SOA-C02 Security and Compliance Practice Question
A company uses AWS CloudTrail to log API activity. The security team needs to be alerted when an IAM user creates a new access key. Which combination of services should the SysOps administrator use to meet this requirement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A CloudWatch Events rule that matches the CreateAccessKey API call and sends an SNS notification
CloudWatch Events (now Amazon EventBridge) can match CloudTrail events (like CreateAccessKey) and trigger an SNS notification. Option A is wrong because CloudWatch Logs Insights is a query tool for analyzing logs, not a real-time alerting mechanism; although metric filters and alarms can be set up, CloudWatch Events provides a more direct solution. Option B is wrong because AWS Config rules evaluate resource configurations and compliance, not real-time API calls. Option D is wrong because S3 event notifications trigger on object-level events in S3 buckets, not on specific API calls within CloudTrail logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
CloudWatch Logs Insights query on CloudTrail logs with an alarm
Why it's wrong here
CloudWatch Logs Insights is an interactive query engine for analyzing log data already stored in CloudWatch Logs; it is not a real-time monitoring or alerting service. While you could use a metric filter on the CloudTrail log group to trigger an alarm, that is a separate mechanism from Logs Insights itself, which only supports on-demand `fields`/`filter`/`stats` queries and cannot generate SNS notifications.
- ✗
An AWS Config rule that checks for new access keys and sends an SNS notification
Why it's wrong here
AWS Config evaluates the recorded configuration state of resources against rules, and access keys are IAM resources whose age and status can be checked. A Config rule can emit an SNS notification when a noncompliant access key is detected, but it does so after configuration changes are recorded and evaluated, not in real time, and it cannot directly capture the CreateAccessKey API call event. It also relies on the IAM access key resource type rather than processing CloudTrail API activity, so it is the wrong tool for event-driven alerting on a specific API call.
- ✓
A CloudWatch Events rule that matches the CreateAccessKey API call and sends an SNS notification
Why this is correct
Amazon EventBridge (formerly CloudWatch Events) can consume CloudTrail events as a built-in event source, so a rule with an event pattern tailored to `AWS API Call via CloudTrail` and `eventName` `CreateAccessKey` fires whenever that API is invoked. The rule can target an SNS topic as the action, delivering a near-real-time notification that includes the full event detail such as the IAM user, source IP, and user agent. This is the direct, native mechanism for alerting on specific API calls.
- ✗
S3 event notifications to an SNS topic
Why it's wrong here
S3 event notifications are scoped to object lifecycle activities within a bucket, such as `s3:ObjectCreated:*` or `s3:ObjectRemoved:*`, and have no awareness of CloudTrail API call records. If CloudTrail delivers log files to S3, an S3 event would only notify you that a log file landed, not which API calls were made, and the notification payload lacks per-call details. S3 events also cannot filter content inside the delivered object, making them unsuitable for detecting a CreateAccessKey event.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.