SOA-C02 Security and Compliance Practice Question
A company uses AWS Config to track resource changes. The security team wants to receive notifications whenever an IAM policy is changed. Which AWS service should be used with AWS Config to send notifications?
⚠ Common exam trap
A common mix-up: candidates confuse AWS Config's notification mechanism with CloudTrail's logging, assuming CloudTrail can send alerts directly, when in fact CloudTrail only records events and requires integration with other services like CloudWatch Alarms or SNS for notifications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon Simple Notification Service (SNS)
Amazon Simple Notification Service (SNS) is the correct service to pair with AWS Config to send notifications when an IAM policy changes. AWS Config can publish configuration change events to an SNS topic, which then delivers notifications via email, SMS, or other protocols to the security team. This integration allows real-time alerting on resource changes without additional polling or custom logic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon CloudWatch Logs
Why it's wrong here
Amazon CloudWatch Logs is designed to ingest, store, and monitor log files from applications and AWS services, with metric filters to alarm on patterns. AWS Config does not natively publish its configuration change notifications or compliance evaluations directly to CloudWatch Logs; instead, its delivery channel is an S3 bucket or an SNS topic. While you could theoretically create a subscription filter to route logs, that is not a direct integration and would require additional infrastructure, so CloudWatch Logs is not the correct notification service.
- ✗
Amazon Simple Queue Service (SQS)
Why it's wrong here
Amazon Simple Queue Service (SQS) is a fully managed message queue that enables asynchronous decoupling between components, where consumers poll for messages. AWS Config does not have a native push destination to SQS; its notification mechanism is Amazon SNS, which can then have an SQS queue as a subscriber if downstream processing is needed. Choosing SQS as the direct target misinterprets the architectural flow—Config publishes to a topic, not to a queue.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail captures and records user activity and API calls made by IAM users and AWS services, producing auditable event history. Conversely, AWS Config focuses on recording resource configuration state changes and evaluating those changes against rules. Although both integrate with S3 and SNS, Config does not use CloudTrail to distribute its notifications; those are generated independently from Config's own configuration recorder and sent via its SNS delivery channel. Thus CloudTrail is a separate audit mechanism, not a notification service for Config.
- ✓
Amazon Simple Notification Service (SNS)
Why this is correct
Amazon Simple Notification Service (SNS) is the correct answer because AWS Config natively publishes configuration item change notifications, rule compliance change notifications, and other alerts to an SNS topic. This pub/sub model allows real-time fan-out to email, SMS, Lambda, or SQS consumers. You configure an SNS topic as the delivery channel for your Config recorder, and Config sends JSON messages to that topic whenever a resource changes or a rule evaluation changes.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 1,169 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.