DOP-C02 · Question #471
A company uses AWS Organizations with CloudTrail trusted access. All events across accounts and Regions must be logged and retained in an audit account, and failed login attempts should trigger…
The correct answer is A. Publish CloudTrail logs to S3 in the audit account. Create an EventBridge rule for failed login. Using an organization trail with logs centralized in the audit account's S3 bucket ensures compliance and isolation. An EventBridge rule in the audit account triggers on failed login events (ConsoleLogin failed) and sends SNS notifications in near real time.
Question
A company uses AWS Organizations with CloudTrail trusted access. All events across accounts and Regions must be logged and retained in an audit account, and failed login attempts should trigger real-time notifications. Which solution meets these requirements?
Options
- APublish CloudTrail logs to S3 in the audit account. Create an EventBridge rule for failed login
- BStore logs in the management account and query using Athena + Lambda every 5 minutes.
- CStore logs in audit S3 + CloudWatch log group in management account + metric filter for failed
- DStream to Kinesis -> Flink -> SNS.
How the community answered
(30 responses)- A73% (22)
- B13% (4)
- C10% (3)
- D3% (1)
Explanation
Using an organization trail with logs centralized in the audit account's S3 bucket ensures compliance and isolation. An EventBridge rule in the audit account triggers on failed login events (ConsoleLogin failed) and sends SNS notifications in near real time.
Topics
Community Discussion
No community discussion yet for this question.