SCS-C02 Threat Detection and Incident Response Practice Question

A company is using AWS WAF to protect a web application. The security team wants to receive alerts when a specific rule block is triggered. Which AWS service should they use to achieve this?

⚠ Common exam trap

It's easy for candidates to confuse the notification mechanism (SNS) with the evaluation mechanism (CloudWatch Alarms), selecting SNS alone without recognizing that CloudWatch Alarms are required to evaluate the WAF metric and trigger the notification.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

CloudWatch Alarms with SNS

AWS WAF integrates with Amazon CloudWatch to provide metrics for each rule, including the 'BlockedRequests' count. By creating a CloudWatch Alarm on this metric, you can trigger an SNS notification when the threshold is exceeded, alerting the security team. This is the standard pattern for receiving alerts on WAF rule actions, as CloudWatch Alarms with SNS provide the necessary monitoring and notification pipeline.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Amazon EventBridge
Why it's wrong here
Amazon EventBridge processes events from AWS services and custom applications, making it tempting as a general event router. However, it does not directly provide the alerting mechanism for AWS WAF rule block triggers. WAF rule blocks generate logs and metrics, which CloudWatch Alarms are specifically designed to monitor and action for alerting. EventBridge would be the correct choice if the requirement was to react to WAF resource configuration changes or to route events for further processing in an event-driven architecture, rather than for direct metric-based alerting.
✓
CloudWatch Alarms with SNS
Why this is correct
AWS WAF publishes real-time CloudWatch metrics such as BlockedCount and CountedCount for each web ACL and rule. A CloudWatch Alarm can monitor these metrics and transition to the ALARM state when a threshold (e.g., blocked requests exceed 100 per minute) is breached, then automatically publish to an SNS topic to send email or SMS notifications. This is the native, direct alerting mechanism for WAF rule events because it uses the service's own metric stream.
✗
Amazon S3
Why it's wrong here
Amazon S3 is an object storage service, not a notification or alerting service. While AWS WAF can be configured to deliver access logs to an S3 bucket for later analysis, S3 itself does not actively monitor WAF metrics or push out alerts when a rule blocks traffic. Any notification would require additional services like S3 Event Notifications with Lambda or EventBridge, making it an indirect and non-real-time solution for immediate alerting on WAF rule blocks.
✗
Amazon SNS
Why it's wrong here
Amazon SNS is a fully managed pub/sub messaging service that only delivers messages after a producer publishes to a topic. An SNS topic alone cannot monitor AWS WAF metrics or trigger alerts because it has no inherent ability to observe blocked traffic or evaluate thresholds. To send WAF block alerts via SNS, you must first configure a CloudWatch Alarm (or another event source) to act as the publisher, so SNS is just the transport layer, not the alerting mechanism.

Go deeper

SCS-C02 Threat Detection and Incident Response Practice Question

Why each option matters

Option-by-option breakdown

Related to this question