DVA-C02 Security Practice Question
A company has a requirement that all API calls to AWS must be logged and monitored for suspicious activity. They want to receive alerts when root account activity is detected. Which AWS service and configuration should they use?
⚠ Common exam trap
A common mix-up: candidates confuse CloudTrail's logging capability with direct notification configuration—candidates often think SNS can be attached directly to CloudTrail, but CloudTrail requires an intermediary like CloudWatch Events to filter and route events to SNS or Lambda.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable AWS CloudTrail and create a CloudWatch Events rule to match root account API calls and trigger a Lambda function.
AWS CloudTrail captures all API calls, including those made by the root account. By creating a CloudWatch Events (now Amazon EventBridge) rule that matches the `userIdentity.type` field set to `Root` and the `eventSource` set to `signin.amazonaws.com`, you can trigger a Lambda function to send alerts or perform remediation. This provides real-time monitoring and notification for suspicious root account activity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable AWS CloudTrail and configure SNS notifications for root account events.
Why it's wrong here
AWS CloudTrail is essential for recording API calls and management events, delivering them to an S3 bucket and optionally to CloudWatch Logs. However, CloudTrail does not possess a native capability to directly send notifications to Amazon SNS for specific event types. To achieve SNS notifications from CloudTrail events, an intermediary service like CloudWatch Logs (with subscription filters) or CloudWatch Events/EventBridge (with a rule matching the event pattern) is required to process the logs and then trigger an SNS topic.
- ✓
Enable AWS CloudTrail and create a CloudWatch Events rule to match root account API calls and trigger a Lambda function.
Why this is correct
This option correctly outlines the standard and most effective architecture for real-time alerting on specific AWS API calls, such as root account usage. AWS CloudTrail captures all API activity, which can then be streamed to CloudWatch Logs. A CloudWatch Events rule (now often referred to as Amazon EventBridge) can be configured to filter these log events for specific patterns, like API calls made by the root user. Upon a match, the rule can reliably trigger an AWS Lambda function, which can then perform custom actions such as sending detailed alerts, enriching data, or initiating automated remediation.
- ✗
Use VPC Flow Logs to capture API calls and analyze with Athena.
Why it's wrong here
VPC Flow Logs capture IP traffic metadata at the network interface level, not the AWS API call records needed to detect root account sign-in events. This makes them incapable of logging the specific IAM user identity or service actions required by the scenario. The temptation arises because Flow Logs are a standard tool for network traffic analysis, and Athena can query them for anomalies; in a scenario requiring inspection of network-level patterns, such as unusual port scans or data transfer volumes, this combination would be correct.
- ✗
Use AWS Config rules to detect root account usage.
Why it's wrong here
AWS Config is designed to assess, audit, and evaluate the configurations of your AWS resources, ensuring compliance with specified rules and best practices. It primarily focuses on the *state* of resources and their configuration changes over time, rather than individual API calls or user actions. Therefore, AWS Config rules are incapable of directly detecting or alerting on specific API call events, such as a root user signing in or performing an action, as this falls outside its scope of configuration monitoring.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.