Courseiva
← SOA-C02
Full test
Question 831 of 1,546
Monitoring, Logging, and Remediation →mediumMultiple ChoiceObjective-mapped

Quick Answer

The correct combination is AWS CloudTrail with Amazon EventBridge, using an event rule that matches the 'CreateUser' API call via the 'aws.cloudtrail' event source, and setting targets to an Amazon SNS topic and a CloudWatch Logs log group. This works because EventBridge natively consumes CloudTrail events in near-real time, allowing you to filter for specific API actions like 'CreateUser' without any custom code. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this scenario tests your understanding of how to achieve real-time CloudTrail event notification for security monitoring, often appearing as a trap where candidates mistakenly choose AWS Lambda or custom polling solutions. The key insight is that EventBridge directly integrates with CloudTrail for event-driven workflows, making it the minimal-code choice for both alerting via SNS and centralized logging to CloudWatch Logs. Memory tip: think "EventBridge eats CloudTrail events raw" — no Lambda needed when you need fast, code-free notification and logging.

SOA-C02 Monitoring, Logging, and Remediation Practice Question

This SOA-C02 practice question tests your understanding of monitoring, logging, and remediation. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A SysOps administrator needs to monitor AWS CloudTrail logs for any calls to the 'CreateUser' API in AWS Identity and Access Management (IAM). When such an API call is detected, the administrator wants to receive a notification within a few minutes and also log the event to a central log group in Amazon CloudWatch Logs. The solution should use minimal custom code. Which combination of services should be used?

Question 1mediummultiple choice
Read the full NAT/PAT explanation →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use AWS CloudTrail with Amazon EventBridge by creating an event rule that matches the 'CreateUser' API call via the 'aws.cloudtrail' event source, and set the targets to an Amazon SNS topic and a CloudWatch Logs log group.

Option B is correct because Amazon EventBridge can directly consume CloudTrail events in near-real time via the 'aws.cloudtrail' event source, allowing you to create a rule that matches the 'CreateUser' API call. This rule can then target both an Amazon SNS topic for immediate notification and a CloudWatch Logs log group for centralized logging, all without custom code.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Configure AWS CloudTrail to deliver logs to Amazon CloudWatch Logs, create a metric filter for the 'CreateUser' API call, and set up a CloudWatch alarm that sends an Amazon SNS notification.

    Why it's wrong here

    This method works, but it requires manual creation of a metric filter and alarm. It also ingests all CloudTrail logs into CloudWatch Logs, which can increase costs. A more efficient approach is to use Amazon EventBridge.

  • ✓

    Use AWS CloudTrail with Amazon EventBridge by creating an event rule that matches the 'CreateUser' API call via the 'aws.cloudtrail' event source, and set the targets to an Amazon SNS topic and a CloudWatch Logs log group.

    Why this is correct

    Amazon EventBridge natively listens for AWS service events, including CloudTrail API calls. By creating a rule with a custom event pattern that matches the specific API call, you can directly send the event to multiple targets (SNS, CloudWatch Logs, Lambda, etc.) without needing metric filters or alarms. This is the recommended low-overhead solution.

    Related concept

    Read the scenario before looking for a memorised answer.

  • ✗

    Write an AWS Lambda function that is triggered by Amazon S3 events when a new CloudTrail log is delivered to S3. The Lambda parses the log file for 'CreateUser' and if found, sends an SNS notification.

    Why it's wrong here

    This approach involves custom code (Lambda) and is more complex. It also relies on periodic log delivery to S3, which may introduce delays. It is not the least overhead option.

  • ✗

    Enable AWS Config and create a custom rule that evaluates CloudTrail trail configurations for events.

    Why it's wrong here

    AWS Config is for evaluating configuration of AWS resources, not for real-time monitoring of API calls. It cannot directly detect specific API calls like 'CreateUser'.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates often assume CloudTrail-to-CloudWatch Logs delivery is the fastest method, but they overlook the inherent delivery latency and the fact that EventBridge provides a more immediate, event-driven path for real-time monitoring.

Detailed technical explanation

How to think about this question

EventBridge uses an event-driven architecture where CloudTrail publishes events to the default event bus in near-real time (typically within 5 minutes). The rule matches on the 'eventName' field in the CloudTrail event JSON, and you can configure multiple targets, including SNS and CloudWatch Logs, using the same rule. This approach avoids the latency of S3 log delivery and the overhead of custom parsing code.

KKey Concepts to Remember

  • Read the scenario before looking for a memorised answer.
  • Find the constraint that changes the correct option.
  • Eliminate answers that are true in general but not in this case.

TExam Day Tips

  • Watch for words such as best, first, most likely and least administrative effort.
  • Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related practice questions

Related SOA-C02 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Monitoring, Logging, and Remediation practice questions

Practise SOA-C02 questions linked to Monitoring, Logging, and Remediation.

Reliability and Business Continuity practice questions

Practise SOA-C02 questions linked to Reliability and Business Continuity.

Deployment, Provisioning, and Automation practice questions

Practise SOA-C02 questions linked to Deployment, Provisioning, and Automation.

Security and Compliance practice questions

Practise SOA-C02 questions linked to Security and Compliance.

Networking and Content Delivery practice questions

Practise SOA-C02 questions linked to Networking and Content Delivery.

Cost and Performance Optimization practice questions

Practise SOA-C02 questions linked to Cost and Performance Optimization.

SOA-C02 fundamentals practice questions

Practise SOA-C02 questions linked to SOA-C02 fundamentals.

SOA-C02 scenario practice questions

Practise SOA-C02 questions linked to SOA-C02 scenario.

SOA-C02 troubleshooting practice questions

Practise SOA-C02 questions linked to SOA-C02 troubleshooting.

Practice this exam

Start a free SOA-C02 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions20 questions30 questions50 questionsTimed 30
SOA-C02 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this SOA-C02 question test?

Monitoring, Logging, and Remediation — This question tests Monitoring, Logging, and Remediation — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Use AWS CloudTrail with Amazon EventBridge by creating an event rule that matches the 'CreateUser' API call via the 'aws.cloudtrail' event source, and set the targets to an Amazon SNS topic and a CloudWatch Logs log group. — Option B is correct because Amazon EventBridge can directly consume CloudTrail events in near-real time via the 'aws.cloudtrail' event source, allowing you to create a rule that matches the 'CreateUser' API call. This rule can then target both an Amazon SNS topic for immediate notification and a CloudWatch Logs log group for centralized logging, all without custom code.

What should I do if I get this SOA-C02 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

More SOA-C02 practice questions

Browse all SOA-C02 questions →

Last reviewed: Jun 11, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

Sign in to join the discussion.

This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.