Examkin

Question

Difficulty: MediumAWS Management, Governance, and Developer Tools

A company wants to track changes made to their AWS resource configurations over time and audit which IAM user or service made the API calls that initiated those changes. Which of the following AWS services should the company use to meet these requirements? (Select TWO.)

  1. AWS ConfigAnswer
  2. AWS CloudTrailAnswer
  3. C
    Amazon CloudWatch
  4. D
    AWS Elastic Beanstalk
  5. E
    AWS CloudFormation

Answer

AWS Config and AWS CloudTrail
The service that tracks AWS resource configuration history and evaluates compliance is AWS Config. The service that records API activity and tracks the identity of users making changes is AWS CloudTrail. Using these two services together provides a complete audit trail of what changed and who changed it.

Step-by-Step Solution

1
Identify the requirement to track AWS resource configurations and their history over time.
AWS Config is identified as the primary service designed to record resource configuration histories and evaluate compliance against guidelines.
AWS Config monitors and records configuration changes, allowing administrators to see how resources were configured at any point in time.
2
Identify the requirement to audit API activity and determine who or what made the API calls causing the changes.
AWS CloudTrail is identified as the primary service that captures API activity, including the identity of the caller and the time of the event.
AWS CloudTrail provides an audit log of all actions taken via the AWS Management Console, SDKs, CLI, or other AWS services.

Key Concept

Distinguishing between AWS auditing, configuration monitoring, and performance monitoring services.
Rate this question

Topics

AWS Management, Governance, and Developer Tools

More questions from this topic