SOA-C02 · Question #579
A company has business-critical resources in one of its AWS accounts. The company wants to receive an email notification every time an AWS Management Console root user sign-in event occurs in the…
The correct answer is C. Create an Amazon EventBridge rule that reacts to AWS Management Console root user sign-in. Option C is correct because EventBridge natively integrates with AWS CloudTrail to detect root user console sign-in events in near-real time, and you can configure the rule to trigger an SNS topic that delivers an email notification - all without provisioning or managing any…
Question
A company has business-critical resources in one of its AWS accounts. The company wants to receive an email notification every time an AWS Management Console root user sign-in event occurs in the account. Which solution will meet this requirement with the MOST operational efficiency?
Options
- ACreate an Amazon CloudWatch alarm that detects AWS Management Console root user sign-in
- BLaunch an Amazon EC2 instance. Schedule a script to run every hour to analyze AWS CloudTrail
- CCreate an Amazon EventBridge rule that reacts to AWS Management Console root user sign-in
- DCreate an Amazon EventBridge rule that reacts to AWS Management Console root user sign-in
How the community answered
(43 responses)- A5% (2)
- B7% (3)
- C74% (32)
- D14% (6)
Explanation
Option C is correct because EventBridge natively integrates with AWS CloudTrail to detect root user console sign-in events in near-real time, and you can configure the rule to trigger an SNS topic that delivers an email notification - all without provisioning or managing any infrastructure.
Option A is wrong because CloudWatch alarms are designed for metric thresholds (e.g., CPU > 80%), not for reacting to discrete API/console events like a root login. You'd need a CloudWatch Logs metric filter as an intermediary, making it more complex and less operationally efficient.
Option B is wrong because running an EC2 instance to poll CloudTrail every hour is the least efficient approach - it incurs compute costs, requires maintenance, and introduces up to a 60-minute delay in detection, which defeats the purpose of timely alerting.
Note: Options C and D appear identical as written - this is likely a transcription error in the question; on the real exam, one option typically differs by a key detail (e.g., missing the SNS/email step).
Memory tip: Think of EventBridge as the "event router" of AWS - when something happens (an event), EventBridge reacts and can fan out to SNS, Lambda, etc. If the question involves detecting a specific AWS action and triggering a notification, EventBridge + SNS is almost always the most operationally efficient answer.
Topics
Community Discussion
No community discussion yet for this question.