The correct answer is They provide evidence for regulatory requirements and assist forensic investigations and lessons learned.

Complete audit trails record detailed events with timestamps and contextual data across systems and users. This makes them indispensable for demonstrating compliance with regulatory requirements and for reconstructing incident timelines during forensic investigations. They also enable structured lessons learned that improve detection rules, response playbooks, and overall continuous monitoring.

They replace the need for a centralized log aggregation service such as Cloud Logging is incorrect because audit trails are the raw records that still need centralized collection, correlation, secure storage, and access controls to be useful at scale. A centralized log service provides the platform to retain, search, and analyze those trails.

They allow teams to ignore low priority alerts and deprioritize monitoring is incorrect because comprehensive audit trails help teams triage and tune alerts rather than justify ignoring them. Ignoring alerts or deprioritizing monitoring increases risk and undermines both incident response and continuous monitoring.

They reduce the need for coordination between the security operations center and incident responders is incorrect because audit trails increase the value of coordination. Both teams must agree on what to log, how to interpret trails, and how to preserve evidence and hand off investigations for effective response.

Full AWS Practitioner Certification Question