The network team changes a Transit Gateway route table and needs to identify who performed the management operation. Which evidence is most appropriate?

1. CloudTrail events for the route-table API operation and caller identity.
2. DNS query logs for the Transit Gateway private IP.
3. The current route table alone, because it retains every previous caller.
4. VPC Flow Logs as the authoritative record of the IAM caller.