AWS CloudTrail and Config: SAA-C03 audit scenarios

Who did what versus what a resource is and whether it still complies — the audit and governance pairing the exam leans on. Seven scenarios with the reasoning attached, SAA-C03, 2026 edition.

Try 7 free CloudTrail and Config scenarios in the exam's own style — every answer explained, no sign-up.

Straight to the 7 free questions ↓

Audit and governance sit inside the SAA-C03’s largest domain, and the exam tests one distinction relentlessly: the difference between recording activity and recording state. Get that split right and a whole family of questions resolves quickly. The diagram above lays it out — CloudTrail on one side answering who did what, AWS Config on the other answering what a resource is and whether it still complies, both feeding a single audit and compliance view.

CloudTrail: who did what

AWS CloudTrail is the account’s API activity log. Every management call — and, if enabled, data events — is recorded with the caller identity, the timestamp, the source IP and the action. When a scenario asks which principal deleted this, from where, at what time, that is a CloudTrail question, full stop. This is the service you reach for in incident forensics and access audits, because it reconstructs the sequence of actions a human or role actually took.

AWS Config: what a resource is, and whether it drifted

AWS Config records the configuration state of each resource and keeps a versioned history of how that state changed over time — letting you see what a security group or volume looked like three weeks ago. On top of that timeline, Config rules continuously evaluate resources against a desired state and flag drift as non-compliant the moment it appears: an EBS volume created without encryption, an S3 bucket that turns public. When the requirement is a live compliance verdict rather than an actor trail, Config is the answer.

The distinction the exam keeps testing

Read the question for what it is really asking. Who and when point to CloudTrail. What is this resource, how did it change, is it compliant point to Config. The two are complementary, not interchangeable — a full audit programme usually runs both, but any single scenario is asking about one of them. A frequent distractor swaps their roles; another offers a home-grown Describe script where a managed service belongs.

Scaling and protecting the audit trail

Two patterns extend the basics. Across many accounts under AWS Organizations, an organization trail is defined once and automatically covers every current and future member account, delivering to one central bucket — the least-overhead way to centralise cross-account activity. And to prove the logs themselves were not tampered with, enable CloudTrail log file integrity validation and store the logs in a locked-down S3 bucket with KMS encryption; the signed digests make any alteration or deletion detectable. For the encryption side of that pattern, see KMS encryption scenarios.

Threat detection on top of the logs

One layer above logging sits Amazon GuardDuty, a managed service that analyses CloudTrail, DNS and VPC flow data with threat intelligence and anomaly detection to surface findings — like credentials used from an unusual location — with no detection logic for you to build. It consumes the same log sources this pairing produces, which is why a “continuously find threats in the logs” requirement points to GuardDuty rather than to Config rules or CloudTrail alone.

How to use the seven scenarios below

Answer each before opening the explanation, and when you miss, name the word that decided it — “who”, “history”, “compliant”, “across accounts”, “tamper-evident”. Every explanation names the deciding constraint and takes the distractors apart one by one. For the wider domain, see Design Secure Architectures and the foundational IAM policy scenarios.

Two audit services feeding one compliance view. On the left, AWS CloudTrail records the API call history — who did what: the identity, the time and the action for every management and data event, answering questions about activity and access. On the right, AWS Config records the configuration state of each resource and how it has changed over time, then evaluates that state against Config rules to flag non-compliant resources such as an unencrypted volume or a public bucket. Both streams flow into a central audit and compliance view, with an arrow noting that Amazon GuardDuty analyses the same log sources to surface intelligent threat findings.

7 free SAA-C03 practice questions

Answers and explanations — no email wall

SAA-C03 Question 1 of 7

A security team is investigating a production incident. They need to determine which IAM principal deleted a specific Amazon S3 bucket, from which source IP, and at exactly what time. Which AWS service provides this record?

Answer: A — AWS CloudTrail, which logs the identity, time and source of every API call.

CloudTrail answers the who-did-what question: every management API call is recorded with the caller identity, timestamp, source IP and the action itself, which is exactly what a forensic investigation needs. Why not the others: AWS Config tells you what a resource looked like and when it changed, but not which principal issued the deleting call. CloudWatch metrics are numeric time series, not an actor-level audit trail. S3 server access logs capture requests to objects in a bucket, not the management call that deleted the bucket, and they omit the rich identity context CloudTrail carries.

SAA-C03 Question 2 of 7

A governance team wants a continuously updated inventory of every resource in an account, a full history of how each resource's configuration has changed over time, and the ability to see what a security group looked like three weeks ago. Which service is purpose-built for this?

Answer: A — AWS Config, which records resource configuration state and its change history.

AWS Config is the resource-state service: it captures configuration items on every change, keeps a versioned timeline per resource and lets you view the exact configuration at any past point. Why not the others: CloudTrail records the API calls that caused changes, not a queryable snapshot of each resource's state over time — reconstructing state from a call log is exactly the toil Config removes. Systems Manager Inventory focuses on software and OS-level detail inside instances, not the full account-wide resource configuration graph. A home-grown Describe script is undifferentiated heavy lifting the exam consistently marks against a managed service.

SAA-C03 Question 3 of 7

A solutions architect is asked to explain the division of labour between AWS CloudTrail and AWS Config for an audit programme. Which statement draws the distinction correctly?

Answer: A — CloudTrail is the API activity log — who did what; Config records resource state and evaluates it for compliance.

The clean mental model is activity versus state: CloudTrail answers who made which API call and when, while Config answers what each resource is configured as and whether that configuration still complies. Why not the others: the second option simply swaps the two services' roles. Claiming either alone covers a full audit misses that you usually want both — the actor trail and the state timeline answer different questions. And neither service is a billing or cost tool; that framing describes Cost Explorer and Budgets, not the governance pairing this diagram shows.

SAA-C03 Question 4 of 7

A company runs many AWS accounts under AWS Organizations and needs one immutable, centralised trail that captures API activity from every account and delivers it to a single logging account. What is the least-overhead way to achieve this?

Answer: A — Create an organization trail in CloudTrail that applies to all accounts and delivers to a central S3 bucket.

An organization trail is defined once in the management account and automatically applies to every current and future member account, delivering all their events to one central bucket — the least-overhead, most complete answer. Why not the others: per-account trails stitched together by hand are operationally fragile and miss new accounts, the opposite of least overhead. Enabling Config in one account records configuration state, not the cross-account API activity the requirement names. VPC Flow Logs capture network traffic metadata, not management API calls, so they answer a different question entirely.

SAA-C03 Question 5 of 7

A compliance policy requires that any Amazon EBS volume created without encryption, and any S3 bucket that becomes publicly accessible, is automatically flagged as non-compliant as soon as it appears. Which approach meets this with the least custom code?

Answer: A — Enable AWS Config rules that evaluate resources against the encryption and public-access requirements.

AWS Config rules continuously evaluate resource configuration against a desired state and mark drift as non-compliant the moment it occurs, with managed rules already available for EBS encryption and S3 public access. Why not the others: CloudTrail records that the create call happened but does not evaluate the resulting configuration against a compliance rule, so it does not produce a compliant/non-compliant verdict on its own. A monthly manual review is neither automatic nor timely. Macie discovers and classifies sensitive data inside S3 objects — valuable, but not the general resource-compliance engine the requirement describes.

SAA-C03 Question 6 of 7

Beyond logging activity and evaluating configuration, a security team wants a managed service that continuously analyses CloudTrail, DNS and VPC flow data to surface intelligent threat findings — such as credentials being used from an unusual location — without them building detection logic themselves. Which service fits?

Answer: A — Amazon GuardDuty, which applies threat intelligence and anomaly detection to those log sources.

GuardDuty is the managed threat-detection service: it consumes CloudTrail, DNS and VPC flow logs and applies machine learning and curated threat intelligence to raise findings like anomalous credential use, with no detection code to maintain. Why not the others: a Config custom rule evaluates configuration state, not behavioural threat signals across log streams. CloudTrail Insights flags unusual API call-rate patterns but is narrower than the cross-source intelligent detection described. Amazon Inspector assesses workloads for software vulnerabilities and exposure, not log-based threat analytics.

SAA-C03 Question 7 of 7

An auditor must be able to prove that the CloudTrail log files themselves were not altered or deleted after delivery. Which combination establishes tamper-evident, protected audit logs?

Answer: A — Enable CloudTrail log file integrity validation and store logs in S3 with restrictive policies and KMS encryption.

Log file integrity validation produces signed digest files so any modification or deletion after delivery can be detected, and pairing that with a locked-down, KMS-encrypted S3 bucket protects the logs at rest — together they give tamper-evident audit trails. Why not the others: S3 does not make objects immutable by default; that requires deliberate controls, and integrity validation is what proves tampering. Granting broad delete permission is the opposite of protecting an audit trail. Disabling encryption weakens confidentiality and is never the answer on a security-domain question.

That is exactly how every question in the course works — answer, explanation, why-not. The real set continues in the practice player: 10 free questions, no sign-up.

Continue with the 10 free questions →

Those 7 questions were the start.

The exam does not test whether you recognise a term — it tests whether you can rule out three plausible answers under time pressure. That is what the explanations above are for, and there are 780 more questions built exactly like them.

Collecting questions yourself

Scattered across forums, of unknown age
Answer keys without reasoning
No idea which domain you are weak in

Practising with a system

780 questions in 12 full tests, SAA-C03 (2026)
Every option explained — including the wrong ones
Readiness per exam domain, and drills for your weakest

Start free — 10 questions

Straight into the player. No account, no email.

Frequently asked questions

CloudTrail versus AWS Config in one line?

CloudTrail is the API activity log — who did what, and when. AWS Config records what each resource is configured as, tracks how that changes over time, and evaluates it against rules for compliance. Activity versus state.

Does AWS Config track configuration history?

Yes. Config captures a configuration item on every change, keeping a versioned timeline for each resource, so you can see exactly what a resource looked like at any past point and what changed between versions — that history is the core of the service.

Are these real exam questions?

No. They are original scenarios written for this page in the exam's style and difficulty. Reproducing real exam items violates the AWS certification agreement and can cost a candidate their certification — ours come with the reasoning attached, which is the part that prepares you.

Updated for SAA-C03 (July 2026). The sample questions above are our own work in the style of the exam — not real exam items. The exam itself is set and marked by the certification body.