DOP-C02 Security and Compliance Practice Question
An organization has a compliance requirement to automatically detect and alert on any IAM user creation in all AWS accounts. Which combination of services should be used to meet this requirement?
⚠ Common exam trap
Watch out — candidates often confuse AWS Config (which evaluates resource configurations) with CloudTrail (which records API activity), leading them to select Option C, but AWS Config cannot trigger alerts on API call events like `CreateUser`; it only reacts to configuration changes after they have occurred.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail and Amazon CloudWatch Events
AWS CloudTrail captures all IAM user creation events as `CreateUser` API calls. Amazon CloudWatch Events (now Amazon EventBridge) can be configured with a rule that matches this specific event pattern and triggers an alert via Amazon SNS. This combination provides real-time detection and notification without custom code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon GuardDuty and Amazon SNS
Why it's wrong here
GuardDuty is a threat detection service that analyzes VPC Flow Logs, DNS query logs, and CloudTrail management events to identify malicious activity such as cryptocurrency mining or compromised credentials. Even though it consumes CloudTrail events, its purpose is to generate security findings, not to provide event-driven, per-API-call notifications for compliance operations like IAM user creation. SNS simply delivers messages; without an event source that directly tracks CreateUser, this pairing cannot automatically alert on each IAM user creation event.
- ✗
Amazon S3 server access logs and Amazon Athena
Why it's wrong here
S3 server access logs capture object-level operations on an S3 bucket, such as GET, PUT, DELETE, and LIST requests, but they contain no IAM management-plane API calls because CreateUser is an operation on the IAM service, not on an S3 object. Athena could query those logs if they existed, but the fundamental problem is that the data source does not include the events you care about. Therefore, this solution cannot trigger an alert when an IAM user is created because the event is never recorded in the logs Athena would analyze.
- ✗
AWS Config and AWS Lambda
Why it's wrong here
AWS Config tracks the configuration state of AWS resources and delivers ConfigurationItemChangeNotifications when resources are created, modified, or deleted, but it does not capture the API call that caused the change. Config can query whether an IAM user exists, but it does not know that the CreateUser API was invoked or by whom, because that event is outside Config's scope. While Lambda functions can run custom rules, they would be evaluating configuration snapshots, not processing the real-time API event, so the pairing still cannot automatically alert on the actual CreateUser action.
- ✓
AWS CloudTrail and Amazon CloudWatch Events
Why this is correct
CloudTrail is the authoritative audit service that records every management API call, including the IAM CreateUser event, along with details such as the requesting IAM principal, source IP address, and timestamps. You can configure CloudWatch Events (or Amazon EventBridge) with an event pattern that matches `"eventSource": "iam.amazonaws.com"` and `"eventName": "CreateUser"`, and route matching events to an SNS topic or Lambda function for immediate notification. This provides the real-time, event-driven alerting that directly satisfies a compliance requirement to automatically detect and respond to IAM user creation.
Go deeper
Related to this question
About these practice questions
One of 251 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company's Security team wants to detect and alert on the creation of IAM users with console access. Which THREE services should be used?
hard- ✓ A.AWS CloudTrail
- ✓ B.Amazon CloudWatch Logs
- C.AWS Config
- D.Amazon GuardDuty
- ✓ E.Amazon CloudWatch Alarms
Why A: CloudTrail logs the CreateUser and CreateLoginProfile API calls. CloudWatch Logs can receive CloudTrail logs and create metric filters. CloudWatch Alarms can trigger on the metric. Config can track resource changes but not as efficient for alerting on API calls. GuardDuty does not specifically focus on IAM user creation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.