The correct choice is AWS CloudTrail because it captures management and data events for AWS services and provides a time stamped audit trail of API calls that shows who made changes where and when and the console offers a built in 90 day event history while logs can be delivered to Amazon S3 for longer retention.

AWS CloudTrail records management events and data events across services and includes attributes such as the caller identity the source IP and the event time which makes it suitable for compliance audits and forensic review.

Amazon Inspector is a vulnerability assessment and runtime security evaluation service and it does not provide a consolidated record of user API calls across the account.

AWS Config records resource configuration states and relationships and it helps with compliance and drift detection but it does not show the full API caller history in the same way CloudTrail does.

Amazon CloudWatch focuses on metrics logs and alarms and it can ingest logs for applications and services but it is not the primary source for a time stamped audit trail of API activity.

Full AWS Practitioner Certification Question