SCS-C02 · Question #443
A company has a strict policy against using root credentials. The company's security team wants to be alerted as soon as possible when root credentials are used to sign in to the AWS Management…
The correct answer is B. Use Amazon EventBridge to monitor console logins and direct them to Amazon Simple. Amazon EventBridge can be configured to monitor specific AWS CloudTrail events, including root login events. By setting up an EventBridge rule to detect ConsoleLogin events where the userIdentity type is "Root," the security team can quickly receive alerts. EventBridge can then…
Question
A company has a strict policy against using root credentials. The company's security team wants to be alerted as soon as possible when root credentials are used to sign in to the AWS Management Console. How should the security team achieve this goal?
Options
- AUse AWS Lambda to periodically query AWS CloudTrail for console login events and send alerts
- BUse Amazon EventBridge to monitor console logins and direct them to Amazon Simple
- CUse Amazon Athena to query AWS IAM Identity Center logs and send alerts using Amazon
- DConfigure AWS Resource Access Manager to review the access logs and send alerts using
How the community answered
(63 responses)- A11% (7)
- B81% (51)
- C5% (3)
- D3% (2)
Explanation
Amazon EventBridge can be configured to monitor specific AWS CloudTrail events, including root login events. By setting up an EventBridge rule to detect ConsoleLogin events where the userIdentity type is "Root," the security team can quickly receive alerts. EventBridge can then send these events to Amazon SNS, which distributes notifications immediately to the team. This setup provides near-real-time alerts with minimal operational overhead.
Topics
Community Discussion
No community discussion yet for this question.