CLF-C02 Billing, Pricing, and Support Practice Question
A company wants to receive a notification whenever a new AWS root account sign-in occurs. Which combination of services achieves this?
⚠ Common exam trap
Many candidates confuse AWS Config (which audits resource configurations) with CloudTrail (which records API activity), leading them to pick Option A, or they mistakenly think AWS Budgets can monitor security events, when it is strictly for cost and usage alerts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CloudTrail + EventBridge + SNS notification
AWS CloudTrail logs all root account sign-in events as `ConsoleLogin` events in the management events trail. Amazon EventBridge can be configured with a rule that matches this specific event pattern (e.g., `detail.userIdentity.type` = `Root` and `detail.eventName` = `ConsoleLogin`). The rule then triggers an Amazon SNS topic to send a notification (email, SMS, etc.) to the designated recipients. This combination provides a real-time, event-driven notification for root account activity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config + AWS Lambda
Why it's wrong here
AWS Config is designed to record resource configuration changes and evaluate them against compliance rules, not to capture IAM authentication or sign-in activity. Although an AWS Lambda function can be invoked by Config on configuration changes, root user ConsoleLogin events do not produce a configuration item, so this combination has no event source for real-time sign-in alerts. The service that records API activity and sign-in events is CloudTrail, not Config.
- ✓
CloudTrail + EventBridge + SNS notification
Why this is correct
This is the correct combination because AWS CloudTrail logs all management events, including the root user's ConsoleLogin event, with details such as source IP and MFA status. An Amazon EventBridge rule can then match the event pattern for a root sign-in (source: aws.signin, eventName: ConsoleLogin, userIdentity.type: Root) and immediately deliver that event to an Amazon SNS topic. SNS then sends notifications via email, SMS, or other endpoints, providing near-real-time alerting on root account usage.
- ✗
AWS Budgets + SES email
Why it's wrong here
AWS Budgets monitors cost and usage against configured thresholds and sends alerts when spending exceeds those thresholds; it has no visibility into authentication events or user sign-ins. Amazon SES is an email-sending service and could theoretically deliver a message, but without a service that detects the root ConsoleLogin and triggers SES, no alert can be generated. This option addresses cost governance, not security monitoring, so it is incorrect.
- ✗
Amazon GuardDuty finding + S3 export
Why it's wrong here
Amazon GuardDuty uses machine learning and threat intelligence to detect anomalous or potentially malicious activity, and it may eventually generate a finding for unusual root usage, but this is not guaranteed for every root sign-in and can involve delay. Exporting GuardDuty findings to Amazon S3 is a storage/archiving mechanism, not a real-time notification pipeline; you would still need EventBridge and SNS for immediate alerting. The deterministic, event-driven audit trail for root console logins comes from CloudTrail and EventBridge, making this combination incomplete and less reliable.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.