SOA-C02 Monitoring, Logging, and Remediation Practice Question
A company wants to receive a notification when the root account is used to perform any action in the AWS account. Which service should be used to monitor this?
⚠ Common exam trap
Many exam-takers confuse AWS Config (which audits resource configurations) with CloudTrail (which audits API activity), or they think CloudWatch Logs alone can trigger alerts without CloudWatch Events, missing the requirement for event-driven notification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail with Amazon CloudWatch Events
AWS CloudTrail logs all API activity in the account, including root user actions. By creating a CloudTrail trail and sending those logs to Amazon CloudWatch Events (now part of Amazon EventBridge), you can define a rule that matches the `RootAccess` event or any API call where `userIdentity.type` is `Root` and trigger a notification via SNS or Lambda. This combination provides real-time monitoring and alerting for root account usage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config
Why it's wrong here
AWS Config is a configuration tracking service that records resource state changes and evaluates them against compliance rules; it does not capture API calls or user authentication events. While it can react to certain resource modifications, root account sign-ins or root API usage are not configuration changes that Config is designed to detect. Therefore, AWS Config cannot trigger a notification specifically when the root account is used.
- ✗
Amazon CloudWatch Logs
Why it's wrong here
Amazon CloudWatch Logs provides a centralized location for storing, monitoring, and querying log files, but it is a destination and analysis tool, not a source of AWS API activity. Without a separate service like AWS CloudTrail configured to deliver its audit logs to CloudWatch Logs, there is no mechanism to capture root account sign-in events. Even with logs present, you would still need a CloudWatch Events rule to evaluate those logs and send a notification, so CloudWatch Logs alone is insufficient.
- ✓
AWS CloudTrail with Amazon CloudWatch Events
Why this is correct
AWS CloudTrail records every API call made on the account, including root user sign-ins and root-access-key usage, and these are delivered as event history. Amazon CloudWatch Events (now Amazon EventBridge) can monitor CloudTrail events in real time and use a rule to match a pattern such as a ConsoleLogin event with a root user identity. When matched, the rule can invoke an SNS topic to send the desired notification, making this the correct combination for real-time root activity alerts.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor performs periodic checks and provides recommendations across cost optimization, performance, security, and fault tolerance; its security checks include root account MFA and the presence of root access keys. However, these are static assessments that flag configuration drifts, not live monitoring of API activity. Trusted Advisor cannot detect or notify in real time when someone signs in as root or uses root credentials, so it fails to meet the notification requirement.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 1,169 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.