Which AWS service continuously records resource configurations and lets you evaluate them against desired settings — useful for compliance auditing?
A.AWS CloudTrail
CloudTrail logs who called which API — activity, not configuration state.
B.AWS Config
Correct. Config tracks configuration history and rule compliance.
C.Amazon GuardDuty
GuardDuty detects threats — detection, not config audit.
D.AWS CloudFormation
CloudFormation provisions resources — deployment, not auditing.
Why this answer
AWS Config records resource configuration changes over time and evaluates them against rules — the compliance/configuration-history service. CloudTrail logs API calls; they answer different audit questions.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Security Basics practice session.
Practice Security Basics