Exam AWS Certified SysOps Administrator - Associate topic 1 question 58 discussion

C "You can troubleshoot operational and security incidents over the past 90 days in the CloudTrail console by viewing Event history." https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events.html

AWS CloudTrail records all API activity in an AWS account, including actions taken by IAM users and their access keys. By using CloudTrail, the SysOps administrator can track exactly what actions were performed with the compromised access key, including changes to resources or account configurations, and view a detailed log of events within the specified timeframe. Other Options: Option A: Creating an EventBridge (formerly CloudWatch Events) rule for IAM events would not provide historical data about the actions already taken with the compromised key. This setup would only capture future IAM events. Option B: CloudWatch Logs Insights does not provide logs of all actions taken by IAM users and access keys across services. It is mainly used for querying logs stored in CloudWatch, such as application logs. Option D: VPC Flow Logs track network traffic but do not log specific API actions, making them unsuitable for identifying API events or actions taken with an IAM access key. Correct Answer: C

"all event" is key word for answer.

answer is C.

ccccccc