DOP-C02 Question 124

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  B is the cheapest and correct solution CloudTrail does not capture: SSH logins to Linux instances. RDP logins to Windows instances. Commands executed on the instances. Local file access or modifications within the instances.

• Chose B6

  B is correct: <the security team must be notified > means SNS A: irrelevant, inspector is for vulnerability scanning C: cloud trail is for monitoring account activities D: This options uses manual script, which is irrelevant

• Chose C1

  While Option B can provide valuable insights into user logins and send notifications to the security team, it might not guarantee that the security team is notified within 15 minutes of a login occurrence. The time it takes for the CloudWatch metric filter to process and detect the login event, along with the potential delays in the SNS notification, could result in notifications being sent beyond the required 15-minute timeframe. On the other hand, Option C, which uses AWS CloudTrail with Amazon CloudWatch Logs and Amazon Kinesis, allows real-time processing and immediate notifications when a user login event is detected. This makes Option C more suitable for meeting the specific requirement of notifying the security team within 15 minutes of a login occurrence.