SOA-C02 Monitoring, Logging, and Remediation Practice Question
A company wants to receive real-time notifications when specific API calls are made in their AWS account. Which TWO services can be used together to achieve this? (Choose TWO.)
⚠ Common exam trap
The trap here is that candidates often pick AWS Lambda alone, thinking it can directly monitor API calls, but Lambda requires a triggering event source such as CloudWatch Events or S3, not raw CloudTrail logs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail captures API calls and can send events directly to Amazon CloudWatch Events (now Amazon EventBridge). CloudWatch Events rules can match specific API call patterns and trigger real-time notifications via targets like SNS or Lambda. No CloudWatch Logs involvement is required for this integration, so the solution uses exactly two services: CloudTrail and CloudWatch Events.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail records API calls and delivers log files to an S3 bucket or CloudWatch Logs, but it does not send proactive notifications in real time. It is the authoritative source for who made which API calls, yet it requires a separate consumer—such as EventBridge, CloudWatch Logs, or a custom script—to parse those logs and trigger alerts. Thus CloudTrail provides the data for auditing but lacks the built-in event-matching and routing capabilities needed for immediate notification.
- ✗
AWS Config
Why it's wrong here
AWS Config evaluates resource configurations and tracks configuration changes against desired policies, but it is not designed to monitor real-time API call streams. Config rules run periodically or on configuration changes, and they focus on compliance and drift detection, not on matching specific API actions like the ones described. It does not natively integrate with CloudTrail events for high-frequency event filtering, so it would be an indirect and slow mechanism for real-time notifications.
- ✗
AWS Lambda
Why it's wrong here
AWS Lambda is a compute service that runs code in response to triggers, but it does not natively listen for AWS API activity. To receive real-time notifications, Lambda must be invoked by an event source such as Amazon EventBridge (CloudWatch Events) or a message broker; without that, Lambda would require custom polling or integration with another service to detect the event. Therefore it is an intermediary that can act on events, not the service that identifies and routes them.
- ✗
Amazon CloudWatch Logs
Why it's wrong here
Amazon CloudWatch Logs is a service for storing, monitoring, and accessing log data, not for evaluating live API events. Although you can create metric filters or subscription filters on log streams, these operate on data that has already been written to the log group, which introduces latency and does not natively match the full CloudTrail event structure in real time. Its primary role is post-hoc analysis and archival, not proactive event-driven notification.
- ✓
Amazon CloudWatch Events
Why this is correct
Amazon CloudWatch Events (now called Amazon EventBridge) is the correct choice because it provides a real-time event bus that can match patterns against AWS service events, including CloudTrail API activity. You can define a rule with an event pattern that filters for specific API calls, then route matching events to targets such as SNS, Lambda, or SQS to send notifications. This service is purpose-built for event-driven architectures and directly integrates with CloudTrail, enabling low-latency, reliable responses to API activity.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 1,169 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SOA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to receive a real-time notification whenever an IAM user creates a new access key. Which combination of AWS services should be used to achieve this?
easy- A.Amazon GuardDuty and Amazon SQS
- ✓ B.AWS CloudTrail and Amazon EventBridge
- C.Amazon CloudWatch Logs and AWS Lambda
- D.AWS Config and Amazon SNS
Why B: AWS CloudTrail captures IAM API calls, including CreateAccessKey, as management events. Amazon EventBridge can be configured with a rule that matches this specific API call pattern and triggers a real-time notification (e.g., via SNS or Lambda). This combination provides the exact event-driven monitoring required without polling or custom code.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.