SAA-C03 · Question #162
A company runs an order management application on AWS. The application allows customers to place orders and pay with a credit card. The company uses an Amazon CloudFront distribution to deliver the…
The correct answer is A. EventBridge Rule: Detects modifications to CloudFront distributions in real time and triggers C. Lambda + SNS: Provides real-time notifications about changes in logging configuration. Why A and C are correct: When a user modifies a CloudFront distribution's logging configuration, that action is recorded as an API call in AWS CloudTrail. An EventBridge rule (A) can detect this API event (UpdateDistribution) in real time and trigger downstream actions. Lambda…
Question
A company runs an order management application on AWS. The application allows customers to place orders and pay with a credit card. The company uses an Amazon CloudFront distribution to deliver the application. A security team has set up logging for all incoming requests. The security team needs a solution to generate an alert if any user modifies the logging configuration. Which combination of solutions will meet these requirements? (Choose two.)
Options
- AEventBridge Rule: Detects modifications to CloudFront distributions in real time and triggers
- BALB + Config: Focuses on ALB security violations, not relevant for CloudFront logging
- CLambda + SNS: Provides real-time notifications about changes in logging configuration.
- DGuardDuty: Focuses on threat detection, not logging configuration changes.
- EAPI Gateway + WAF: Unrelated to CloudFront logging changes.
How the community answered
(26 responses)- A73% (19)
- B8% (2)
- D15% (4)
- E4% (1)
Explanation
Why A and C are correct: When a user modifies a CloudFront distribution's logging configuration, that action is recorded as an API call in AWS CloudTrail. An EventBridge rule (A) can detect this API event (UpdateDistribution) in real time and trigger downstream actions. Lambda + SNS (C) serves as the ideal downstream target - Lambda processes the event and SNS publishes an alert notification to subscribers, completing the alert pipeline.
Why the distractors are wrong:
- B (ALB + Config): AWS Config tracks resource configuration history but is scoped to ALB here, not CloudFront; this combination doesn't target CloudFront logging changes.
- D (GuardDuty): GuardDuty detects threats like compromised credentials or malicious traffic - it doesn't monitor configuration changes to services like CloudFront.
- E (API Gateway + WAF): WAF protects against web exploits at the request layer; it has no visibility into CloudFront distribution configuration changes.
Memory tip: Think of the pattern as a chain - EventBridge catches the "who changed what" event → Lambda processes it → SNS shouts the alert. For any "alert me when a config changes" question on AWS exams, EventBridge + Lambda/SNS is almost always part of the answer because CloudTrail feeds EventBridge, and EventBridge is the real-time config-change detector.
Topics
Community Discussion
No community discussion yet for this question.