SAP-C02 Continuous Improvement for Existing Solutions Practice Question
A company uses AWS CloudTrail to log all API calls. The security team wants to be alerted when an IAM user creates a new access key. What is the MOST efficient way to achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a CloudWatch Events rule that matches the CreateAccessKey API call and sends an SNS notification.
The most efficient way to alert when an IAM user creates a new access key is to use CloudWatch Events (now Amazon EventBridge) to match the CreateAccessKey API call from CloudTrail and trigger an SNS notification. Option A is incorrect because CloudTrail Insights is for detecting unusual activity patterns, not for real-time event-driven alerts. Option C is less efficient because it requires additional steps of publishing logs to CloudWatch Logs and creating a metric filter, adding complexity. Option D is inefficient because querying CloudTrail logs with Athena is not real-time and requires custom scheduling.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable CloudTrail Insights to detect unusual key creation patterns.
Why it's wrong here
Insights is for anomaly detection, not specific event notification.
- ✓
Create a CloudWatch Events rule that matches the CreateAccessKey API call and sends an SNS notification.
Why this is correct
CloudWatch Events can react to specific CloudTrail events in real-time.
- ✗
Use CloudTrail to publish logs to CloudWatch Logs and create a metric filter to trigger an alarm.
Why it's wrong here
CloudTrail publishing to CloudWatch Logs with a metric filter can alert on access key creation events, but this approach introduces latency from log delivery and metric evaluation, making it less immediate than using Amazon EventBridge, which processes CloudTrail events in near-real time. It is tempting because metric filters are commonly used for monitoring patterns in log data, and this method would be correct if the requirement were to analyse historical trends or aggregate counts over time rather than trigger a prompt security alert.
- ✗
Configure Amazon Athena to query CloudTrail logs and set up a scheduled query to notify.
Why it's wrong here
Athena is for analysis, not real-time notification.
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.