How to Alert on Specific API Calls Using CloudTrail and CloudWatch
A company is using AWS CloudTrail to monitor API activity in its AWS account. The security team needs to be alerted when unauthorized API calls are made to delete Amazon S3 buckets. Which TWO steps should the security team take to meet this requirement? (Choose TWO.)
Quick Answer
Both correct actions here rely on the same underlying mechanism: CloudTrail records every DeleteBucket API call, and that recorded event can be matched by a rule that then triggers an SNS notification, but there are two valid technical paths to get there. One path routes CloudTrail logs into CloudWatch Logs, defines a metric filter that counts occurrences of the DeleteBucket call, and attaches an alarm to that metric that fires an SNS notification once the threshold is crossed. The other path uses Amazon CloudWatch Events, now called Amazon EventBridge, to match the DeleteBucket API call directly as an event from CloudTrail and trigger the SNS notification immediately, without needing an intermediate metric filter or alarm at all. The distinction worth internalizing is that a metric-filter-and-alarm approach is built for counting occurrences over time and alerting on thresholds, while an EventBridge rule is built for reacting to a specific event the instant it happens, and AWS security exams frequently present both as valid but structurally different ways to alert on a specific API call. When a question asks for TWO ways to alert on a specific CloudTrail-logged action, expect one answer to route through CloudWatch Logs metric filters and alarms and the other to route through EventBridge event pattern matching, since these represent the two standard patterns for turning a logged API call into a notification.
⚠ Common exam trap
Candidates often confuse AWS Config (which evaluates resource configurations) with CloudTrail (which records API activity), or think VPC Flow Logs can capture API-level events instead of network flows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure CloudTrail to deliver logs to Amazon CloudWatch Logs and create a metric filter for the DeleteBucket API call.
CloudTrail can be configured to deliver logs to Amazon CloudWatch Logs, and a metric filter can be created to match the `DeleteBucket` API call. This metric can then trigger an alarm that sends an SNS notification, alerting the security team to unauthorized API calls. Option E is correct because Amazon CloudWatch Events (now Amazon EventBridge) can directly match the `DeleteBucket` API call from CloudTrail and trigger an SNS notification without needing a metric filter or alarm.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Amazon VPC Flow Logs to capture API calls and use Amazon Athena to query for DeleteBucket events.
Why it's wrong here
VPC Flow Logs capture network traffic, not API calls.
- ✗
Create an AWS CloudTrail trail that monitors Amazon CloudWatch Logs for DeleteBucket API calls.
Why it's wrong here
CloudTrail does not monitor CloudWatch Logs; it delivers logs to them.
- ✗
Create an AWS Config rule to detect DeleteBucket API calls and send an SNS notification.
Why it's wrong here
AWS Config rules are for resource configuration compliance, not real-time API call alerts.
- ✓
Configure CloudTrail to deliver logs to Amazon CloudWatch Logs and create a metric filter for the DeleteBucket API call.
Why this is correct
CloudTrail can deliver to CloudWatch Logs, and a metric filter can trigger an alarm.
- ✓
Create an Amazon CloudWatch Events rule that matches the DeleteBucket API call and triggers an Amazon SNS notification.
Why this is correct
CloudWatch Events can match specific API calls and trigger SNS notifications.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer needs to monitor AWS account activity for suspicious API calls and receive alerts. Which AWS service should the engineer use to meet this requirement?
easy- A.VPC Flow Logs
- B.AWS Config with AWS Config Rules
- ✓ C.AWS CloudTrail with CloudWatch Alarms
- D.Amazon GuardDuty
Why C: AWS CloudTrail records all API calls made to the AWS environment, providing a detailed audit trail of account activity. By sending these logs to Amazon CloudWatch, you can create metric filters that match suspicious API call patterns and trigger CloudWatch Alarms to send notifications via SNS. This combination directly meets the requirement to monitor and alert on specific API calls.
Variation 2. A company wants to monitor AWS account activity and receive real-time notifications for specific API calls. Which TWO services should the company use together? (Choose TWO.)
easy- A.Amazon CloudWatch Logs
- ✓ B.Amazon CloudWatch Events (Amazon EventBridge)
- C.AWS Config
- D.Amazon Simple Notification Service (SNS)
- ✓ E.AWS CloudTrail
Why B: AWS CloudTrail (Option E) records all API calls made in the account, providing the raw audit log. Amazon CloudWatch Events (now part of Amazon EventBridge) (Option B) can filter these CloudTrail events in real time and trigger notifications. Together, they enable monitoring and alerting for specific API calls without polling.
Variation 3. A security engineer is responsible for monitoring AWS account activity. The engineer needs to receive real-time notifications when specific API calls are made, such as 'DeleteTrail' or 'UpdateTrail'. The engineer wants to use AWS services to achieve this with minimal latency. Which combination of services should the engineer use?
easy- A.CloudTrail -> Amazon EventBridge -> Amazon SNS
- B.CloudTrail -> Amazon S3 -> S3 event notification -> AWS Lambda -> Amazon SNS
- C.CloudTrail -> CloudWatch Logs -> CloudWatch Logs subscription filter -> AWS Lambda -> Amazon SNS
- ✓ D.CloudTrail -> CloudWatch Logs -> CloudWatch metric filter -> CloudWatch alarm -> Amazon SNS
Why D: The correct solution is to send CloudTrail logs to CloudWatch Logs, create a metric filter to match the specific API calls (e.g., 'DeleteTrail', 'UpdateTrail'), and set up a CloudWatch alarm on that metric that publishes to an SNS topic. This provides near-real-time alerts. Option D is correct. Option A is incorrect because while CloudTrail can send events to EventBridge, the event delivery is not as immediate as CloudWatch Logs metric filter approach for this use case. Option B is incorrect because S3 event notifications are for object-level events and not suitable for monitoring CloudTrail API calls. Option C is incorrect because CloudWatch Logs subscription filters are for streaming logs to other destinations, not for directly triggering alarms.
Variation 4. A company wants to detect and alert on unauthorized API calls in their AWS account. Which AWS service can provide real-time notifications when specific API calls are made?
easy- A.AWS Config
- ✓ B.Amazon CloudWatch Events (EventBridge)
- C.Amazon GuardDuty
- D.AWS Trusted Advisor
Why B: Amazon CloudWatch Events (now part of Amazon EventBridge) can capture real-time API calls made to AWS services by using a rule that matches specific API calls via CloudTrail integration. When a matching API call occurs, EventBridge can trigger a target such as an SNS topic or Lambda function to send a notification, enabling immediate alerting on unauthorized API calls.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.