Auditing AWS API Calls and IAM Changes
A SysOps administrator needs to audit all changes to IAM resources in their AWS account. Which THREE AWS services can be used together to achieve this? (Choose THREE.)
Quick Answer
The answer is CloudTrail, AWS Config, and Amazon CloudWatch Logs. CloudTrail records all IAM API calls, providing a detailed audit trail of who made what change and when, while AWS Config continuously tracks the configuration state of IAM resources and can trigger automated rules for compliance. CloudWatch Logs then serves as the centralized storage and monitoring layer for those CloudTrail logs, enabling real-time alerting and long-term retention. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this combination tests your understanding of the three pillars of auditing: recording (CloudTrail), tracking (Config), and monitoring (CloudWatch Logs). A common trap is choosing GuardDuty, which is for threat detection, not change auditing, or Trusted Advisor, which is for best-practice recommendations. Memory tip: think "Record, Track, Watch" — CloudTrail records, Config tracks, CloudWatch watches.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail records all IAM API calls, providing a detailed audit trail of changes. Option C is correct because AWS Config tracks changes to IAM resource configurations and can evaluate them against rules. Option E is correct because Amazon CloudWatch Logs can store and monitor CloudTrail logs, enabling alerting on specific IAM changes. Option B is wrong because Amazon GuardDuty is for threat detection, not auditing configuration changes. Option D is wrong because AWS Trusted Advisor provides best-practice checks but does not log or track changes to IAM resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS CloudTrail
Why this is correct
Records IAM API calls.
- ✗
Amazon GuardDuty
Why it's wrong here
GuardDuty is for threat detection.
- ✓
AWS Config
Why this is correct
Tracks resource changes and can evaluate rules.
- ✗
AWS Trusted Advisor
Why it's wrong here
Trusted Advisor provides recommendations, not auditing.
- ✓
Amazon CloudWatch Logs
Why this is correct
Can store and monitor CloudTrail logs.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 247 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SOA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A SysOps administrator needs to audit all API calls made in the AWS account, including actions performed by the root user. Which service should be enabled?
easy- A.AWS Config
- B.VPC Flow Logs
- ✓ C.AWS CloudTrail
- D.Amazon CloudWatch Logs
Why C: AWS CloudTrail records all API calls, including those by the root user, and delivers log files to an S3 bucket. CloudWatch Logs is for log monitoring, not auditing API calls. AWS Config records resource configuration changes, not API calls. VPC Flow Logs capture network traffic, not API calls.
Variation 2. A SysOps administrator needs to audit all changes to IAM policies in an AWS account. Which AWS service should be used to record these changes?
easy- A.Amazon CloudWatch Logs
- B.AWS Config
- ✓ C.AWS CloudTrail
- D.Amazon S3
Why C: AWS CloudTrail is the correct service because it records API activity in an AWS account, including all IAM policy changes such as creating, updating, or deleting policies. CloudTrail captures these events as JSON logs, which can be stored in an S3 bucket for auditing and analysis. This makes it the appropriate tool for auditing changes to IAM policies.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.