AWS CLF-C02 CloudTrail & CloudWatch
Exam Questions 2026–2027 | AWS
Monitoring, Audit Logs & Performance
Analysis Prep
1. An organization wants to record API activity across all AWS accounts in its
AWS Organizations environment. Which AWS service should be used?
A. Amazon CloudWatch
B. AWS CloudTrail
C. AWS Config
D. Amazon Inspector
Answer: AWS CloudTrail
Rationale: AWS CloudTrail records AWS API calls and account activity, making it
the primary service for auditing who performed actions, what actions were
performed, and when they occurred.
, 2. A security team needs to determine which IAM principal deleted an
Amazon S3 bucket yesterday. Which service provides the most appropriate
information?
A. Amazon CloudWatch
B. AWS CloudTrail
C. Amazon GuardDuty
D. AWS Trusted Advisor
Answer: AWS CloudTrail
Rationale: CloudTrail event history can show the API event associated with the
bucket deletion, including the identity that made the request, event time, source
IP address, and other request details.
3. Which AWS service is primarily designed to monitor metrics, logs, alarms,
and operational performance?
A. AWS CloudTrail
B. Amazon CloudWatch
C. AWS IAM
D. AWS Artifact
Answer: Amazon CloudWatch
Rationale: CloudWatch provides monitoring and observability capabilities
through metrics, logs, alarms, dashboards, and related monitoring features.
4. A company wants an alarm whenever CPU utilization on an Amazon EC2
instance exceeds 80% for five consecutive minutes. Which CloudWatch
feature should be configured?
A. CloudTrail trail
B. CloudWatch alarm
,C. CloudTrail event selector
D. CloudWatch Logs Insights query
Answer: CloudWatch alarm
Rationale: CloudWatch alarms evaluate metrics against configured thresholds
and can trigger actions when specified conditions are met.
5. Which CloudTrail feature allows API events to be delivered to an Amazon S3
bucket for long-term retention?
A. CloudWatch dashboard
B. CloudTrail trail
C. CloudWatch alarm
D. AWS Config rule
Answer: CloudTrail trail
Rationale: A CloudTrail trail can deliver recorded events to Amazon S3, allowing
organizations to retain and analyze audit information over extended periods.
6. A developer wants to view application log messages generated by an
application running on an EC2 instance. Which CloudWatch capability is
most appropriate?
A. CloudWatch Logs
B. CloudTrail Event history
C. AWS Artifact
D. IAM Access Analyzer
Answer: CloudWatch Logs
Rationale: CloudWatch Logs collects and stores log records from applications,
operating systems, AWS services, and other supported sources.
, 7. Which information is commonly included in a CloudTrail management
event?
A. The physical temperature of an AWS data center
B. The identity that made an AWS API request
C. The CPU temperature of an EC2 server
D. The number of bytes stored in an EBS volume
Answer: The identity that made an AWS API request
Rationale: CloudTrail management events provide information about control-
plane operations, including the identity associated with API requests.
8. A company wants to receive a notification when a specific IAM policy is
deleted. Which combination is most appropriate?
A. CloudTrail and CloudWatch Events/EventBridge
B. CloudWatch metrics and Amazon S3 Glacier
C. AWS Config and Amazon Route 53
D. Amazon Inspector and AWS Artifact
Answer: CloudTrail and CloudWatch Events/EventBridge
Rationale: CloudTrail records the API activity, while EventBridge can detect
matching events and initiate actions such as notifications or automated
responses.
9. What is the primary difference between CloudTrail and CloudWatch?
A. CloudTrail monitors performance, while CloudWatch records API activity
B. CloudTrail records AWS activity, while CloudWatch monitors resources and
applications
Exam Questions 2026–2027 | AWS
Monitoring, Audit Logs & Performance
Analysis Prep
1. An organization wants to record API activity across all AWS accounts in its
AWS Organizations environment. Which AWS service should be used?
A. Amazon CloudWatch
B. AWS CloudTrail
C. AWS Config
D. Amazon Inspector
Answer: AWS CloudTrail
Rationale: AWS CloudTrail records AWS API calls and account activity, making it
the primary service for auditing who performed actions, what actions were
performed, and when they occurred.
, 2. A security team needs to determine which IAM principal deleted an
Amazon S3 bucket yesterday. Which service provides the most appropriate
information?
A. Amazon CloudWatch
B. AWS CloudTrail
C. Amazon GuardDuty
D. AWS Trusted Advisor
Answer: AWS CloudTrail
Rationale: CloudTrail event history can show the API event associated with the
bucket deletion, including the identity that made the request, event time, source
IP address, and other request details.
3. Which AWS service is primarily designed to monitor metrics, logs, alarms,
and operational performance?
A. AWS CloudTrail
B. Amazon CloudWatch
C. AWS IAM
D. AWS Artifact
Answer: Amazon CloudWatch
Rationale: CloudWatch provides monitoring and observability capabilities
through metrics, logs, alarms, dashboards, and related monitoring features.
4. A company wants an alarm whenever CPU utilization on an Amazon EC2
instance exceeds 80% for five consecutive minutes. Which CloudWatch
feature should be configured?
A. CloudTrail trail
B. CloudWatch alarm
,C. CloudTrail event selector
D. CloudWatch Logs Insights query
Answer: CloudWatch alarm
Rationale: CloudWatch alarms evaluate metrics against configured thresholds
and can trigger actions when specified conditions are met.
5. Which CloudTrail feature allows API events to be delivered to an Amazon S3
bucket for long-term retention?
A. CloudWatch dashboard
B. CloudTrail trail
C. CloudWatch alarm
D. AWS Config rule
Answer: CloudTrail trail
Rationale: A CloudTrail trail can deliver recorded events to Amazon S3, allowing
organizations to retain and analyze audit information over extended periods.
6. A developer wants to view application log messages generated by an
application running on an EC2 instance. Which CloudWatch capability is
most appropriate?
A. CloudWatch Logs
B. CloudTrail Event history
C. AWS Artifact
D. IAM Access Analyzer
Answer: CloudWatch Logs
Rationale: CloudWatch Logs collects and stores log records from applications,
operating systems, AWS services, and other supported sources.
, 7. Which information is commonly included in a CloudTrail management
event?
A. The physical temperature of an AWS data center
B. The identity that made an AWS API request
C. The CPU temperature of an EC2 server
D. The number of bytes stored in an EBS volume
Answer: The identity that made an AWS API request
Rationale: CloudTrail management events provide information about control-
plane operations, including the identity associated with API requests.
8. A company wants to receive a notification when a specific IAM policy is
deleted. Which combination is most appropriate?
A. CloudTrail and CloudWatch Events/EventBridge
B. CloudWatch metrics and Amazon S3 Glacier
C. AWS Config and Amazon Route 53
D. Amazon Inspector and AWS Artifact
Answer: CloudTrail and CloudWatch Events/EventBridge
Rationale: CloudTrail records the API activity, while EventBridge can detect
matching events and initiate actions such as notifications or automated
responses.
9. What is the primary difference between CloudTrail and CloudWatch?
A. CloudTrail monitors performance, while CloudWatch records API activity
B. CloudTrail records AWS activity, while CloudWatch monitors resources and
applications
