The correct choice is AWS Config. It is built to detect and record configuration changes for supported AWS resources and to trigger notifications so the company can enforce governance and demonstrate compliance during audits.

AWS Config continuously records resource configuration state and retains configuration history. It evaluates resources against configurable rules to determine compliance and can send notifications for configuration changes or noncompliant resources by integrating with services such as Amazon SNS.

AWS Security Hub aggregates and prioritizes security findings from multiple sources and integrates results across services. It does not provide per resource configuration history or native change detection and notification for resource configuration like AWS Config.

AWS CloudTrail logs API activity and can be used to alert on specific management events but it does not maintain ongoing configuration state or perform rule based compliance evaluation that Config provides.

Amazon Inspector focuses on automated vulnerability assessment of workloads and packaged software and it is not designed to track resource configuration changes or to evaluate compliance rules for infrastructure configuration.

Full AWS Practitioner Certification Question