Being an AWS administrator for a certain company with AWS infrastructure in two regions, you are involved in architecting a web application environment. There is a requirement for monitoring API calls to ensure that auditing the environment for compliance is secure. It should follow strict security compliance requirements, and also the logs should be encrypted. Which of the following would you choose to achieve this?

Answer options:

A.AWS VPC flow logs and Subnet logs.
B.AWS CloudTrail logs
C.Use request tracing .
D.AWS CloudTrail logs and CloudWatch logs.

Correct Answer: B
AWS CloudTrail helps monitor all the API calls in your AWS account and is used for compliance purposes. It supports multi-region configuration. By default, AWS automatically encrypts the CloudTrail logs stored in the S3 bucket using Amazon S3 server-side encryption.
Option A is incorrect because -VPC flow logs are used to capture information about the IP traffic going to and from network interfaces in your VPC. Mostly they can be useful for security auditing. The Subnet flow logs help capture information about the IP traffic going to and from network interfaces associated with your subnet. They are similar to VPC flow logs, just that they capture traffic associated with the subnets.
Option C is incorrect because -This is used, for example, when using a load balancer to trace HTTP requests from clients to targets or other services.
Option D is incorrect as CloudWatch is used to monitor performance and not the API calls.