nerdexam
Amazon

SOA-C02 · Question #579

A company has business-critical resources in one of its AWS accounts. The company wants to receive an email notification every time an AWS Management Console root user sign-in event occurs in the…

The correct answer is C. Create an Amazon EventBridge rule that reacts to AWS Management Console root user sign-in. Option C is correct because EventBridge natively integrates with AWS CloudTrail to detect root user console sign-in events in near-real time, and you can configure the rule to trigger an SNS topic that delivers an email notification - all without provisioning or managing any…

Submitted by priya_blr· Mar 30, 2026Security and Compliance

Question

A company has business-critical resources in one of its AWS accounts. The company wants to receive an email notification every time an AWS Management Console root user sign-in event occurs in the account. Which solution will meet this requirement with the MOST operational efficiency?

Options

  • ACreate an Amazon CloudWatch alarm that detects AWS Management Console root user sign-in
  • BLaunch an Amazon EC2 instance. Schedule a script to run every hour to analyze AWS CloudTrail
  • CCreate an Amazon EventBridge rule that reacts to AWS Management Console root user sign-in
  • DCreate an Amazon EventBridge rule that reacts to AWS Management Console root user sign-in

How the community answered

(43 responses)
  • A
    5% (2)
  • B
    7% (3)
  • C
    74% (32)
  • D
    14% (6)

Explanation

Option C is correct because EventBridge natively integrates with AWS CloudTrail to detect root user console sign-in events in near-real time, and you can configure the rule to trigger an SNS topic that delivers an email notification - all without provisioning or managing any infrastructure.

Option A is wrong because CloudWatch alarms are designed for metric thresholds (e.g., CPU > 80%), not for reacting to discrete API/console events like a root login. You'd need a CloudWatch Logs metric filter as an intermediary, making it more complex and less operationally efficient.

Option B is wrong because running an EC2 instance to poll CloudTrail every hour is the least efficient approach - it incurs compute costs, requires maintenance, and introduces up to a 60-minute delay in detection, which defeats the purpose of timely alerting.

Note: Options C and D appear identical as written - this is likely a transcription error in the question; on the real exam, one option typically differs by a key detail (e.g., missing the SNS/email step).

Memory tip: Think of EventBridge as the "event router" of AWS - when something happens (an event), EventBridge reacts and can fan out to SNS, Lambda, etc. If the question involves detecting a specific AWS action and triggering a notification, EventBridge + SNS is almost always the most operationally efficient answer.

Topics

#AWS CloudTrail#Amazon EventBridge#Security Monitoring#Notifications

Community Discussion

No community discussion yet for this question.

Full SOA-C02 Practice