Logging and auditing of system and file events is correct. This practice is specifically about keeping detailed event records and identifying unauthorized modifications to important configuration files and operating system components.

Logging captures events such as file accesses, modifications, user logons and system changes. Auditing and log analysis look for anomalies and can include file integrity monitoring to detect tampering. Together these controls provide forensic trails and real time alerts that help identify and investigate unauthorized changes to vital files and OS components.

Identity and Access Management controls manage who can access systems and what permissions they have. They do not by themselves create the persistent event records or perform continuous file integrity checks that are needed to detect unauthorized modifications.

Static application security testing analyzes application source code or binaries for vulnerabilities during development. It does not monitor runtime system or file events or detect changes to operating system components.

Secure integration of application components focuses on designing and deploying components so they communicate securely and do not introduce vulnerabilities. It does not center on logging events or auditing file and system level modifications.

Full AWS Practitioner Certification Question