Track who changed the configuration of an internal generative-AI application and when.
Use the records for incident investigations and compliance checks.
Which audit design is most appropriate?
Record API activity with CloudTrail and design retention, access, encryption, and tamper-resistance policies for the trail.
Detailed explanation
Short retention prevents investigation and compliance evidence.
CloudTrail records API activity; retention, access, encryption, and integrity must also be designed.
Unrestricted modification undermines log integrity.
The context needed to reconstruct an event would be missing.
Check official documentation
Compare the following points with the official documentation.
AWS CloudTrail User GuideとAWS Well-Architected Security Pillarのログ・監査方針を確認する。
Official references
What to confirm
記録するだけでなく、保持・アクセス制御・改ざん防止を含む監査設計を説明できる。
Key points
- CloudTrail
- Audit trail
- Retention and integrity
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
Evidence scope
A useful audit record identifies the actor, resource, operation, time, and outcome rather than only a count.
Retention boundary
Retention and deletion rules should reflect legal, operational, privacy, and cost requirements.