
AWS Config is a configuration management and compliance service that records the state of AWS resources over time and evaluates those configurations against desired policies. It tracks what a resource's configuration looks like and when it changed, but it does not capture the identity of the user or service that initiated the change. While Config provides a configuration history and can help answer 'what changed?', CloudTrail supplies the complementary 'who made the change?' by logging the actual API requests with caller details.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail is the service designed to record every AWS API call made by a user, role, or AWS service, capturing essential audit data such as the caller's identity, the source IP address, the request parameters, and the response elements. These events form a complete audit trail that can be used for security analysis, operational troubleshooting, and governance, and they can be delivered to an S3 bucket or CloudWatch Logs for long-term storage and monitoring. This makes CloudTrail the definitive answer for tracking user activity and API usage across all AWS accounts.
- ✗
VPC Flow Logs
Why it's wrong here
VPC Flow Logs capture metadata about network traffic flowing through a VPC, such as the source and destination IP addresses, ports, protocol, and the number of packets and bytes transferred, at the elastic network interface level. They are intended for network traffic analysis, troubleshooting connectivity issues, and identifying security threats, but they do not record AWS management API calls or the identities of users performing those calls. Therefore, VPC Flow Logs would not help you determine who launched an EC2 instance or changed an S3 bucket policy.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 993 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.