The security team wants to maintain a record of all GetItem and PutItem operations performed on a DynamoDB table for audit purposes. What solution can they use to meet this requirement?

Answer options:

A.CloudWatch
B.CloudTrail
C.Enable DynamoDB Streams. Use AWS Lambda to read and record stream records.
D.AWS Config

Answer: C
Option A is incorrect because CloudWatch logs are used for storing application logs.
Option B is incorrect because DynamoDB data-plane API operations, such as GetItem and PutItem, are not logged into CloudTrail logs.
Option C is CORRECT because DynamoDB streams record events every time any table item is modified. AWS Lambda function can be used to process and record these stream records.
Option D is incorrect because AWS Config is a service for tracking and monitoring configuration changes of AWS resources.
Reference:
https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/best-practices-security-detective.html