CND Practice Question: Enterprise Cloud Virtual And Wireless Network Protection
An enterprise IT security team wants to monitor AWS API calls and receive alerts whenever an unauthorized user attempts to modify critical IAM policies or security group rules. Which combination of AWS services should be configured?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail combined with Amazon EventBridge and SNS alerts
AWS CloudTrail logs API calls, and Amazon EventBridge (formerly CloudWatch Events) detects specific events to trigger AWS SNS alerts or Lambda remediation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Direct Connect combined with VPC Flow Logs
Why it's wrong here
VPC Flow Logs track IP traffic, not IAM API management events.
- ✗
AWS Config rules combined with Amazon Inspector
Why it's wrong here
Config assesses configuration compliance and Inspector scans host vulnerabilities, not real-time API monitoring.
- ✗
AWS WAF combined with Amazon Route 53 DNS logging
Why it's wrong here
WAF and Route 53 protect web apps and DNS, not AWS IAM API audit logging.
- ✓
AWS CloudTrail combined with Amazon EventBridge and SNS alerts
Why this is correct
CloudTrail captures API activity, EventBridge detects pattern matches, and SNS sends security alerts.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
About these practice questions
This CND question is part of Courseiva's 323-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.