A security team needs an audit trail to investigate suspicious API activity across multiple AWS accounts. Which AWS approach best provides centralized visibility into who did what, when, for service API calls?

Enable AWS Config only for EC2 security groups and rely on it for API call auditing.

AWS Config captures configuration changes and evaluations (for example, resource state and rule compliance). It is not a complete substitute for API-level auditing across all services and accounts.

Turn on S3 server access logging for every bucket and assume it covers all AWS services.

S3 server access logging records requests made to S3 buckets. It does not provide audit logs for IAM, KMS, Secrets Manager, or other service API calls.

Use only Amazon CloudWatch alarms with no logging destination to reduce storage costs.

CloudWatch alarms are for monitoring and alerting on metrics. Without a retained log destination such as CloudTrail, they do not provide the detailed “who/what/when” event records needed for investigation.

What does this SAA-C03 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Create an AWS CloudTrail organization trail that delivers logs to a centralized, access-controlled S3 bucket. — AWS CloudTrail records API and management events, capturing information such as the requesting identity (user/role), source, event time, event name, and related parameters. Using an AWS Organizations organization trail provides coverage across multiple accounts from a centralized location, which is ideal for detective and forensic investigations. Delivering logs to a hardened, access-controlled S3 bucket supports retention and later analysis. AWS Config and CloudWatch alarms can complement monitoring, but they do not provide the same API-level audit event granularity across accounts. AWS Config focuses on configuration history and compliance evaluations, not complete API activity auditing for all services. S3 access logs only cover S3 requests and cannot answer questions about other AWS service API usage. CloudWatch alarms can notify you of issues, but without retained detailed event logs, they do not provide enough information for root-cause analysis and “who did what” investigation.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.