PAS-C01 Operations and Maintenance Practice Question
An SAP administrator needs to ensure that all API calls made to create, modify, or delete AWS resources are logged for auditing. Which AWS service should be enabled?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail logs API calls. Option A (CloudWatch) is for monitoring metrics. Option C (Config) is for resource configuration. Option D (GuardDuty) is for security threats.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon CloudWatch
Why it's wrong here
CloudWatch monitors performance, not API calls.
- ✓
AWS CloudTrail
Why this is correct
CloudTrail records all API activity for auditing.
- ✗
AWS Config
Why it's wrong here
Config evaluates resource configurations, not API calls.
- ✗
Amazon GuardDuty
Why it's wrong here
GuardDuty detects threats, not auditing.
Go deeper
Related to this question
About these practice questions
One of 1,616 original PAS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on PAS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An SAP administrator needs to ensure that all API calls made to AWS services are logged for auditing purposes. Which AWS service should be enabled?
easy- A.AWS Config
- ✓ B.AWS CloudTrail
- C.Amazon CloudWatch Logs
- D.VPC Flow Logs
Why B: AWS CloudTrail records API calls for auditing. Option A is incorrect because AWS Config monitors configuration changes. Option C is incorrect because Amazon CloudWatch Logs is for storing log data. Option D is incorrect because VPC Flow Logs capture network traffic information.
Variation 2. An SAP system administrator needs to ensure that all API calls made to AWS services by the SAP system are logged for security auditing. Which AWS service should be enabled?
easy- A.AWS Config
- B.Amazon CloudWatch
- C.VPC Flow Logs
- ✓ D.AWS CloudTrail
Why D: AWS CloudTrail logs all API calls made to AWS services, enabling security auditing. Option A is incorrect because AWS Config tracks configuration changes, not API calls. Option B is incorrect because Amazon CloudWatch monitors performance metrics and logs, but does not log API calls specifically. Option C is incorrect because VPC Flow Logs capture network traffic metadata, not API calls.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.