<strong>The company that you are working for has strong security policies. And for AWS services, they want to track all API calls if possible. One team has just started using CloudFormation to migrate their legacy application to AWS. </strong>

Answer options:

A.Create a new CloudTrail and configure a S3 bucket for the trail. By default, CloudFormation service is included and all CloudFormation API calls will be recorded as CloudTrail events. The events contain lots of useful information that security team cares about.
B.Create a new CloudTrail trail and configure a S3 bucket. Include the CloudFormation service for the new trail. All relevant CloudFormation API call informations are recorded such as Parameter names, Parameter values, IAM roles and Tags used during stack creation.
C.The CloudTrail actually does not support CloudFormation specific api calls. For example,when CloudFormation stack is created or updated, the relevant events are not recorded in CloudTrail. The trail only captures the API events for resources that CloudFormation has created.
D.For CloudFormation tracking, it is suggested to use AWS Config as it is able to monitor all CloudFormation activities such as stack creation, stack update and stack deletion.

Correct Answer - A
For API tracking in AWS, the first service to think about should be CloudTrail. Option D is eliminated. And CloudTrail supports CloudFormation and all API calls are recorded as event. For Option B, it is partially correct as “Only the input parameter key names are logged; no parameter values are logged.” About how to use CloudTrail to track CloudFormation API calls, refer to
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-api-logging-cloudtrail.html.
The below event is one for stack creation. It only has the parameter name:
 "stackName": "my-test-stack",
"disableRollback": true,
"parameters": [
{
"parameterKey": "password"
},
{
"parameterKey": "securitygroup"
}
]
Option B is incorrect: CloudTrail events do not record the parameter values for CloudFormation. 
Option C is incorrect: because CloudTrail supports CloudFormation and is able to record its API calls.
Option D is incorrect: To trace API calls, the main service should be CloudTrail.