Week 4's tools answer different questions than CloudWatch. CloudWatch shows "what's happening now in real-time," but this week's tools answer "historically who did what, is current state compliant, how do we present evidence to external auditors"—retrospective, normative questions. Post-incident response and compliance require both real-time detection and post-incident tracking with evidence systems. Today we review how CloudTrail, CloudTrail Lake, AWS Config, and Audit Manager form layers, then finish with 10 high-frequency exam scenarios.