A regional hospital network runs several AWS accounts. Its AWS CloudTrail trail already delivers events to a CloudWatch Logs log group in the security account.
The security operations team must be paged within five minutes whenever the root user signs in to any account, or whenever more than five console sign-in attempts fail within ten minutes. The team does not want to write or maintain custom code, and it does not want a second copy of the logs.
Which solution meets these requirements with the LEAST operational overhead?
Choose one answer.
AA. Create two metric filters on the CloudTrail log group for root and failed ConsoleLogin events, and CloudWatch alarms on them that notify an SNS topic.
BB. Run a Lambda function every hour that searches the CloudTrail logs in Amazon S3 for root and failed sign-in events, and sends an email when it finds any.
CC. Turn on AWS Config and add the root-account-mfa-enabled rule, so that the team is alerted when the root user signs in without multi-factor authentication.
DD. Export the CloudTrail log group to an Amazon S3 bucket every day, then query the exported files with Amazon Athena each morning for root and failed sign-in events.
Show the answer and explanation
Answer: A
A. Right: Correct. Metric filters turn matching log events into metrics without copying the logs or running code. Alarms on those metrics page the on-call team through SNS within minutes, and the five-in-ten-minutes threshold is a simple alarm setting. Learn more: Creating metrics from log events using filters (opens in a new tab)
B. Wrong: The function can find these events, but an hourly schedule can take up to an hour to alert, which misses the five-minute requirement. The team would also have to write and maintain the custom code that the requirements rule out.
C. Wrong: That Config rule checks whether the root user has MFA turned on. It does not detect a root sign-in or count failed console logins, so the alert requirements are not met.
D. Wrong: Daily exports and morning queries are far too slow for a five-minute alert. The approach also adds an export job and a query routine that the team must run and maintain.
Explanation
Metric filters on the CloudTrail log group count matching events, and CloudWatch alarms on those counts notify the team through SNS. This meets the five-minute alert and the threshold without code or copies of the logs. Hourly searches, daily exports and a Config MFA rule each miss one of the stated requirements.
Want more on Security metrics, alarms and alert routing (CloudWatch, EventBridge)? The 5 full-length practice sets have 7 more Security metrics, alarms and alert routing (CloudWatch, EventBridge) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →