SCS-C02 Security Logging and Monitoring Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a CloudWatch Logs metric filter on the CloudTrail log group for CreateAccessKey events and set an alarm.

  Why it's wrong here

  Using a CloudWatch Logs metric filter requires first configuring CloudTrail to deliver events to CloudWatch Logs, then creating a metric filter that matches the textual representation of the CreateAccessKey event, and finally setting up a CloudWatch alarm on that metric. This approach adds multiple dependent components and incurs ingestion, storage, and metric costs. It also introduces latency because CloudWatch Logs delivery and metric filter processing are asynchronous, so the alarm can be delayed by minutes, making it slower and more operationally heavy than a direct EventBridge rule.

• ✓

  Create an Amazon EventBridge rule that matches the CreateAccessKey event and triggers an Amazon SNS notification.

  Why this is correct

  EventBridge is the least-overhead, near-real-time option because CloudTrail automatically delivers all management events to the default EventBridge bus without extra configuration. A rule with an event pattern that matches eventSource="iam.amazonaws.com" and eventName="CreateAccessKey" triggers an SNS topic immediately when the API call occurs, enabling instantaneous security notifications. This is fully event-driven and serverless: there is no polling, no custom code, no log parsing, and no separate metric filter to maintain, which makes it the architecturally cleanest solution.

• ✗

  Write a Python script that uses the CloudTrail LookupEvents API and run it on a scheduled basis using Amazon EventBridge Scheduler.

  Why it's wrong here

  Polling the CloudTrail LookupEvents API on a scheduled basis introduces significant latency, preventing near real-time alerts for new IAM access key creations. This approach also incurs higher operational overhead due to custom script development and maintenance, which contradicts the requirement for the least overhead. LookupEvents is designed for historical event retrieval and ad-hoc investigations, making it suitable for periodic auditing or data analysis, not for immediate, event-driven security notifications.

• ✗

  Develop a custom AWS Lambda function that queries CloudTrail logs in S3 every hour.

  Why it's wrong here

  Building a Lambda function to query CloudTrail log files in Amazon S3 every hour is a polling pattern with significant delay: CloudTrail delivers log files to S3 in batches, and an hourly scan means discovery of a new access key could be up to 60 minutes late. This approach also requires custom code, IAM permissions for reading S3 objects, handling of log file formats, and state management to avoid re-processing, all of which add operational overhead. It is neither near-real-time nor the least-overhead solution because it replaces a managed event-driven service with a custom, schedule-based batch process.

Go deeper

Related to this question