DOP-C02 Monitoring and Logging Practice Question
A company uses AWS CloudFormation to deploy infrastructure. The security team wants to be notified whenever a stack is created, updated, or deleted. They also want to track who made the change. Which combination of services should be used to achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail and Amazon CloudWatch Events (now Events) with SNS
CloudTrail captures CloudFormation API calls (CreateStack, UpdateStack, DeleteStack) and CloudWatch Events can trigger SNS notifications based on those API calls. Option A is wrong because Config rules evaluate resource compliance, not API events. Option C is wrong because S3 event notifications are for S3 objects. Option D is wrong because Lambda alone cannot capture who made the change without CloudTrail integration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config rules and Amazon SNS
Why it's wrong here
AWS Config rules are designed to evaluate the recorded configuration state of resources against compliance policies, not to capture or react to CloudFormation API operations. Since Config only reports post-change resource compliance, it cannot see the initiating event, the user identity, or the exact API call (e.g., UpdateStack, DeleteStack) that triggered the change. Pairing Config with SNS still yields only configuration drift notices, not real-time notifications of CloudFormation stack API events, so it fails the requirement.
- ✓
AWS CloudTrail and Amazon CloudWatch Events (now Events) with SNS
Why this is correct
AWS CloudTrail records all CloudFormation management-plane API calls as event payloads, including the calling identity, request parameters, and timestamp. Amazon CloudWatch Events (now EventBridge) can consume those CloudTrail events using a rule that matches on source: aws.cloudformation and specific event names like UpdateStack or DeleteStack. That rule can then route the matched event to an SNS topic, producing immediate, precise notifications of who performed the stack operation and what operation occurred. This is the native, event-driven pattern for CloudFormation activity monitoring.
- ✗
Amazon S3 event notifications and AWS Lambda
Why it's wrong here
Amazon S3 event notifications are strictly data-plane object-level events (e.g., s3:ObjectCreated:Put, s3:ObjectRemoved) that trigger only when an object is written to or deleted from a bucket. CloudFormation API calls such as CreateStack or UpdateStack are control-plane operations that do not generate S3 object events, even if the template body is stored in S3. A Lambda function could process S3 object events, but it would have no visibility into the CloudFormation API event, the caller identity, or the stack lifecycle, making this combination incapable of capturing the required stack-change notifications.
- ✗
AWS Lambda and Amazon DynamoDB
Why it's wrong here
AWS Lambda and Amazon DynamoDB simply do not provide any capture or filtering of AWS API events. DynamoDB is a managed NoSQL database that stores data, while Lambda is compute that executes code only when invoked by an explicit event source. Neither service can detect a CloudFormation API call on its own; without a CloudTrail feed or an EventBridge rule configured to invoke Lambda, there is no event source to trigger the function or data to record the API activity. At best, Lambda could be used in conjunction with CloudTrail or EventBridge, but by themselves this pair lacks identity tracking and event ingestion, so the answer is wrong.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 251-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.