Welcome to Part 10 of our complete study series for the AWS Certified Cloud Practitioner (CLF-C02) certification. When you run applications in the cloud, keeping track of performance, auditing user activity, and managing multiple accounts securely is just as important as building the architecture itself. That is exactly where AWS governance and monitoring tools come in. Knowing how to track system metrics or audit API calls—especially understanding the key differences in CloudWatch vs CloudTrail—is a guaranteed topic on your actual exam. Solving realistic, scenario-based questions is the most effective way to lock in this knowledge before test day.
|
| AWS Governance & Monitoring CLF-C02 Practice Exam – CloudWatch vs CloudTrail |
In this free aws cloud practitioner practice exam module (Part 10), we focus entirely on Management, Governance, and Developer Tools. You will work through 20 carefully selected questions (Questions 1 through 20) designed to test your ability to choose the right service for specific business needs. We will clear up common exam confusion, such as choosing between AWS Organizations vs Control Tower for multi-account management, or deciding when to use AWS Config instead of AWS Trusted Advisor. Every question includes a simple, straightforward explanation so you know exactly why the correct answer makes sense.
AWS Cloud Practitioner (CLF-C02) Practice Questions
Q1: Secure EC2 Browser Access (Systems Manager)
A company wants to securely connect to its Amazon EC2 instances using a
browser-based shell. The company needs to achieve this without opening
inbound firewall ports or managing bastion hosts.
Which AWS Systems Manager feature meets these requirements?
• Why Session Manager is correct: AWS Systems Manager Session Manager provides secure, interactive browser-based and CLI access to EC2 instances without requiring open inbound ports, SSH keys, or bastion hosts.
Why are the other options incorrect?
• AWS Systems Manager State Manager: State Manager is used to automate the process of keeping managed instances in a defined target configuration (such as ensuring specific software is installed). It does not provide interactive login access.
• AWS Systems Manager Patch Manager: Patch Manager is used to automate the process of patching managed instances with security and operating system updates.
• AWS Systems Manager Automation: Systems Manager Automation is used to run predefined scripts (runbooks) to automate common IT operations and management tasks. It is not designed to provide an interactive administrative shell.
Q2: AWS Monitoring and Developer Tools (Yes/No)
Review the three statements below regarding AWS Monitoring and Developer Tools. Determine whether each statement is Yes (True) or No (False).
1. Amazon CloudWatch is used to collect and track performance metrics, monitor log files, and set alarms for AWS resources.
2. AWS CloudTrail is primarily used to monitor application performance and track the real-time CPU utilization of Amazon EC2 instances.
3. AWS X-Ray is a developer tool that helps analyze and debug distributed applications, such as those built using a microservices architecture.
• Statement 1 is Yes (True): Amazon CloudWatch is a monitoring and observability service that collects operational data in the form of logs, metrics, and events. It is used to monitor resource performance and set automated alarms.
• Statement 2 is No (False): Tracking CPU utilization and monitoring real-time application performance are capabilities of Amazon CloudWatch. AWS CloudTrail is an auditing tool used to log AWS API calls and track user account activity.
• Statement 3 is Yes (True): AWS X-Ray allows developers to trace user requests as they travel through underlying services. It is specifically designed to identify performance bottlenecks and troubleshoot errors in distributed architectures.
Q3: Resource Configuration Auditing (AWS Config)
A company needs to audit its AWS resources by tracking configuration
changes over time. The company must also evaluate these resource
configurations against internal compliance rules and trigger automated
remediation if any settings drift from the policies.
Which AWS service is designed specifically to meet these requirements?
• Why AWS Config is correct: AWS Config continuously monitors, records, and audits configuration changes to AWS resources. It evaluates these configurations against predefined rules and can automatically trigger remediation actions if a resource becomes non-compliant.
Why are the other options incorrect?
• AWS CloudTrail: AWS CloudTrail records API calls and user activity for auditing account actions (answering "who did what, when, and from where"). It does not track resource configuration state histories or evaluate compliance rules.
• AWS Secrets Manager: AWS Secrets Manager is used to securely store, manage, and rotate sensitive information, such as database credentials and API keys.
• AWS Trusted Advisor: AWS Trusted Advisor provides real-time guidance to help provision resources according to AWS best practices (cost, security, performance, etc.), but it does not record granular configuration histories or enforce custom compliance rules.
Q4: Automating CI/CD Workflows (CodePipeline)
To accelerate software release cycles, which AWS service should be used to model, visualize, and automate continuous integration and continuous delivery (CI/CD) workflows?
• Why AWS CodePipeline is correct: AWS CodePipeline is a fully managed continuous delivery service that automates the build, test, and deployment phases of your release process every time there is a code change.
Why are the other options incorrect?
• AWS Config: AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. It does not orchestrate software deployments.
• AWS DataSync: AWS DataSync is an online data transfer service that simplifies moving large amounts of data between on-premises storage and AWS.
• Amazon Cognito: Amazon Cognito provides authentication, authorization, and user identity management for web and mobile applications.
Q5: Remote Command Execution at Scale (Systems Manager)
An administrator needs to run routine scripts and operating system
commands across a large fleet of Amazon EC2 instances. The solution must
avoid manual SSH logins and eliminate the need to manage bastion hosts.
Which AWS service provides the MOST operationally efficient way to
remotely execute these commands at scale?
• Why AWS Systems Manager is correct: AWS Systems Manager (specifically the Run Command feature) allows administrators to remotely and securely execute scripts and commands across fleets of EC2 instances at scale without requiring SSH access or bastion hosts.
Why are the other options incorrect?
• AWS Lambda: AWS Lambda is a serverless compute service that runs code in response to events. It does not execute in-guest scripts directly inside existing Amazon EC2 instance operating systems.
• AWS Control Tower: AWS Control Tower is used to automate the setup and governance of a secure, multi-account AWS environment (a landing zone). It is not used for instance-level administration.
• AWS Organizations: AWS Organizations provides centralized management, policy enforcement, and consolidated billing for multiple AWS accounts. It does not provide command execution capabilities for instances.
Q6: Declarative Infrastructure Provisioning (CloudFormation)
Which AWS service allows users to provision infrastructure consistently across multiple environments by defining cloud resources in declarative JSON or YAML templates?
• Why AWS CloudFormation is correct: AWS CloudFormation is an Infrastructure as Code (IaC) service that allows you to model, provision, and manage AWS resources in a repeatable way using JSON or YAML templates.
Why are the other options incorrect?
• AWS Elastic Beanstalk: AWS Elastic Beanstalk is a managed service used for deploying and scaling web applications, not a general-purpose IaC tool for defining arbitrary infrastructure components.
• AWS CloudShell: AWS CloudShell is a browser-based shell environment used to interact with AWS resources using the AWS CLI. It is not used for declarative infrastructure provisioning.
• AWS Systems Manager: AWS Systems Manager provides operational management tools to view and control AWS resources, rather than provisioning new environments using declarative templates.
Q7: Network Traffic Auditing (VPC Flow Logs)
A security team needs to log and analyze the incoming and outgoing IP
traffic on the network interfaces within an Amazon VPC. This data will be
used to investigate connectivity issues and potential security
incidents.
Which AWS feature should be enabled to capture this information?
• Why VPC Flow Logs is correct: VPC Flow Logs is a feature that captures metadata about the IP traffic going to and from network interfaces in a VPC, which is essential for troubleshooting connectivity and performing security analysis.
Why are the other options incorrect?
• Amazon Inspector: Amazon Inspector is an automated vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure. It does not log network traffic.
• AWS CloudTrail: AWS CloudTrail logs API activity and management events within an AWS account, not the actual IP traffic flowing through a VPC network.
• VPC route tables: VPC route tables contain rules that determine where network traffic is directed. They are used for routing, not for recording traffic logs.
Q8: Configuration Compliance Auditing (AWS Config)
A company needs to maintain an audit trail of all configuration changes
across its AWS infrastructure. The company requires a solution that
continuously records resource settings and evaluates these configurations
against security baseline rules.
Which AWS service meets these requirements?
• Why AWS Config is correct: AWS Config continuously monitors, records, and audits AWS resource configurations. It allows companies to evaluate resource settings against predefined compliance rules.
Why are the other options incorrect?
• Amazon Inspector: Amazon Inspector is an automated vulnerability management service used to discover software vulnerabilities and unintended network exposure. It does not record configuration histories.
• AWS Shield: AWS Shield is a managed Distributed Denial of Service (DDoS) protection service. It is not used for configuration auditing or compliance tracking.
• AWS Identity and Access Management (IAM): AWS IAM is used to manage access to AWS services and resources securely. It does not track configuration changes for the broader AWS infrastructure.
Q9: Infrastructure as Code (AWS CloudFormation)
A development team needs to provision identical cloud environments across
multiple AWS Regions and accounts. The team wants to deploy AWS resources
in a consistent and repeatable manner using declarative JSON or YAML
templates.
Which AWS service provides this Infrastructure as Code (IaC) capability?
• Why AWS CloudFormation is correct: AWS CloudFormation allows users to model, provision, and manage AWS resources in a predictable and repeatable way using Infrastructure as Code (IaC) templates written in JSON or YAML.
Why are the other options incorrect?
• AWS Systems Manager: AWS Systems Manager provides a centralized hub to view and manage operational data and automate tasks across AWS resources. It is not an IaC service for provisioning infrastructure.
• AWS CodeBuild: AWS CodeBuild is a fully managed continuous integration service that compiles source code, runs tests, and produces software packages. It does not provision cloud infrastructure.
• AWS CodeDeploy: AWS CodeDeploy automates the deployment of application code to compute services like Amazon EC2, AWS Lambda, and Amazon ECS. It does not provision the underlying infrastructure itself.
Q10: Monitoring & Management Services (Matching)
Match each description below to its corresponding AWS Service:
1. Provides alerts and remediation guidance when AWS experiences service issues that may impact your environment:
2. Collects performance metrics, monitors log files, and triggers automated alarms based on resource utilization:
3. Provides a centralized hub to view operational data and automate management tasks across your infrastructure:
• 1 is AWS Health Dashboard: The AWS Health Dashboard provides real-time alerts, personalized views, and remediation guidance regarding AWS service health events that may affect your specific AWS environment.
• 2 is Amazon CloudWatch: Amazon CloudWatch is the primary monitoring service that collects operational data (metrics and logs) and uses that data to trigger automated alarms or actions (like Auto Scaling) when predefined thresholds are met.
• 3 is AWS Systems Manager: AWS Systems Manager acts as a centralized operations hub that allows you to view operational data from multiple AWS services and automate routine management tasks (such as patching and running commands) across your instances.
• AWS X-Ray is the unused option. It is a developer tool used to analyze and debug distributed applications, such as those built using a microservices architecture, rather than for general infrastructure monitoring or health alerts.
Q11: Troubleshooting VPC Network Traffic
A network engineer is investigating why two Amazon EC2 instances in an
Amazon VPC cannot communicate with each other. The engineer needs to
determine whether network packets are being accepted or dropped.
Which AWS feature should the engineer use to troubleshoot this network
connectivity issue?
• Why VPC Flow Logs is correct: VPC Flow Logs is a feature that captures metadata about IP traffic moving to and from network interfaces in a VPC. It records whether traffic was accepted or rejected, making it ideal for troubleshooting connectivity and firewall misconfigurations.
Why are the other options incorrect?
• Internet gateway: An internet gateway allows communication between resources in a VPC and the public internet. It does not log network traffic or troubleshoot internal connectivity issues.
• AWS CloudHSM: AWS CloudHSM provides hardware security modules for generating and managing cryptographic keys. It does not provide networking diagnostic capabilities.
• AWS Certificate Manager (ACM): AWS Certificate Manager (ACM) is used to provision and manage SSL/TLS certificates. It is not used for network troubleshooting.
Q12: Infrastructure as Code (IaC) Operational Advantage
What is a primary operational advantage of using Infrastructure as Code (IaC) in the AWS Cloud?
• Why this option is correct: IaC allows organizations to define cloud infrastructure using declarative code templates. This enables automated, predictable, and version-controlled provisioning of AWS resources, reducing manual configuration and human error.
Why are the other options incorrect?
• Option A: IaC is used to define and deploy cloud infrastructure using code. It is not used to physically migrate on-premises hardware into AWS data centers.
• Option C: IaC manages infrastructure components (such as compute, storage, and networking), not application business logic. Furthermore, customers are responsible for their own application code, not AWS Support.
• Option D: While using IaC can help enforce security baselines and compliance, it is an automation practice for resource deployment, not a mechanism for outsourcing compliance audits.
Q13: Auditing User API Activity (AWS CloudTrail)
A developer notices that an Amazon EC2 instance has been unexpectedly
terminated. The operations team needs to determine which user initiated
the termination, the specific API call that was made, and when the event
occurred.
Which AWS service should the team use to audit this activity?
• Why AWS CloudTrail is correct: AWS CloudTrail records API calls and user activity within an AWS account. It provides a detailed event history that shows who made the request, the time of the event, and the specific API action taken.
Why are the other options incorrect?
• Amazon CloudWatch Logs: Amazon CloudWatch Logs monitors, stores, and accesses log files from applications and operating systems. It does not record AWS management plane API calls.
• Amazon Inspector: Amazon Inspector is an automated vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure. It does not audit user API activity.
• AWS Security Hub: AWS Security Hub aggregates security findings from various AWS services and evaluates environments against security standards. It is not the service used to track granular API requests and user actions.
Q14: Secure Multi-Account Governance (Control Tower)
A company wants to set up and govern a secure, multi-account AWS
environment based on AWS best practices. The company needs a service that
automates the deployment of a landing zone and enforces governance
guardrails across all accounts.
Which AWS service provides this functionality?
• Why AWS Control Tower is correct: AWS Control Tower automates the setup of a secure, compliant, multi-account AWS environment (a landing zone). It also enforces preventive and detective governance guardrails across the organization.
Why are the other options incorrect?
• AWS Systems Manager: AWS Systems Manager provides operational management tools to view and control AWS resources. It does not automate the deployment of a multi-account landing zone.
• AWS Config: AWS Config continuously monitors and records AWS resource configurations to evaluate compliance. While AWS Control Tower uses AWS Config for detective guardrails, AWS Config alone does not orchestrate a multi-account environment.
• AWS IAM Identity Center: AWS IAM Identity Center (formerly AWS Single Sign-On) centrally manages workforce access and authentication across AWS accounts. It does not build landing zones or enforce infrastructure guardrails.
Q15: Source Control & Deployment (Select 2)
A development team is building a continuous delivery pipeline. The team
needs a managed Git repository service to store source code and an
automated deployment service to release application updates to compute
instances.
Which AWS services should the team use to meet these requirements? (Choose
TWO.)
• Why AWS CodeCommit is correct: AWS CodeCommit is a fully managed source control service that hosts secure, Git-based repositories for storing and versioning application code.
• Why AWS CodeDeploy is correct: AWS CodeDeploy is a fully managed deployment service that automates software deployments to compute services such as Amazon EC2, AWS Fargate, AWS Lambda, and on-premises servers.
Why are the other options incorrect?
• Amazon Elastic Container Service (Amazon ECS): Amazon ECS is a fully managed container orchestration service. It is not a source control repository or a deployment automation tool.
• Amazon DynamoDB: Amazon DynamoDB is a fully managed, serverless NoSQL database service. It does not manage source code or automate application deployments.
• Amazon S3: Amazon S3 is an object storage service. While it can store compiled build artifacts, it does not provide native Git version control or continuous deployment automation.
Q16: Infrastructure as Code Frameworks (Select 2)
A DevOps team wants to eliminate manual configuration errors and deploy
infrastructure consistently across development, staging, and production
environments using Infrastructure as Code (IaC).
Which AWS services or frameworks enable the team to model and provision
cloud resources? (Choose TWO.)
• Why AWS CloudFormation is correct: AWS CloudFormation is an Infrastructure as Code (IaC) service that allows teams to automate the provisioning and configuration of AWS resources in a repeatable way using JSON or YAML templates.
• Why AWS CDK is correct: The AWS Cloud Development Kit (AWS CDK) is an open-source development framework that lets developers define cloud infrastructure using familiar programming languages (like Python, Java, or TypeScript) and provision it reliably through AWS CloudFormation.
Why are the other options incorrect?
• AWS CodeBuild: AWS CodeBuild is a continuous integration service that compiles source code, runs tests, and produces software packages. It does not provision cloud infrastructure.
• AWS Config: AWS Config continuously monitors, records, and audits AWS resource configurations for compliance. It is not an infrastructure provisioning tool.
• AWS CodeStar: AWS CodeStar is a unified user interface that allows teams to manage software development activities and CI/CD pipelines. It is not an IaC framework.
Q17: Centralized Account Governance (AWS Organizations)
Which AWS service provides programmatic creation of new accounts, allows organizing accounts into hierarchical units (OUs), and enables the enforcement of centralized governance policies across multiple accounts?
• Why AWS Organizations is correct: AWS Organizations is an account management service that allows you to consolidate multiple AWS accounts into an organization that you create and centrally manage. It enables programmatic creation of new accounts, grouping accounts into Organizational Units (OUs), consolidating billing, and applying Service Control Policies (SCPs) to govern service access across account groups.
Why are the other options incorrect?
• AWS CloudFormation: AWS CloudFormation is an Infrastructure as Code (IaC) tool used to deploy and manage resource stacks using declarative templates, rather than managing multi-account structures and organizational hierarchies.
• AWS Identity and Access Management (IAM): AWS Identity and Access Management (IAM) manages users, groups, roles, and permissions within an individual account, but it cannot create new AWS accounts or organize multiple distinct accounts.
• AWS Trusted Advisor: AWS Trusted Advisor evaluates your AWS infrastructure against cloud best practices (security, cost, performance, and fault tolerance), but it does not provide account provisioning or account governance features.
Q18: API Auditing & Event History (AWS CloudTrail)
An engineer is investigating the termination of an Amazon EC2 instance
that was active a few days ago. The engineer needs to view the
chronological lifecycle events of the resource and determine which user
identity initiated the termination.
Which action should the engineer take to find this information?
• Why AWS CloudTrail is correct: AWS CloudTrail records API calls and management events within an AWS account. By searching the CloudTrail Event History, the engineer can see the exact API call (such as TerminateInstances), the user identity that initiated the action, and the timestamp.
Why are the other options incorrect?
• Amazon Inspector: Amazon Inspector is an automated vulnerability management service that scans for software vulnerabilities and unintended network exposure. It does not record operational API actions or server termination history.
• AWS Secrets Manager: AWS Secrets Manager is used to securely store, rotate, and retrieve sensitive credentials, such as database passwords and API keys. It does not manage or log compute instance lifecycle events.
• AWS Cost Explorer: AWS Cost Explorer is used to visualize and analyze aggregated billing and usage trends over time. It does not record granular infrastructure API calls or provide a forensic audit trail for deleted instances.
Q19: Rightsizing with Machine Learning (Compute Optimizer)
A company wants to identify overprovisioned and underutilized Amazon EC2
instances across its environment. The company needs a service that uses
machine learning to analyze historical utilization metrics and provide
actionable instance rightsizing recommendations.
Which AWS service meets these requirements?
• Why AWS Compute Optimizer is correct: AWS Compute Optimizer uses machine learning to analyze historical resource utilization metrics (such as CPU, memory, and storage) and provides actionable rightsizing recommendations to help optimize performance and reduce costs for Amazon EC2 instances and other resources.
Why are the other options incorrect?
• AWS Pricing Calculator: AWS Pricing Calculator is used to estimate the expected costs of AWS services before they are provisioned. It does not analyze running workloads or provide rightsizing recommendations.
• AWS App Runner: AWS App Runner is a fully managed service used to deploy containerized web applications and APIs directly from source code or container images. It is not an optimization or rightsizing tool.
• AWS Systems Manager: AWS Systems Manager provides operational management tools to view and control AWS resources, such as patch management and automated remote administration. It does not provide machine learning-based rightsizing recommendations.
Q20: Cloud Optimization & Best Practices (Trusted Advisor)
A company wants to identify underutilized or idle resources, such as
unattached Amazon Elastic Block Store (Amazon EBS) volumes, to reduce its
monthly cloud spending.
Which AWS service scans the environment to provide automated
recommendations for cost optimization, security, and performance?
• Why AWS Trusted Advisor is correct: AWS Trusted Advisor inspects your AWS environment and provides real-time guidance following AWS best practices. It offers automated recommendations across categories such as cost optimization (identifying idle resources), security, performance, fault tolerance, and service quotas.
Why are the other options incorrect?
• AWS Pricing Calculator: AWS Pricing Calculator is used to estimate the expected monthly costs of AWS services before provisioning them. It does not inspect running resources for underutilization.
• AWS Budgets: AWS Budgets allows users to set custom spending limits and receive alerts when costs exceed predefined thresholds. It does not scan infrastructure to recommend specific cost-saving actions.
• AWS Organizations: AWS Organizations provides centralized governance, policy management, and consolidated billing across multiple AWS accounts. It does not provide automated resource optimization checks.
AWS Governance & Monitoring Cheat Sheet: Core Comparisons
In the CLF-C02 exam, distinguishing between similarly named services is crucial. Use this quick comparison table to master AWS governance, audit tools, and monitoring architectures:
| Service Pair | Primary Focus & Mechanism | Key Question to Ask Yourself |
|---|---|---|
| CloudWatch vs CloudTrail |
CloudWatch tracks performance metrics (CPU, RAM) and triggers
alarms. CloudTrail tracks API calls and user auditing (Who, What, When). |
Am I looking for performance issues (CloudWatch) or auditing who deleted a resource (CloudTrail)? |
| Config vs Trusted Advisor |
AWS Config records chronological configuration changes and
enforces compliance. Trusted Advisor provides broad best-practice recommendations (cost, security). |
Do I need to track historical drift/compliance (Config) or just get general optimization tips (Trusted Advisor)? |
| Organizations vs Control Tower |
Organizations provides centralized billing and Service Control
Policies (SCPs). Control Tower builds an automated, secure multi-account "landing zone" with pre-configured guardrails. |
Am I manually grouping accounts (Organizations) or do I need automated, out-of-the-box multi-account governance (Control Tower)? |
| Inspector vs Systems Manager |
Amazon Inspector automatically scans instances for software
vulnerabilities. Systems Manager is the hub to remotely patch those vulnerabilities and run commands. |
Am I looking for security holes (Inspector) or am I actively running scripts/patches to fix them (Systems Manager)? |
Key Takeaways for AWS Governance & Dev Tools (Part 10 Summary)
• Observability & Auditing: Differentiating CloudWatch and CloudTrail is mandatory for the exam. CloudWatch is for *metrics and monitoring* (e.g., triggering an Auto Scaling group when CPU hits 80%). CloudTrail is for *auditing and governance* (e.g., figuring out which IAM user stopped a production database).
• Infrastructure as Code (IaC): AWS CloudFormation uses declarative templates (JSON/YAML) to provision resources automatically. The AWS Cloud Development Kit (AWS CDK) allows developers to write IaC using familiar programming languages (Python, Java) which then compile into CloudFormation templates.
• CI/CD Pipelines: Familiarize yourself with the Developer Tools suite. CodeCommit stores source code (Git), CodeBuild compiles and tests it, CodeDeploy pushes it to compute instances, and CodePipeline connects all these steps together into an automated release workflow.
• Multi-Account Management: As companies grow, they use AWS Organizations to consolidate billing and apply high-level permissions (SCPs). To automate the creation of a secure baseline environment (landing zone) across these accounts, they deploy AWS Control Tower.
Frequently Asked Questions (AWS CLF-C02 FAQ)
1. What is the exact difference between AWS CloudWatch vs CloudTrail?
This is the most common point of confusion on the CLF-C02 exam. Amazon CloudWatch focuses on resource performance. It collects metrics (like CPU usage, network traffic, and disk read/writes) and logs to trigger automated alarms. AWS CloudTrail focuses on security auditing and governance. It logs the API activity (the management actions) performed by users, roles, or AWS services. Simply put: CloudWatch asks "How is my system performing?", while CloudTrail asks "Who did what, and when?"
2. What is the difference between AWS Config and AWS Trusted Advisor?
AWS Config is a continuous auditing service that records the historical configuration of your resources. It evaluates these settings against custom compliance rules (e.g., "Are all my S3 buckets encrypted?"). If a resource drifts from compliance, it triggers an alert. AWS Trusted Advisor acts as a high-level cloud consultant. It scans your entire AWS environment and gives you a dashboard of recommendations based on AWS best practices across five pillars: Cost Optimization, Security, Fault Tolerance, Performance, and Service Quotas.
3. What is the difference between AWS Organizations and AWS Control Tower?
AWS Organizations is the foundational service for managing multiple AWS accounts. It allows you to centrally manage billing, group accounts into Organizational Units (OUs), and apply overarching security rules called Service Control Policies (SCPs). AWS Control Tower sits on top of AWS Organizations. It is an orchestration service that automatically sets up a secure, well-architected multi-account environment (called a landing zone) and applies predefined preventive and detective "guardrails" (using SCPs and AWS Config rules) without manual configuration.
4. Can AWS CloudTrail monitor the CPU utilization of my EC2 instances?
No. AWS CloudTrail does not monitor system-level performance metrics like CPU, memory, or network utilization. It only tracks API requests (e.g., when a user clicks "Launch Instance" or runs an API command to stop a server). To monitor CPU utilization or set an alarm when a server hits 90% CPU, you must use Amazon CloudWatch.
Ready to See Your Results?
Great job completing Part 10 of our free aws cloud practitioner practice exam series! Governance, auditing, and developer tools are critical components of Domain 4 (Billing, Pricing, and Support) and Domain 3 (Technology) on the official AWS Certified Cloud Practitioner (CLF-C02) exam.
Review any questions you answered incorrectly, make sure you understand the differences in the cheat sheet table above, and continue your certification preparation with our next practice module covering AWS Application Integration, Migration & Machine Learning.
