A company wants to be alerted through email when IAM CreateUser API calls are made within its AWS account. Which combination of actions should a SysOps administrator take to meet this requirement?…

The correct answer is A. Create an Amazon EventBridge (Amazon CloudWatch Events) rule with AWS CloudTrail as the D. Use an Amazon Simple Notification Service (Amazon SNS) topic as an event target with an email. AWS IAM API Monitoring via EventBridge + SNS Option A is correct because AWS CloudTrail records all IAM API calls (including CreateUser), and EventBridge can use CloudTrail as an event source to trigger rules when specific API calls are detected. Option D is correct because…

Submitted by ricky.ec· Mar 30, 2026Monitoring, Logging, and Remediation

Question

A company wants to be alerted through email when IAM CreateUser API calls are made within its AWS account. Which combination of actions should a SysOps administrator take to meet this requirement? (Choose two.)

Options

ACreate an Amazon EventBridge (Amazon CloudWatch Events) rule with AWS CloudTrail as the
BCreate an Amazon EventBridge (Amazon CloudWatch Events) rule with Amazon CloudSearch as
CCreate an Amazon EventBridge (Amazon CloudWatch Events) rule with AWS IAM Access
DUse an Amazon Simple Notification Service (Amazon SNS) topic as an event target with an email
EUse an Amazon Simple Email Service (Amazon SES) notification as an event target with an email

How the community answered

(53 responses)

A
87% (46)
B
4% (2)
C
8% (4)
E
2% (1)

Explanation

AWS IAM API Monitoring via EventBridge + SNS

Option A is correct because AWS CloudTrail records all IAM API calls (including CreateUser), and EventBridge can use CloudTrail as an event source to trigger rules when specific API calls are detected. Option D is correct because Amazon SNS is the native AWS service for sending notifications - you create an SNS topic, set it as the EventBridge rule's target, and subscribe an email address to that topic.

Why the distractors fail:

B (CloudSearch) - CloudSearch is a managed search service with no role in API call monitoring or event sourcing.
C (IAM Access Analyzer) - IAM Access Analyzer identifies unintended resource access via policy analysis; it does not emit events based on specific API calls like CreateUser.
E (SES) - SES is a bulk/transactional email delivery service for applications, not an EventBridge target for AWS service events. SNS handles pub/sub notification delivery natively within the AWS event pipeline.

Memory tip: Think of it as a three-stage pipeline - CloudTrail (captures the API call) → EventBridge (detects and routes the event) → SNS (delivers the email). If a choice breaks this chain (CloudSearch, SES, IAM Access Analyzer), it's wrong. SNS is always the answer for email alerting from AWS event systems, not SES.

Topics

#AWS CloudTrail#Amazon EventBridge#Amazon SNS#Email Alerting

Community Discussion

No community discussion yet for this question.

Full SOA-C02 Practice