Your CTO Thinks Your AWS Account Was Hacked

Multiple Choice

Your CTO thinks your AWS account was hacked. What is the only way to know for certain if there was unauthorized access and what they did, assuming your hackers are very sophisticated AWS engineers and doing everything they can to cover their tracks?

A) Use CloudTrail Log File Integrity Validation.
B) Use AWS Config SNS Subscriptions and process events in real time.
C) Use CloudTrail backed up to AWS S3 and Glacier.
D) Use AWS Config Timeline forensics.