A company detects unusual login attempts in many of its AWS accounts. A DevOps engineer must implement a solution that sends a notification to the company's security team when multiple failed login at

Question

Options

• AConfigure AWS CloudTrail to send management events to an Amazon CloudWatch Logs log
• BConfigure AWS CloudTrail to send management events to an Amazon S3 bucket. Create an
• CConfigure AWS CloudTrail to send data events to an Amazon CloudWatch Logs log group.
• DConfigure AWS CloudTrail to send data events to an Amazon S3 bucket. Configure an Amazon

• A
  70% (26)
• B
  5% (2)
• C
  16% (6)
• D
  8% (3)

Explanation

AWS CloudTrail management events include login attempts like ConsoleLogin. By sending these events to Amazon CloudWatch Logs, you can track and analyze these logs in real-time, which is ideal for detecting failed login attempts. A CloudWatch Logs metric filter can be configured to detect specific patterns (such as failed ConsoleLogin events) in the logs. This provides an efficient and automated way to detect multiple failed login attempts. Once the metric filter is in place, you can create a CloudWatch alarm that triggers when the number of failed login attempts exceeds a predefined threshold. This alarm can automatically notify the security team by sending a message to the SNS topic. This solution is efficient because it: - Uses existing services like CloudTrail and CloudWatch, which are designed for monitoring and - Provides real-time detection and notification with minimal configuration. - Requires no custom code or manual intervention after setup. It provides the best balance of simplicity, real-time monitoring, and minimal operational effort for detecting and notifying about failed login attempts.

No community discussion yet for this question.