SCS-C03 · Question #83
SCS-C03 Question #83: Real Exam Question with Answer & Explanation
The correct answer is C: Configure Amazon CloudWatch Logs as the target of the EventBridge rule. Set up a metric filter. To monitor for anomalous GetSecretValue API calls and trigger notifications, the solution needs to capture the relevant events, filter them for anomalies, and send alerts. By using Amazon CloudWatch Logs as the target for the EventBridge rule, the security engineer can create a C
Question
A company stores sensitive data in AWS Secrets Manager. A security engineer needs to design a solution to generate a notification email when anomalous GetSecretValue API calls occur. The security engineer has configured an Amazon EventBridge rule for all Secrets Manager events that AWS CloudTrail delivers. Which solution will meet these requirements?
Options
- AConfigure CloudTrail as the target of the EventBridge rule. Set up an attribute filter on the
- BConfigure CloudTrail as the target of the EventBridge rule. Set up an attribute filter on the
- CConfigure Amazon CloudWatch Logs as the target of the EventBridge rule. Set up a metric filter
- DConfigure Amazon CloudWatch Logs as the target of the EventBridge rule. Use CloudWatch Logs
Explanation
To monitor for anomalous GetSecretValue API calls and trigger notifications, the solution needs to capture the relevant events, filter them for anomalies, and send alerts. By using Amazon CloudWatch Logs as the target for the EventBridge rule, the security engineer can create a CloudWatch Logs metric filter on relevant API call data (such as IncomingBytes), enabling anomaly detection to spot unusual activity. Then, an Amazon SNS topic can be configured to distribute alerts when a CloudWatch alarm (based on the metric filter) is triggered. This setup is efficient for detecting anomalous patterns in API calls and notifying the team via email.
Community Discussion
No community discussion yet for this question.