The correct option is Enable DynamoDB Streams with NEW_AND_OLD_IMAGES and invoke an AWS Lambda function to persist each change record to Amazon S3. This approach captures every item change and writes an auditable copy outside the table.

DynamoDB Streams provides a time ordered sequence of item level changes and the NEW_AND_OLD_IMAGES setting includes both before and after images so you can record the exact state transitions. Using Lambda as a stream consumer keeps operational overhead low and allows you to persist immutable records to S3 for long term retention and easy retrieval.

Use Amazon CloudTrail and run an EC2-based parser to read CloudTrail logs and copy changed items into another DynamoDB table is incorrect because CloudTrail records API calls rather than item images and it would require managing EC2 instances and additional parsing work to reconstruct item state.

Create DynamoDB Global Tables across two Regions and export stream records directly to Amazon S3 is incorrect because Global Tables are for multi Region replication and not for auditing, and there is no built in path to export Streams directly to S3 without a consumer such as Lambda or Kinesis.

Send DynamoDB events to Amazon CloudWatch Logs and have AWS Lambda filter deletes and archive them to Amazon S3 is incorrect because DynamoDB does not emit item change records to CloudWatch Logs and this pattern would miss inserts and updates while adding unnecessary complexity.

Full AWS Practitioner Certification Question