DOP-C02 Security and Compliance Practice Question
A company's Security team wants to detect and alert on the creation of IAM users with console access. Which THREE services should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
CloudTrail logs the CreateUser and CreateLoginProfile API calls. CloudWatch Logs can receive CloudTrail logs and create metric filters. CloudWatch Alarms can trigger on the metric. Config can track resource changes but not as efficient for alerting on API calls. GuardDuty does not specifically focus on IAM user creation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail is the authoritative audit service that records management events as API calls, including the CreateUser action that IAM user creation invokes. By enabling CloudTrail, your security team gains a detailed, tamper-evident log of who created which IAM user, from which source IP, and with what permissions. This event data can then be delivered to Amazon CloudWatch Logs for further processing and alerting, making CloudTrail the essential first step in a real-time monitoring pipeline.
- ✓
Amazon CloudWatch Logs
Why this is correct
Amazon CloudWatch Logs acts as the ingestion and processing layer for CloudTrail events when you configure CloudTrail to deliver trails to a CloudWatch Logs log group. Once the events are in CloudWatch Logs, you can create metric filters that scan incoming log events for patterns like the IAM CreateUser API call, incrementing a CloudWatch metric for each match. This converts raw audit logs into a quantitative metric that can be used to trigger alarms, which is exactly why CloudWatch Logs is a correct and necessary component of the solution.
- ✗
AWS Config
Why it's wrong here
AWS Config is designed to track resource configuration changes and evaluate them against rules, but it does not provide real-time alerting on API calls like IAM user creation. While Config can record that an IAM user resource has changed and might even detect new users during periodic evaluations, it operates on configuration snapshots and remediation, not on streaming events. Its event-driven model is not suited for immediate, per-API-call alerting, so it would not satisfy the security team's requirement for real-time detection.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a threat detection service that analyzes continuous streams of AWS data—such as VPC Flow Logs, DNS logs, and CloudTrail management events—to identify malicious or anomalous behavior like compromised credentials or reconnaissance. It is not designed to generate alerts for routine administrative actions such as the creation of an IAM user, which may be entirely legitimate and common in a production environment. GuardDuty's models focus on threat signatures and anomalies, not on every IAM event, so it is the wrong tool for this specific, non-threat-based alerting requirement.
- ✓
Amazon CloudWatch Alarms
Why this is correct
Amazon CloudWatch Alarms are the alerting mechanism that watches a CloudWatch metric and transitions into an ALARM state when the metric crosses a defined threshold, triggering an action like sending an Amazon SNS notification. In this scenario, the alarm would be configured on the metric produced by a CloudWatch Logs metric filter, so that a sustained or even a single occurrence of the IAM CreateUser event raises an alert. This completes the loop from log to notification, making CloudWatch Alarms a correct and indispensable part of the overall solution—though it relies on the preceding services to generate the metric.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.