A company runs an order management application on AWS. The application allows customers to place orders and pay with a credit card. The company uses an Amazon CloudFront distribution to deliver the…

Question

Options

• AEventBridge rule: Triggers an event whenever there is a change in CloudFront distribution,
• BALB with WAF: Focuses on application-level security, not CloudFront logging.
• CLambda + SNS: Provides notifications upon detection of changes in logging configuration.
• DGuardDuty: Monitors anomalies but does not specifically address CloudFront logging changes.
• EPrivate API + WAF: Irrelevant to CloudFront logging changes.

• A
  86% (25)
• B
  3% (1)
• D
  7% (2)
• E
  3% (1)

Explanation

A (EventBridge rule) is correct because EventBridge can capture AWS API calls - including changes to CloudFront distribution settings like logging - and trigger automated responses when those changes occur. C (Lambda + SNS) is correct because it forms the notification layer: Lambda processes the EventBridge event and SNS delivers the alert to the security team, completing the detection-to-alert pipeline.

B (ALB + WAF) is wrong because WAF protects against web-layer attacks on traffic, not configuration change events. D (GuardDuty) is wrong because GuardDuty performs threat intelligence and anomaly detection on behavior, not configuration drift on specific services like CloudFront. E (Private API + WAF) is entirely unrelated to monitoring logging configuration changes.

Memory tip: Think of it as a two-stage pipeline - you need a detector (EventBridge watches for the config change via CloudTrail API events) and a notifier (Lambda + SNS sends the alert). Any answer that doesn't fit one of those two roles is a distractor.

No community discussion yet for this question.