CCSP Cloud Security Operations Practice Question
A security engineer needs to ensure that all API calls made to AWS resources are logged for auditing purposes. Which AWS service should be enabled to capture management events, data events, and provide log file validation?
⚠ Common exam trap
A common mistake is to confuse the service that generates logs (CloudTrail) with services that store or analyze logs (CloudWatch Logs, GuardDuty), leading candidates to select CloudWatch Logs as the primary logging service for API calls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail is the correct service because it is specifically designed to log API calls and actions taken within an AWS account, capturing management events (e.g., creating or deleting resources) and data events (e.g., S3 object-level operations). It also provides log file validation through digital signatures using SHA-256 hashing and RSA, ensuring the integrity and authenticity of the log files after they have been delivered.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon CloudWatch Logs
Why it's wrong here
CloudWatch Logs stores application and resource log streams but does not record API activity events or provide log file validation. CloudTrail delivers management events, data events and digest-based validation. CloudWatch Logs is right when you need to query and alarm on custom application log output.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail captures API activity across AWS resources, covering both management events and, when configured, data events such as S3 object operations. Its log file validation feature produces digest files proving logs were not altered after delivery, satisfying the auditing and tamper-evidence requirements stated in the stem.
- ✗
AWS Config
Why it's wrong here
AWS Config records resource configuration changes and evaluates compliance rules, not API call history. It captures state, not who invoked which action. Config is the correct choice when you must track configuration drift or assess resource compliance against defined rules.
- ✗
AWS GuardDuty
Why it's wrong here
GuardDuty is a threat-detection service that analyses CloudTrail, VPC and DNS logs to surface malicious activity; it does not itself log API calls or validate log integrity. GuardDuty is correct when the requirement is identifying compromised credentials or anomalous behaviour rather than audit capture.
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.