The company requires a recorded history of any changes to security groups and wants the SysOps administrator notified whenever a security group is modified. Which implementation accomplishes both goals?

The correct option uses AWS Config, which is specifically designed to record and evaluate configuration changes of AWS resources, including security groups. It stores this history, and can trigger Amazon SNS notifications for changes, allowing the administrator to be alerted via email. Incorrect options: Amazon Detective is a security service for investigating potential security issues, not for recording configuration changes or providing real-time alerts on resource modifications. AWS Systems Manager Change Manager is for managing operational changes to your application configuration and infrastructure, not for recording all configuration history of individual AWS resources like security groups. The other option involving Amazon Detective again misuses Detective's primary purpose. While it can store data in S3 and use SNS, it's not the service for tracking configuration changes.