{"question":{"id":38547,"htmlId":"question38547","kind":"SingleChoice","specVersion":null,"questionHtml":"

A team building an ML model wants a record of all S3 bucket-level and object-level API calls so they can review who accessed training data. Which AWS service best satisfies this logging requirement?

","descriptionHtml":"

AWS CloudTrail captures account activity by recording API calls made to Amazon S3, including object-level operations, and delivers the log files to an S3 bucket for auditing. Amazon CloudWatch Logs can store application or system logs but does not automatically record S3 API activity. AWS Config tracks resource configuration changes, not every request. AWS Trusted Advisor offers best-practice checks but does not create detailed access logs.

","answers":[{"id":2564185,"html":"

AWS CloudTrail

","isCorrect":true},{"id":2564187,"html":"

AWS Config

","isCorrect":false},{"id":2564186,"html":"

Amazon CloudWatch Logs

","isCorrect":false},{"id":2564188,"html":"

AWS Trusted Advisor

","isCorrect":false}],"textInput":null,"matching":null,"objectiveId":1913,"objectiveTitle":"Security, Compliance, and Governance for AI Solutions ","nextQuestionUrl":"/study/questions/aif-c01/a-small-development-team-needs-to-add-speech-to-text-capability-to-its/38029?HideScore=false&ObjectiveMode=RoundRobbinObjectives","questionUrl":"/study/questions/aif-c01/a-team-building-an-ml-model-wants-a-record-of-all-s3-bucket-level-and/38547","followUpPrompts":[{"id":277380,"prompt":"What is AWS CloudTrail?","response":"AWS CloudTrail is a service that enables governance, compliance, and operational auditing of your AWS account. It records API calls made in your AWS account, including details like who made the call, when it was made, the IP address, and what actions were taken. CloudTrail logs can be stored in an S3 bucket for auditing, helping teams review access to resources such as S3 buckets."},{"id":277381,"prompt":"How does AWS CloudTrail differ from Amazon CloudWatch Logs?","response":"AWS CloudTrail focuses on recording API activity across your AWS account, capturing events like object-level operations in S3 or changes in EC2 instances. It provides detailed access logs for audit purposes. Amazon CloudWatch Logs, on the other hand, is primarily used for monitoring and storing system and application logs, helping to analyze performance and troubleshoot issues. CloudWatch Logs do not automatically track all API calls, unlike CloudTrail."},{"id":277382,"prompt":"Can AWS CloudTrail record object-level operations in S3?","response":"Yes, AWS CloudTrail can be configured to record object-level operations in S3. By enabling S3 data events in CloudTrail, you can capture detailed activity such as GetObject, DeleteObject, and PutObject, allowing a team to track exactly who accessed or modified files within a bucket. These logs can then be delivered to an S3 bucket for auditing and analysis."}],"presentationMode":false,"hideFeedbackForm":false,"hideResponseBadges":false,"setId":null,"skipSaveResponse":false},"canVote":false,"streak":{"value":null,"title":null,"launchConfetti":false,"isRecord":false},"id":"crucial-react-a168c3ecf2bf42768069ad3b182b3c53"}

AWS Certified AI Practitioner AIF-C01 Practice Question

Report Issue