SOA-C02 Monitoring, Logging, and Remediation Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Configure AWS CloudTrail to deliver logs to Amazon CloudWatch Logs, create a metric filter for the 'CreateUser' API call, and set up a CloudWatch alarm that sends an Amazon SNS notification.

  Why it's wrong here

  CloudTrail can deliver logs to CloudWatch Logs, and a metric filter with an alarm on the `CreateUser` event can trigger an SNS notification, but this setup does not log the event to a central CloudWatch Logs log group as required—it only sends an alarm notification. The stem demands both notification and central logging; a metric filter alone does not write the event payload into a log group. This option is tempting because it is the standard pattern for real-time alerting on specific API calls, and it would be correct if only notification were needed without centralised log storage.

• ✓

  Use AWS CloudTrail with Amazon EventBridge by creating an event rule that matches the 'CreateUser' API call via the 'aws.cloudtrail' event source, and set the targets to an Amazon SNS topic and a CloudWatch Logs log group.

  Why this is correct

  Amazon EventBridge natively listens for AWS service events, including CloudTrail API calls. By creating a rule with a custom event pattern that matches the specific API call, you can directly send the event to multiple targets (SNS, CloudWatch Logs, Lambda, etc.) without needing metric filters or alarms. This is the recommended low-overhead solution.

• ✗

  Write an AWS Lambda function that is triggered by Amazon S3 events when a new CloudTrail log is delivered to S3. The Lambda parses the log file for 'CreateUser' and if found, sends an SNS notification.

  Why it's wrong here

  This approach fails because CloudTrail log file delivery to S3 typically incurs a delay of several minutes, sometimes up to 15 minutes, which does not meet the requirement for notifications 'within a few minutes'. Furthermore, it necessitates custom parsing code within Lambda to extract the specific API call. This pattern is suitable for less time-sensitive, batch processing of CloudTrail logs, such as for periodic security analysis, compliance checks, or data warehousing, where immediate notification is not a primary concern.

• ✗

  Enable AWS Config and create a custom rule that evaluates CloudTrail trail configurations for events.

  Why it's wrong here

  AWS Config is designed to evaluate the configuration state of AWS resources over time against desired policies; it does not ingest or process CloudTrail event history in real time. A custom Config rule could check whether a trail is configured correctly, but it cannot react to an individual API call like CreateUser as it occurs, because Config rules trigger on configuration changes or scheduled evaluations, not on API events. Even if you attempted to use a Config rule to query CloudTrail logs, the retrieval would be asynchronous and nowhere near the near-real-time notification that EventBridge provides.

Go deeper

Related to this question