Security asks 'who terminated that EC2 instance yesterday?' Which service answers API-activity questions like this?
A.Amazon CloudWatch
CloudWatch monitors performance — it doesn't log 'who did what'.
B.AWS CloudTrail
Correct. CloudTrail is the API audit log.
C.AWS Config
Config shows what changed about a resource, not who made API calls.
D.Amazon Inspector
Inspector scans for vulnerabilities, not API activity.
Why this answer
CloudTrail records every API call — who did what, when, from where. CloudWatch is performance metrics/logs; Config tracks resource configuration changes; Inspector finds software vulnerabilities.
Correct answer: B · Last reviewed 2026-10-27
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Security Basics practice session.
Practice Security Basics