Security wants automatic detection of unusual API activity patterns — spikes in DeleteBucket calls or IAM changes outside normal baselines — rather than just logging events. Which CloudTrail feature?
A.CloudTrail event history
Event history is raw search — no anomaly detection.
B.CloudTrail Insights
Baseline anomaly detection = Insights. Correct.
C.CloudTrail log file validation
Validation proves log integrity — not behavioral detection.
D.AWS Config timeline
Config tracks resource config changes, not API call patterns.
Why this answer
CloudTrail Insights analyzes write API calls against baselines and flags unusual activity automatically (insight events) — the 'detect anomalies in the trail' feature, vs raw event history which is just lookup.
Correct answer: B · Last reviewed 2026-11-05
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Logging & Audit practice session.
Practice Logging & Audit