Logging and Monitoring

1. A security engineer wants to automatically trigger an AWS Lambda function whenever an IAM policy is changed, to audit configuration drift in real time. Which AWS service combination is the MOST appropriate solution?

• A.Use Amazon CloudWatch Events (EventBridge) with an IAM API event rule targeting a Lambda function to invoke it on policy changes.✓ Correct
• B.Use Amazon CloudWatch Alarms with a custom metric filter to invoke Lambda when policy change count exceeds a threshold.
• C.Use AWS CloudTrail alone to stream IAM events directly to a Lambda function without any intermediary service.
• D.Use Amazon CloudWatch Logs Insights queries scheduled hourly to detect IAM policy changes and trigger Lambda manually.

2. A team sets up a CloudWatch Alarm to detect brute-force login attempts by monitoring a metric filter on failed SSH login log entries. The alarm triggers an SNS notification. After deployment, no alerts are received despite verified failed logins. What is the MOST likely cause?

• A.The CloudWatch Alarm evaluation period and datapoints-to-alarm settings may not match the frequency of log ingestion, causing missed breaches.
• B.CloudWatch Alarms cannot monitor log-based metric filters; only native CloudWatch service metrics are supported by alarms.
• C.The metric filter namespace is set incorrectly, so the custom metric data never reaches the alarm's monitored metric.✓ Correct
• D.SNS topics require explicit CloudWatch service principal permissions in the topic's access policy to publish alarm notifications.

3. A compliance team must receive an immediate alert whenever the AWS root account is used for any API call. Which CloudWatch configuration achieves this MOST directly?

• A.Create a CloudWatch Logs metric filter using the RootAccountUsage filter pattern on the CloudTrail log group, then attach an alarm and SNS topic to that metric.✓ Correct
• B.Enable AWS Config with a managed rule for root account usage and configure an SNS notification on Config rule non-compliance events.
• C.Create a CloudWatch Events rule matching all IAM events and filter for root user in the Lambda function that receives the events.
• D.Use AWS GuardDuty's RootCredentialUsage finding and configure a GuardDuty SNS notification for immediate alerting.

4. Which CloudWatch metric filter pattern correctly identifies root account API activity from CloudTrail logs delivered to a CloudWatch Logs log group?

• A.{ $.userIdentity.type = "Root" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != "AwsServiceEvent" } is the correct RootAccountUsage filter pattern.✓ Correct
• B.{ $.userIdentity.arn = "arn:aws:iam::*:root" } is sufficient to capture all root account activities including service-invoked events.
• C.{ $.eventSource = "iam.amazonaws.com" && $.userIdentity.type = "Root" } limits detection to IAM API calls only and misses other services.
• D.{ $.userIdentity.type = "Root" } alone captures all root usage but will also generate false positives from AWS service-initiated root events.

5. A developer's IAM role has a policy granting 'cloudwatch:PutMetricData' but they cannot publish metrics to a custom namespace. A security review reveals the CloudWatch namespace has no resource-based policy. What is the MOST accurate explanation?

• A.CloudWatch does not support resource-based policies on namespaces; access is controlled entirely by identity-based IAM policies attached to principals.✓ Correct
• B.CloudWatch requires both an identity-based policy on the IAM role and a resource-based policy on the namespace to allow PutMetricData.
• C.The developer must use a service-linked role for CloudWatch because PutMetricData is restricted to AWS-managed roles only.
• D.Resource-based policies on CloudWatch namespaces override identity-based policies, so the absence of a namespace policy denies all access by default.