DOP-C02 Monitoring and Logging Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable Amazon GuardDuty and configure it to monitor CloudTrail logs for suspicious activity.

  Why it's wrong here

  Amazon GuardDuty is a threat detection service that consumes CloudTrail management events, VPC Flow Logs, and DNS logs to identify suspicious behavior such as compromised credentials or crypto-mining activity. It does not have built-in checks for configuration drift or trail health, and it cannot generate a targeted alert when a trail is stopped or updated. GuardDuty may eventually flag anomalous API patterns, but its focus is on malicious activity, not on maintaining the integrity of the CloudTrail configuration itself, so it would not satisfy the real-time notification requirement.

• ✓

  Create an Amazon EventBridge rule that matches CloudTrail API calls like StopLogging or UpdateTrail and triggers an SNS topic.

  Why this is correct

  Amazon EventBridge can natively consume CloudTrail management events and evaluate them against a rule with an event pattern that matches specific API calls such as StopLogging or UpdateTrail. Because the rule is event-driven, it triggers an SNS topic within seconds of the incident, enabling immediate notification to security operations. This approach requires no polling or configuration state evaluation, making it the most direct real-time mechanism for responding to changes to CloudTrail itself.

• ✗

  Use AWS Config rules with remediation actions to detect and revert changes to CloudTrail.

  Why it's wrong here

  AWS Config rules are resource-based and assess the configuration state of resources against desired policies, checking a trail for loggingEnabled or some other compliance field. They are evaluated on a periodic schedule (for example, every hour) or when a configuration change is detected, but never as a direct reaction to an API call event. A remediation action would only run after the rule has identified the trail as non-compliant, introducing an unavoidable delay that prevents the kind of immediate alerting offered by EventBridge. Additionally, you would need to author a custom rule to detect the specific configuration, whereas EventBridge already sees the raw API event.

• ✗

  Use AWS Trusted Advisor to check CloudTrail configuration and send alerts via email.

  Why it's wrong here

  AWS Trusted Advisor runs a set of best-practice checks on a periodic basis and covers categories like cost optimization, security, and fault tolerance, but it does not include a check for CloudTrail trail health or API-call-level activity. Any alerts Trusted Advisor sends via email or weekly digest are based on those infrequent checks, not on real-time events, and it cannot be configured to react to a specific StopLogging call. Therefore, Trusted Advisor cannot provide the instantaneous notification required by the use case.

Go deeper

Related to this question