AWS Certified Cloud Practitioner — Question 434

A company's system administrator discovers that someone logged in to the company's AWS account during the weekend and terminated an Amazon EC2 instance.

Which AWS service should the system administrator use to identify who made this change?

Answer options

• A. Amazon Inspector
• B. Amazon Pinpoint
• C. AWS CloudTrail
• D. AWS Trusted Advisor

Correct answer: C

Explanation

AWS CloudTrail logs and monitors account activity, including API calls made through the AWS Management Console, SDKs, and command line tools, which allows administrators to identify who terminated the Amazon EC2 instance. Amazon Inspector is a security assessment service, Amazon Pinpoint is a customer engagement service, and AWS Trusted Advisor helps optimize AWS infrastructure based on best practices.