A company needs to know which user was responsible for terminating several critical Amazon Elastic Compute Cloud (EC2) Instances. Where can the customer find this information?

Answer options:

A.AWS Trusted Advisor
B.Amazon EC2 instance usage report
C.Amazon CloudWatch
D.AWS CloudTrail logs

Answer - D
Using CloudTrail, one can monitor all the API activity conducted on all AWS services.
The AWS Documentation additionally mentions the following.
AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. With CloudTrail, you can log, continuously monitor, and retain account activity related to actions across your AWS infrastructure. CloudTrail provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. This event history simplifies security analysis, resource change tracking, and troubleshooting.
For more information on AWS Cloudtrail, please refer to the below URL:
https://aws.amazon.com/cloudtrail/
Answers A, B and C are incorrect. Cloudtrail is the most appropriate place to monitor activity in AWS.