A company's security team wants to receive near-real-time email notifications about AWS abuse reports related to DoS attacks. An Amazon SNS topic already exists and is subscribed to by the security…

Question

Options

• APoll Trusted Advisor for abuse notifications by using a Lambda function.
• BCreate an Amazon EventBridge rule that matches AWS Health events for
• CPoll the AWS Support API for abuse cases by using a Lambda function.
• DDetect abuse reports by using CloudTrail logs and CloudWatch alarms.

• A
  9% (5)
• B
  70% (38)
• C
  4% (2)
• D
  17% (9)

Explanation

AWS Abuse Report Notifications Explained

Option B is correct because AWS Health publishes abuse-related events (including DoS attack reports) directly to Amazon EventBridge, allowing you to create a rule that matches these specific events and routes them to an existing SNS topic for near-real-time email notifications - this is the purpose-built, native AWS solution for this use case.

Why the distractors fail:

• Option A is wrong because AWS Trusted Advisor focuses on best practice recommendations (cost, security posture, performance), not abuse reports - polling it would yield no relevant data.
• Option C is wrong because while AWS Support does handle abuse cases, polling via Lambda introduces latency and unnecessary complexity when EventBridge already provides event-driven, near-real-time delivery natively.
• Option D is wrong because CloudTrail logs API activity within your account, not external abuse reports filed against your account - CloudWatch alarms on CloudTrail would never detect incoming DoS abuse notifications.

Memory Tip: Think of AWS Health = your account's health feed, including communications from AWS about abuse. EventBridge acts as the "listener" that catches Health events and forwards them - remember the pattern: AWS Health → EventBridge Rule → SNS Topic → Email.

No community discussion yet for this question.