CloudTrail Real-Time Monitoring with EventBridge
A company uses AWS CloudTrail to log API activity in their AWS account. They need to ensure that any changes to CloudTrail configuration itself are detected and alerted upon in real time. Which service should they use?
Quick Answer
The answer is Amazon CloudWatch Events (EventBridge), which enables CloudTrail real-time monitoring with EventBridge by allowing you to create a rule that matches specific API calls like StopLogging or UpdateTrail. This is correct because CloudTrail itself logs API activity but cannot natively trigger alerts on its own configuration changes; EventBridge fills that gap by acting as a real-time event bus that evaluates CloudTrail events as they occur and immediately invokes downstream actions such as SNS notifications or Lambda functions. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this scenario tests your understanding of how to chain AWS services for security monitoring—a common trap is to assume CloudTrail alone provides alerting, but it only delivers logs to S3 or CloudWatch Logs, not real-time reactions. Memory tip: think “Trail changes need a Bridge” — CloudTrail logs the action, EventBridge bridges it to an alert.
⚠ Common exam trap
A common mix-up: candidates confuse AWS Config (which is for compliance and configuration history) with real-time event-driven alerting, or they think GuardDuty covers all security monitoring, but neither provides the specific real-time API call detection that EventBridge offers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Amazon CloudWatch Events (EventBridge) to create a rule matching the StopLogging or UpdateTrail API calls.
Amazon CloudWatch Events (EventBridge) can monitor CloudTrail API calls in real time by creating a rule that matches specific API calls such as StopLogging or UpdateTrail. When these calls are made, the rule triggers an action (e.g., SNS notification or Lambda function) to alert administrators immediately. This provides the real-time detection required for changes to CloudTrail configuration itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use Amazon CloudWatch Events (EventBridge) to create a rule matching the StopLogging or UpdateTrail API calls.
Why this is correct
CloudWatch Events can trigger notifications in real time for specific API calls.
- ✗
Enable AWS Config rules to monitor CloudTrail configuration changes.
Why it's wrong here
AWS Config evaluates changes periodically, not in real time.
- ✗
Use Amazon CloudWatch Logs Insights to query CloudTrail logs for changes.
Why it's wrong here
Logs Insights is for querying, not real-time alerting.
- ✗
Enable Amazon GuardDuty to detect changes to CloudTrail.
Why it's wrong here
GuardDuty is not designed for CloudTrail configuration monitoring.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 251-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to receive a notification when an AWS IAM user creates a new access key. Which AWS service should be used to capture this event and trigger a notification?
easy- A.Amazon GuardDuty
- ✓ B.AWS CloudTrail with CloudWatch Events
- C.Amazon CloudWatch
- D.AWS Config
Why B: AWS CloudTrail captures API activity, including the CreateAccessKey event when an IAM user creates a new access key. By sending these events to Amazon CloudWatch Events (now part of Amazon EventBridge), you can define a rule that triggers a notification via SNS, Lambda, or other targets. This combination provides the real-time event-driven notification the company requires.
Variation 2. A company uses AWS CloudTrail to log all API calls in their AWS account. They need to ensure that any changes to CloudTrail configuration (such as disabling the trail or modifying the log file validation) are immediately detected and trigger an automated response. Which solution should the DevOps engineer implement?
medium- A.Enable Amazon GuardDuty and configure it to monitor CloudTrail logs for suspicious activity.
- ✓ B.Create an Amazon EventBridge rule that matches CloudTrail API calls like StopLogging or UpdateTrail and triggers an SNS topic.
- C.Use AWS Config rules with remediation actions to detect and revert changes to CloudTrail.
- D.Use AWS Trusted Advisor to check CloudTrail configuration and send alerts via email.
Why B: AWS CloudTrail logs are delivered to an S3 bucket, and any API calls that modify CloudTrail (such as StopLogging or UpdateTrail) are recorded by CloudTrail itself. An Amazon EventBridge rule can be set to match these specific API call events and trigger an SNS topic for immediate notification or a Lambda function for automated response. Option A is wrong because GuardDuty is designed to detect security threats, not to monitor CloudTrail configuration changes in real time. Option C is wrong because AWS Config can detect configuration drift but its evaluations are periodic (e.g., every 10 minutes) and not real-time, whereas EventBridge provides immediate detection. Option D is wrong because Trusted Advisor checks best practices but does not monitor CloudTrail changes specifically.
Variation 3. A DevOps team needs to monitor failed API calls in their AWS account. They want to receive notifications when specific IAM actions, such as DeleteBucket, fail. Which service should they use?
medium- ✓ A.AWS CloudTrail and Amazon EventBridge.
- B.AWS Config rules.
- C.Amazon S3 server access logs.
- D.CloudWatch Logs and metric filters.
Why A: AWS CloudTrail captures API calls, and Amazon EventBridge (formerly CloudWatch Events) can be used to create rules that match specific failed API calls (e.g., DeleteBucket) and trigger notifications. Option B is incorrect because AWS Config rules monitor resource configuration compliance, not API call failures. Option C is incorrect because S3 server access logs log requests made to an S3 bucket, not IAM API calls. Option D is incorrect because CloudWatch Logs and metric filters are used to monitor log data, but they are not the primary service for capturing API calls; CloudTrail is needed for that.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.