You work as an administrator for a company. The company hosts a number of resources using AWS. There is an incident of suspicious API activity that occurred 11 days ago. The Security Admin has asked to get the API activity from that point in time. How can this be achieved?

Answer options:

A.Search the Cloud Watch logs to find the suspicious activity which occurred 11 days ago.
B.Search the Cloudtrail event history on the API events which occurred 11 days ago.
C.Search the Cloud Watch metrics to find for the suspicious activity which occurred 11days ago.
D.Use AWS Config to get the API calls that were made 11 days ago.

Answer: B
Option A is incorrect because AWS Cloudwatch is used for logging and not for monitoring API activity.
Option B is CORRECT because AWS CloudTrail event history allows viewing events that are recorded for 90 days. So one can use a metric filter to gather the API calls from 11 days ago.
Option C is incorrect because AWS Cloudwatch is used for logging and not for monitoring API activity.
Option D is incorrect because AWS Config is a configuration service and is not used for monitoring API activity on the AWS account.
Note: 
In this question, we assume that the customer has enabled the CloudTrail service. AWS CloudTrail is enabled by default for ALL CUSTOMERS and will provide visibility into the past seven days of account activity without the need for you to configure a trail in the service to get started.
So for an activity that happened 11 days ago to be stored in the CloudTrail, we need to configure the trail manually to ensure that it is stored in the event`s history.
For more information on AWS CloudTrail, kindly refer to the following URLs:
https://aws.amazon.com/blogs/aws/new-amazon-web-services-extends-cloudtrail-to-all-aws-customers/
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/how-cloudtrail-works.html