DOP-C02 Monitoring and Logging Practice Question
A DevOps engineer needs to audit changes to IAM policies over the past 90 days. The engineer wants to see who made the change, what the change was, and when it occurred. Which AWS tool should be used?
⚠ Common exam trap
A common mix-up: candidates confuse AWS Config's ability to track configuration changes with CloudTrail's ability to provide a detailed audit trail of API calls, leading them to choose AWS Config for auditing who made a change, when in fact Config only shows the state change, not the identity of the actor.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail is the correct choice because it records all API calls made to the AWS environment, including IAM policy changes, and stores them as events with details such as the identity of the caller (IAM user or role), the time of the request, and the request parameters. By querying CloudTrail logs over the past 90 days, the DevOps engineer can audit who made the change, what the change was (e.g., the specific IAM policy document modification), and when it occurred.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config
Why it's wrong here
AWS Config records configuration changes for IAM policies and can show the new policy state in its configuration timeline, but it does not directly capture the principal (user or role) that made the change. To identify the actor, you must cross-reference the API call event with AWS CloudTrail, making Config insufficient as a standalone audit source for who changed the policy.
- ✗
Amazon CloudWatch Logs
Why it's wrong here
Amazon CloudWatch Logs is a centralized service for storing and querying log data, but it does not natively record AWS API calls or IAM policy changes. IAM events are only delivered to CloudWatch Logs if you configure a CloudTrail trail with a CloudWatch Logs destination, so CloudWatch Logs acts as a downstream log sink rather than the source of audit data.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail is the correct service for auditing IAM policy changes because it records every API call as an event, including the identity of the requesting principal, the timestamp, source IP, request parameters, and response elements. You can view these events directly in the CloudTrail event history or create a trail for long-term storage in S3 and analysis via CloudWatch Logs or Athena, making it the authoritative audit source.
- ✗
IAM Access Analyzer
Why it's wrong here
IAM Access Analyzer is designed to identify resources, such as S3 buckets or IAM roles, that are shared with external entities by analyzing resource policies. It generates findings about current permissions and potential external access, but it does not maintain a historical record of policy changes or capture who made those changes, so it cannot be used to audit past modifications to IAM policies.
Go deeper
Related to this question
About these practice questions
One of 251 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.