SOA-C02 Monitoring, Logging, and Remediation Practice Question
A SysOps administrator wants to be alerted when the root user of the AWS account signs in. Which TWO services can be used together to achieve this?
⚠ Common exam trap
The trap here is that candidates often pick AWS Config or Trusted Advisor because they associate them with security monitoring, but neither service captures API call events like root sign-ins, which require CloudTrail and EventBridge for event-driven alerting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail logs all API calls, including root user sign-ins, as `RootLogin` events in the management events trail. Option D is correct because Amazon CloudWatch Events (now part of Amazon EventBridge) can be configured with a rule that matches these CloudTrail log events and triggers a notification action, such as sending an SNS alert, when the root user signs in.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Lambda
Why it's wrong here
AWS Lambda is a serverless compute service that runs code in response to events, but it has no native ability to audit or capture console sign-in activity. The event data that shows a root login must first exist in a service such as CloudTrail, and Lambda would be a downstream target for a rule to invoke — not the source that identifies the root user.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail records the ConsoleLogin event as a management event, including the userIdentity type of Root, the source IP, and the login result. A trail configured across all regions delivers these log files to Amazon S3, and the event can also be processed in near real-time by EventBridge, making CloudTrail the authoritative data source for detecting root use. This is why monitoring root login activity fundamentally requires CloudTrail.
- ✗
AWS Config
Why it's wrong here
AWS Config is designed to track configuration changes and compliance of AWS resources, such as security group rules or S3 bucket policies, not ephemeral authentication actions. A root user console login is an IAM sign-in event that leaves no persistent configuration artifact, so Config records no data about it and cannot be used to trigger the alert.
- ✓
Amazon CloudWatch Events (Amazon EventBridge)
Why this is correct
Amazon CloudWatch Events, now called Amazon EventBridge, is a rule engine that can match events from the CloudTrail stream, such as a ConsoleLogin event whose userIdentity type is Root, and route them to targets like an SNS topic for email alerts. It does not store or generate the login event itself; its value is in the near-real-time filtering and forwarding that completes the alerting pipeline. The rule's event pattern identifies the root ARN, and the target invokes SNS to notify the administrator.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor provides best-practice recommendations based on static inspections of your account, like checking for unused security groups, IAM access keys rotation, or MFA on the root account. It does not ingest transient sign-in events, so it has no visibility into when a root login actually occurs and therefore cannot produce a real-time alert for this scenario.
Go deeper
Related to this question
About these practice questions
This SOA-C02 question is part of Courseiva's 1,169-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.