AWS Certified Cloud Practitioner

Correct Answers: AWS CloudTrail (B) and Amazon CloudWatch (A)

Explanation:

1. AWS CloudTrail: This is the primary service for governance, compliance, and auditing. CloudTrail records AWS API calls for your account and delivers log files to you. It provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services.

2. Amazon CloudWatch: While primarily a monitoring service, CloudWatch can be used in conjunction with CloudTrail for governance and compliance. CloudWatch can monitor CloudTrail logs, set up alarms for specific activities, and help with compliance monitoring by tracking metrics and logs.

Why the other options are incorrect:

• Amazon GuardDuty (C): This is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, but it's not specifically for retaining records of account activities for governance and auditing.

• AWS Shield (D): This is a managed Distributed Denial of Service (DDoS) protection service, not for activity monitoring and auditing.

• AWS WAF (E): This is a web application firewall that helps protect web applications from common web exploits, not for account activity monitoring and auditing.

Key Points:

• CloudTrail is specifically designed for governance, compliance, and auditing by recording API calls and account activities.

• CloudWatch complements CloudTrail by providing monitoring, alerting, and log analysis capabilities.

• Together, these services provide comprehensive visibility into AWS account activities for security and compliance purposes.