SOA-C02 Monitoring, Logging, and Remediation Practice Question
A company wants to receive a real-time notification whenever an IAM user creates a new access key. Which combination of AWS services should be used to achieve this?
⚠ Common exam trap
A common mix-up: candidates confuse AWS Config (which tracks resource state changes) with CloudTrail (which tracks API calls), leading them to pick Option D, but Config does not provide real-time, event-driven notifications for individual API actions like CreateAccessKey.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail and Amazon EventBridge
AWS CloudTrail captures IAM API calls, including CreateAccessKey, as management events. Amazon EventBridge can be configured with a rule that matches this specific API call pattern and triggers a real-time notification (e.g., via SNS or Lambda). This combination provides the exact event-driven monitoring required without polling or custom code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon GuardDuty and Amazon SQS
Why it's wrong here
Amazon GuardDuty is a threat detection service that analyzes CloudTrail logs, VPC Flow Logs, and DNS logs to identify malicious or unauthorized activity. It does not emit a real-time feed of every API call; instead, it generates findings only when suspicious behavior is detected. SQS is a message queue service that waits for consumers to poll messages, so it cannot push notifications in real time without an additional trigger, and GuardDuty integrates primarily with SNS and EventBridge for alerting, not direct SQS delivery. Therefore, this combination monitors security threats, not API call activity.
- ✓
AWS CloudTrail and Amazon EventBridge
Why this is correct
AWS CloudTrail records API activity in your account and delivers management events to Amazon EventBridge in near real time, typically within seconds. EventBridge rules can filter these events using event patterns—for example, matching on event source, event name, or user identity—and route them to targets like SNS to send notifications, or Lambda to trigger custom actions. This combination is purpose-built for real-time API call monitoring and notification, making it the correct choice. The event payload includes the identity of the caller, the request parameters, and the response, giving full visibility into the API call.
- ✗
Amazon CloudWatch Logs and AWS Lambda
Why it's wrong here
Amazon CloudWatch Logs can ingest CloudTrail logs, but it is not designed for real-time, per-event API call notification. Metric filters aggregate log data into metrics, and CloudWatch Alarms only fire when a threshold is crossed over a period, adding latency and losing event-level detail. While a Lambda function could subscribe to a CloudWatch Logs log group and process each log event, you would need to configure CloudTrail to deliver logs to a log group first, and the end-to-end path has higher latency and operational overhead than directly using EventBridge. The result is a batch-oriented, metric-focused pipeline that fails to provide immediate, event-specific notifications for every API call.
- ✗
AWS Config and Amazon SNS
Why it's wrong here
AWS Config tracks resource configurations and records configuration changes, such as when a resource is created, modified, or deleted, but it does not record the API calls that caused those changes. Config can send delivery notifications to Amazon SNS via its delivery channel, but these notifications are about configuration item changes or compliance evaluations, not about the API caller or the exact API event. For example, Config might tell you that an EC2 instance changed, but it will not tell you which principal called RunInstances or what parameters were used. Therefore, it is unsuitable for monitoring API calls in real time.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 1,169 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SOA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to receive real-time notifications when specific API calls are made in their AWS account. Which TWO services can be used together to achieve this? (Choose TWO.)
medium- ✓ A.AWS CloudTrail
- B.AWS Config
- C.AWS Lambda
- D.Amazon CloudWatch Logs
- ✓ E.Amazon CloudWatch Events
Why A: AWS CloudTrail captures API calls and can send events directly to Amazon CloudWatch Events (now Amazon EventBridge). CloudWatch Events rules can match specific API call patterns and trigger real-time notifications via targets like SNS or Lambda. No CloudWatch Logs involvement is required for this integration, so the solution uses exactly two services: CloudTrail and CloudWatch Events.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.