SOA-C02 Monitoring, Logging, and Remediation Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  CloudTrail + Amazon S3 + Amazon SNS

  Why it's wrong here

  While you can configure CloudTrail to deliver logs to S3 and then use S3 event notifications to trigger SNS, this is an indirect, batch-oriented mechanism. S3 event notifications are typically delivered within seconds, but they rely on object writes, and you must separately set up the event notification on the bucket. This approach introduces extra components, potential permissions, and doesn't natively filter on API action types, making it less precise and more latent than a native event-driven service like EventBridge.

• ✗

  CloudTrail + Amazon CloudWatch Logs + Amazon SNS

  Why it's wrong here

  You can send CloudTrail logs to CloudWatch Logs and create a metric filter to count specific events, then set an alarm on that metric to trigger SNS. This works but requires more steps than using EventBridge.

• ✗

  CloudTrail + AWS Config + Amazon SNS

  Why it's wrong here

  AWS Config records configuration changes of resources, not every API call. It evaluates resources against desired policies and can trigger SNS when a resource becomes non-compliant, but it does not capture the full CloudTrail API activity stream. Thus, it cannot alert on specific API actions in real time; its scope is config drift, not audit trail events. You would need to set up Config rules and rely on its evaluation cycle, which is fundamentally different from direct event-driven processing of CloudTrail.

• ✓

  CloudTrail + Amazon EventBridge + Amazon SNS

  Why this is correct

  CloudTrail continuously delivers management events to EventBridge (formerly CloudWatch Events) as the default event bus. You can create an EventBridge rule with an event pattern that matches a specific API call, such as s3.amazonaws.com: DeleteBucket or an IAM action, and set an SNS topic as the target for immediate notification. This is the most direct, low-latency, and fully managed approach; no extra storage or external monitoring is needed. Because EventBridge natively ingests CloudTrail events, you get built-in filtering and fan-out, which is ideal for real-time alerting.

Go deeper

Related to this question