DOP-C02 Monitoring and Logging Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable CloudTrail log file validation and create a CloudWatch alarm on the DigestDeliveryFailed metric

  Why this is correct

  CloudTrail's built-in log file validation creates hash-chained digest files that are digitally signed with a private key, and you can verify them with the public key published by AWS. The CloudTrail service emits the DigestDeliveryFailed metric to CloudWatch when it cannot deliver a digest file, which is often the first sign of tampering or a delivery problem. Creating a CloudWatch alarm on this metric gives you immediate, proactive notification without building custom code.

• ✗

  Create a Lambda function that checks the integrity of logs and publishes to SNS

  Why it's wrong here

  Writing a Lambda function to verify log integrity is an anti-pattern here because CloudTrail already ships native, cryptographically signed digest files for validation, so you would be duplicating functionality at significant cost and complexity. You would need to implement the digest verification algorithm, securely manage AWS's public key, and then publish to SNS yourself, all of which introduces risk of errors. Additionally, a Lambda cannot natively monitor for digest delivery failures from CloudTrail, so a critical part of the detection loop would still require extra work.

• ✗

  Configure CloudTrail to deliver logs to the S3 bucket and enable SNS notifications for all events

  Why it's wrong here

  CloudTrail does write log files to S3, but it does not natively publish SNS notifications for every API event; SNS integration requires a separate bucket event notification, and those notifications simply indicate object creation, not integrity or validation status. Enabling SNS for all events would generate a high volume of noisy messages that give you no information about log authenticity or tampering. The correct built-in mechanism to be alerted on validation problems is the CloudTrail CloudWatch metric, not SNS for raw events.

• ✗

  Send CloudTrail logs to CloudWatch Logs and create a metric filter for validation errors

  Why it's wrong here

  While CloudTrail can stream events to CloudWatch Logs, log file validation operates entirely on the S3 digest files and is completely independent of the CloudWatch Logs delivery path. The validation outcome is not recorded as a field or message within the log events, so a metric filter would have nothing to match; there are no 'validation error' entries to filter on. Even if you filtered for something else, you would still be missing the actual alerting mechanism: the DigestDeliveryFailed metric emitted by CloudTrail.

Go deeper

Related to this question