The correct answer is D because AWS CloudTrail is the AWS service that records management activity across an account, including actions taken through the AWS Management Console, CLI, SDKs, and APIs.
AWS documentation explains that CloudTrail provides a history of account activity and captures management events, which is exactly what investigators need when reconstructing who changed cloud resources, when those changes occurred, and how they were initiated. That makes it the key source for control-plane timeline analysis. Amazon S3 Server Access Logging is limited to S3 request logging and does not provide broad account-wide management visibility. The AWS CLI is a tool for interacting with AWS, not the forensic record itself. Amazon CloudWatch can collect metrics and logs, but the question specifically asks for the authoritative account-wide record of management actions. CHFI v11 includes cloud forensics and AWS evidence sources, so candidates are expected to distinguish platform activity logs from service-specific or tooling components. For unauthorized modifications across AWS accounts, CloudTrail is the primary source for identity-linked management event reconstruction.