Question 251 of 256
DOP-C02 Monitoring and Logging Practice Question
A company is using AWS CloudTrail to track API calls. They want to be notified immediately when an IAM user creates a new access key. Which combination of AWS services should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon CloudWatch Events (Amazon EventBridge) with an Amazon SNS topic.
To be notified immediately when an IAM user creates a new access key, the most efficient approach is to use Amazon CloudWatch Events (Amazon EventBridge) with an Amazon SNS topic. CloudTrail records the 'CreateAccessKey' API call as an event. An EventBridge rule can be configured to match this specific event pattern and send the event to an SNS topic, which can then send notifications via email, SMS, etc. This provides real-time notification without additional services. Option A (CloudWatch Logs with metric filter and alarm) requires sending CloudTrail logs to CloudWatch Logs, which adds latency and complexity; it is not as direct as EventBridge. Option B (AWS Config with Lambda) is not designed for real-time event notification. Option C (EventBridge with Lambda and SES) adds unnecessary Lambda processing since SNS can directly send email when subscribed to the topic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon CloudWatch Logs with a metric filter and alarm.
Why it's wrong here
Routing CloudTrail logs to CloudWatch Logs requires an additional delivery configuration in the trail, and metric filters then scan those logs asynchronously. The alarm only fires after the log stream is written and the metric filter evaluates the data, which introduces noticeable latency and misses the point of real-time API call tracking. EventBridge receives CloudTrail events natively without this intermediate log pipeline, making it the more direct and lower-latency option.
- ✗
AWS Config with an AWS Lambda function.
Why it's wrong here
AWS Config is fundamentally a configuration recording and compliance service: it tracks resource configuration changes and evaluates them against rules, not individual API calls. A Lambda function triggered by an AWS Config rule would react to configuration drift or compliance violations, not to the occurrence of a specific API action, and Config delivers evaluations on a timeline of minutes rather than in real time. For immediate notification of an API call, you need an event-driven service that consumes CloudTrail events directly, which AWS Config is not designed to do.
- ✗
Amazon CloudWatch Events (Amazon EventBridge) with an AWS Lambda function that sends an email via Amazon SES.
Why it's wrong here
While an EventBridge rule can target a Lambda function, that function must then execute code to format and send an email through SES, adding cold-start latency, a potential error surface, and IAM permissions to manage. This pattern works but is overengineered because Amazon SNS is a fully managed pub/sub service that can directly receive the rule's matched event and deliver it as an email notification without any compute. The minimal and more reliable design is for EventBridge to invoke SNS directly, eliminating the intermediate Lambda hop entirely.
- ✓
Amazon CloudWatch Events (Amazon EventBridge) with an Amazon SNS topic.
Why this is correct
Amazon EventBridge is the native event router for CloudTrail API activity: CloudTrail automatically delivers every call to an event bus, and a rule with a JSON pattern can match the specific API (e.g., an unauthorized or sensitive call). The rule immediately invokes an Amazon SNS topic, which then fans out notifications via email, SMS, or other subscribers. This event-driven flow provides sub-second, real-time alerts with no polling, no custom code, and direct integration, making it the correct architecture.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 20, 2026
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.