Match each AWS service to its primary function.
Drag a concept onto its matching description — or click a concept then click the description.
Monitoring and observability
API activity logging
Resource compliance and configuration tracking
Best practice recommendations
Operational management and automation
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
CloudTrail: Records API activity for auditing
AWS CloudTrail records API calls for auditing; AWS Config evaluates resource configurations; AWS Trusted Advisor gives recommendations. Common confusions involve swapping CloudTrail and Config functions.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
CloudTrail: Records API activity for auditing
Why this is correct
AWS CloudTrail is a governance service that captures a chronological record of every API call made by users, roles, and AWS services across your account. Each event includes the identity of the caller, the source IP address, the requested action, and resource details, making it indispensable for auditing, security investigations, and compliance reporting. It delivers logs to Amazon S3 and CloudWatch Logs for retention and automated analysis.
Config: Evaluates resource configurations against policies
Why this is correct
AWS Config is a configuration assessment service that continuously records and evaluates the state of your AWS resources against desired baseline configurations and compliance rules. It detects configuration changes and compares each resource's attributes to managed or custom rules, then produces a compliance status per resource. This enables you to validate that infrastructure remains aligned with organizational policies, such as encryption requirements or tag standards.
Trusted Advisor: Provides recommendations for cost optimization and security
Why this is correct
AWS Trusted Advisor is an advisory service that examines your AWS account's operational posture and provides best-practice recommendations across five categories: cost optimization, performance, security, fault tolerance, and service limits. It performs automated checks on resources such as unused load balancers, open security groups, and underutilized Amazon EBS volumes, then offers actionable guidance on improving efficiency and reducing risk. Some detailed checks require Business or Enterprise support level.
CloudTrail: Monitors resource configurations for compliance
Why it's wrong here
AWS CloudTrail does not monitor resource configurations for compliance because its purpose is to record API activity, not to evaluate the resulting state of resources. It captures events such as CreateBucket or ModifyInstanceAttribute, but it lacks the rules engine needed to compare resource properties against a desired policy. AWS Config is the service that continuously evaluates configuration state and produces compliance findings.
Config: Records API activity for audit trail
Why it's wrong here
AWS Config does not record API activity; that is the function of AWS CloudTrail. Config's job is to assess resource configurations by capturing configuration history and evaluating it against rules, answering whether a resource is compliant. While Config can integrate with CloudTrail to obtain API-level context for configuration changes, Config itself does not produce an audit trail of API calls.
Go deeper
About these practice questions
One of 1,169 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.