Objective: choose evidence that can answer the question
After lessons 03 and 04, distinguish an operational observation from an account-action record and from a provider compliance document. The service name is less useful than the question the evidence can answer. A performance graph may show when behavior changed without establishing who changed a setting. An action record may identify an actor without proving the change caused a slowdown. A compliance document describes a scope of controls; it does not directly replace either kind of workload observation. By the end, explain both the useful evidence and the conclusion it cannot establish.
Observability, recorded actions, and reports
CloudWatch provides operational observability for performance, health, and resource utilization. CloudTrail records supported account activity as events, including console, CLI, SDK, and API actions. This is a purpose comparison, not a claim that CloudWatch cannot collect logs or that every possible action is recorded by default in CloudTrail. AWS Artifact supplies AWS security and compliance documents that can support due diligence and evaluation of customer controls. Each resource has a useful role; the mistake is promoting the evidence beyond that role.
Worked example: the nonprofit’s two timelines
Fictional teaching case: a nonprofit sees slow responses after a configuration change. Its coordinator asks when latency rose, and its reviewer asks who made the recorded change. First use performance observations to build the latency timeline; this is the operational-observability question. Separately inspect the applicable recorded activity event to answer the actor/action question. Comparing the timelines can guide further investigation, but the coincidence alone does not establish causation. The nonprofit also requests AWS control reports for a supplier review. That third request points to Artifact, not to a latency graph. Check each result by writing the question it actually answers: when behavior changed, which principal performed a supported recorded action, or what AWS controls were documented.
Data state changes the protection question
At-rest data is persisted in non-volatile storage; encryption transforms it so plaintext recovery requires a key. In-transit data moves between systems, where confidentiality and integrity require appropriate protection, including encrypted and authenticated communication. An encrypted stored copy does not prove every network path is protected. Nor does protected transport determine whether the recipient is authorized to use the records. The customer’s data sensitivity and control requirements remain relevant. Provider reports can inform that evaluation, but do not automatically certify the nonprofit’s application.
Transfer check and check basis
Try this new teaching case: a cultural center has an encrypted database and a downloaded AWS compliance document. It has no evidence about how a separate file-export connection protects records. Which conclusion is still unsupported? Check basis: protection of that transit path remains unestablished; neither a resting encrypted database nor a provider document substitutes for examining it. This answer should name the missing state/path rather than declaring every control failed. Attempt aws-clf-q-017–020 and cards aws-clf-card-13–15. Keep source and conclusion paired, and avoid interpreting a single piece of evidence as complete workload approval.
Try it, then explain it.
Complete a short set without looking at the example. After each answer, explain which evidence or rule supports your decision and why the alternatives do not fit.
Sources & authorship
Original OpenExam explanations and examples. References support the concepts; they are not the source of copied questions. Independent educator review is pending.
What is AWS Artifact? - AWS ArtifactWhat Is AWS CloudTrail? - AWS CloudTrailWhat is Amazon CloudWatch? - Amazon CloudWatchWhat is IAM? - AWS Identity and Access ManagementProtecting data at rest - Security PillarProtecting data in transit - Security Pillar