Which TWO services record WHO did WHAT and WHEN in an AWS account — forming the audit trail for security investigations? (Select TWO.)
Choose 2 answers.
A.AWS CloudTrail
Correct. CloudTrail is the canonical who-did-what audit service.
B.AWS Config
Correct. Config provides the configuration-change history trail.
C.Amazon GuardDuty
GuardDuty analyzes logs to detect threats — it doesn't record the audit trail itself.
D.Amazon Macie
Macie scans S3 for sensitive data — discovery, not audit.
E.VPC Flow Logs
Flow Logs record network flows (source/dest/ports), not API activity.
Why this answer
CloudTrail logs every API call (who/what/when) — the primary audit trail. Config records resource configuration history and changes — complementary audit for 'what changed and when'. GuardDuty detects threats; Macie finds sensitive data; Flow Logs capture network traffic, not API attribution.
Correct answers: A, B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Logging & Audit practice session.
Practice Logging & Audit