DOP-C02 Monitoring and Logging Practice Question
Exhibit
CloudTrail log entry (JSON):
{
"eventVersion": "1.08",
"userIdentity": {
"type": "AssumedRole",
"arn": "arn:aws:sts::123456789012:assumed-role/AdminRole/JohnDoe",
"accountId": "123456789012",
"sessionContext": {
"sessionIssuer": {
"type": "Role",
"principalId": "AROAEXAMPLEID",
"arn": "arn:aws:iam::123456789012:role/AdminRole",
"accountId": "123456789012",
"userName": "AdminRole"
},
"webIdFederationData": {},
"attributes": {
"creationDate": "2025-03-15T14:30:00Z",
"mfaAuthenticated": "false"
}
}
},
"eventTime": "2025-03-15T14:35:00Z",
"eventSource": "ec2.amazonaws.com",
"eventName": "TerminateInstances",
"awsRegion": "us-east-1",
"sourceIPAddress": "203.0.113.50",
"userAgent": "console.amazonaws.com",
"requestParameters": {
"instancesSet": {
"items": [{"instanceId": "i-0abcd1234efgh5678"}]
}
},
"responseElements": {
"instancesSet": {
"items": [{"instanceId": "i-0abcd1234efgh5678", "currentState": {"code": 32, "name": "shutting-down"}}]
}
}
}Refer to the exhibit. A security team reviews this CloudTrail log entry. Which finding is most concerning?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user did not authenticate with MFA.
The session was created without MFA (mfaAuthenticated: false). This is a security concern because the role allows console access and the user did not use MFA, increasing risk of unauthorized access. The termination is the action, but the lack of MFA is a security gap.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The event occurred in us-east-1.
Why it's wrong here
The AWS region where a CloudTrail event occurs (us-east-1) is an operational attribute, not a security indicator. Regions are chosen for latency, compliance, or service availability, and us-east-1 is the default for many accounts. A security review should focus on the identity, authentication level, and authorization of the caller, not the endpoint location.
- ✗
The instance was terminated by an assumed role.
Why it's wrong here
Assumed roles via AWS STS are a standard pattern for granting temporary, least-privilege credentials to users, services, or cross-account operations. When an IAM user assumes a role to terminate an instance, CloudTrail records this with the assumed role session, but the action is still traceable to an authenticated principal. This is normal cloud operation behavior and does not, by itself, indicate unauthorized activity; the critical check is whether MFA was required and used when the role was assumed.
- ✗
The source IP is from a public IP.
Why it's wrong here
A public source IP address is expected for any console or API access originating outside the AWS network, including legitimate administrative sessions from corporate or home networks. CloudTrail records the IP for forensic purposes, but a public IP alone does not imply a threat. The security relevance lies in whether the IP matches an expected allowlist or known malicious reputation, not in the fact that it is public.
- ✓
The user did not authenticate with MFA.
Why this is correct
The absence of MFA in a CloudTrail session is a direct security-control failure because AWS relies on multi-factor authentication as a second factor to verify the caller's identity beyond long-term credentials. For sensitive actions like terminating an EC2 instance, missing MFA increases the risk that the request came from compromised keys or a stolen session. This makes the MFA status the key anomaly that warrants investigation, as it violates the security best practice of enforcing MFA for destructive operations.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,487-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.