SOA-C02 Monitoring, Logging, and Remediation Practice Question
A SysOps administrator needs to receive an email notification when an IAM user's console login fails. Which AWS service should be used to set up this notification?
⚠ Common exam trap
The trap here is that candidates often pick Amazon SNS directly, forgetting that SNS is a notification channel, not a monitoring service, and requires CloudWatch to detect the failure event first.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon CloudWatch
Amazon CloudWatch can monitor AWS CloudTrail log events for IAM console login failures by creating a metric filter on the CloudTrail log group for the `ConsoleLogin` event with a `failure` status. When the filter matches, CloudWatch can trigger an alarm that sends an email notification via Amazon SNS. This is the correct service because CloudWatch is designed for monitoring and alerting on operational metrics and log patterns.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Amazon CloudWatch
Why this is correct
CloudWatch can create a metric filter on a CloudTrail log group to count failed login events, set an alarm on that metric, and publish to SNS for email notification. CloudWatch is the core monitoring and alerting service.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail is an API auditing service that records all management-plane actions, including failed ConsoleLogin events, as event history. However, CloudTrail itself is purely a telemetry and compliance log; it has no native mechanism to evaluate thresholds, trigger alarms, or deliver email. To generate notifications, you must explicitly configure a CloudTrail trail to stream events into Amazon CloudWatch Logs, then create a metric filter and a CloudWatch alarm that publishes to SNS, which means CloudTrail alone does not satisfy the email notification requirement.
- ✗
Amazon Simple Notification Service (SNS)
Why it's wrong here
Amazon Simple Notification Service (SNS) is the messaging and delivery layer that can send emails via topic subscriptions, but it is a passive transport service with no awareness of login failures. SNS cannot independently detect, evaluate, or filter system events; it only distributes messages that are pushed to it by publishers such as CloudWatch alarms, EventBridge rules, or other services. Selecting SNS as the answer ignores the need for a monitoring agent that first detects the failed login condition and then initiates the notification, so SNS is only one component of the solution, not the enabling service.
- ✗
AWS Config
Why it's wrong here
AWS Config is a service for assessing resource configuration compliance against managed or custom rules, such as checking whether an S3 bucket is encrypted or whether a security group allows unrestricted access. It does not process AWS CloudTrail logs, nor does it have visibility into IAM user login events or authentication failures — those are found in CloudTrail event history, not resource configuration snapshots. AWS Config can trigger notifications on configuration changes and compliance state transitions, but it lacks the metric-based, threshold-aware evaluation needed to detect repeated failed login attempts, making it an incorrect tool for this operational alerting scenario.
Go deeper
Related to this question
About these practice questions
This SOA-C02 question is part of Courseiva's 1,169-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.