DOP-C02 Monitoring and Logging Practice Question
Exhibit
CloudTrail log entry:
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"arn": "arn:aws:iam::123456789012:user/JohnDoe",
"accountId": "123456789012",
"userName": "JohnDoe"
},
"eventTime": "2024-06-01T12:00:00Z",
"eventSource": "ec2.amazonaws.com",
"eventName": "RunInstances",
"awsRegion": "us-east-1",
"sourceIPAddress": "203.0.113.50",
"userAgent": "console.amazonaws.com",
"requestParameters": {
"instanceType": "t2.micro",
"imageId": "ami-0abcdef1234567890",
"maxCount": 1,
"minCount": 1
},
"responseElements": {
"instancesSet": {
"items": [
{
"instanceId": "i-0abcd1234efgh5678",
"instanceState": {
"code": 0,
"name": "pending"
}
}
]
}
}
}Refer to the exhibit. An administrator wants to be notified when any EC2 instance is launched in the account. Which combination of services would provide the most efficient and cost-effective solution?
⚠ Common exam trap
DOP-C02 often tests the confusion between CloudWatch metrics and CloudTrail events, and candidates may incorrectly assume CloudWatch has a RunInstances metric.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an Amazon EventBridge rule that matches RunInstances events from CloudTrail and sends to an SNS topic.
The most efficient and cost-effective solution is to create an Amazon EventBridge rule that matches RunInstances events from CloudTrail and sends notifications to an SNS topic. EventBridge provides near real-time event processing with minimal overhead, and CloudTrail captures EC2 instance launch events. This avoids the need for continuous polling or additional services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable detailed billing reports and create a cost anomaly detection monitor.
Why it's wrong here
Cost and Usage Reports are delivered on a scheduled basis, typically daily, and AWS Cost Anomaly Detection service analyzes aggregate spend patterns across accounts, linked accounts, or cost categories — it does not inspect the EC2 RunInstances API event stream. By the time a billing anomaly is flagged, the launch has already happened, and the alert cannot identify which instance was launched or the requesting IAM identity. This option addresses cost monitoring, not real-time operational event notification.
- ✗
Use AWS Config rules to detect non-compliant instances and trigger an SNS notification.
Why it's wrong here
AWS Config rules evaluate resource configurations for compliance against managed or custom policies, such as enforcing required tags or instance types, and they operate on configuration changes rather than CloudTrail API event streams. A Config rule only emits an SNS notification when the compliance state changes, so an instance that launches in a compliant manner would generate no alert, and there is built-in evaluation latency as well. It is not designed to notify on every specific EC2 API call like RunInstances, regardless of compliance status.
- ✓
Create an Amazon EventBridge rule that matches RunInstances events from CloudTrail and sends to an SNS topic.
Why this is correct
An EventBridge rule can match event patterns against CloudTrail records, for example source 'aws.ec2', detail-type 'AWS API Call via CloudTrail', and eventName 'RunInstances'. When a matching API call occurs, EventBridge invokes an SNS topic in near real time, and the event payload contains instance IDs, user identity, request parameters, and response elements. This is the native AWS event-driven pattern for reacting to EC2 API activity.
- ✗
Set up a CloudWatch alarm on the RunInstances metric in the EC2 namespace.
Why it's wrong here
Amazon EC2 does not emit a 'RunInstances' metric in the EC2 namespace; CloudWatch metrics for EC2 are utilization-based or health-based (for example, CPUUtilization, NetworkIn, StatusCheckFailed) and do not capture API operations. CloudWatch alarms only evaluate time-series metric values over aggregation periods, so they cannot react to a discrete point-in-time event like an instance launch. You could theoretically create a custom metric from CloudTrail via a metric filter, but that adds complexity and processing delay, and it is not a built-in EC2 metric.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,298 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.