Exams / SCS-C03 / Study guide / Security metrics, alarms and alert routing (CloudWatch, EventBridge)
Security metrics, alarms and alert routing (CloudWatch, EventBridge): SCS-C03 study notes and practice questions
What to know about Security metrics, alarms and alert routing (CloudWatch, EventBridge) for the SCS-C03 exam, from the Detection domain (16% of the exam guide), then 2 free questions to test it. Part of the SCS-C03 study guide.
These questions describe a security event that must be noticed quickly, such as a root user sign-in, a change to a security group or a burst of failed logins. You choose the alerting path that fires on the right signal, reaches the right team and keeps working when log data stops arriving.
Log patterns: metric filters and alarms
A metric filter in CloudWatch Logs turns matching log events into a custom metric. For example, a filter on a CloudTrail log group can count root user console sign-ins. A filter acts only on events ingested after it exists; it does not search history.
A CloudWatch alarm watches a metric and changes state when the metric crosses a threshold for a set number of evaluation periods. The alarm can notify an SNS topic, which fans the alert out to email, chat integrations or other subscribers.
Missing data treatment matters. For an event count, “no events” means all is well, so the alarm should not breach on missing data. For a heartbeat that proves logs are still arriving, missing data should count as breaching, so a stopped log feed raises an alarm.
Service events: EventBridge
EventBridge rules match events by pattern and send them to targets such as SNS, Lambda, Step Functions or Systems Manager Automation. AWS services publish events for GuardDuty and Security Hub findings, AWS Config compliance changes and many CloudTrail API calls.
EventBridge is regional. A rule sees events from its own Region and account, unless an event bus in another account forwards them.
For a multi-account design, send member account events to a central event bus in the security account. The receiving bus needs a resource policy that allows the sending accounts, and each rule’s target needs permission to run.
How to choose
Scenario wording
Pick
Alert when a pattern appears in CloudTrail or application logs
Metric filter, then a CloudWatch alarm that notifies SNS
React to a GuardDuty or Security Hub finding within seconds
EventBridge rule with a target
Send events from every member account to one security account
Central event bus with a resource policy
Alert when expected logs stop arriving
Alarm on a heartbeat metric with missing data treated as breaching
Count failed sign-ins over the last five minutes
Metric filter with an alarm over a short period
Investigate an event from last month
Logs Insights or Athena, not a new filter
Common traps
Expecting a new metric filter to alert on last week’s events. Filters see only events ingested after they are created.
Filtering a log group that never receives the events, for example a trail that delivers to a different log group.
Leaving missing data at its default for a heartbeat check, so a broken log feed looks healthy.
Polling with a scheduled Lambda when EventBridge can react to the event itself.
Forgetting cross-account permissions, so events from member accounts never reach the security account.
A regional hospital network runs several AWS accounts. Its AWS CloudTrail trail already delivers events to a CloudWatch Logs log group in the security account.
The security operations team must be paged within five minutes whenever the root user signs in to any account, or whenever more than five console sign-in attempts fail within ten minutes. The team does not want to write or maintain custom code, and it does not want a second copy of the logs.
Which solution meets these requirements with the LEAST operational overhead?
Choose one answer.
AA. Create two metric filters on the CloudTrail log group for root and failed ConsoleLogin events, and CloudWatch alarms on them that notify an SNS topic.
BB. Run a Lambda function every hour that searches the CloudTrail logs in Amazon S3 for root and failed sign-in events, and sends an email when it finds any.
CC. Turn on AWS Config and add the root-account-mfa-enabled rule, so that the team is alerted when the root user signs in without multi-factor authentication.
DD. Export the CloudTrail log group to an Amazon S3 bucket every day, then query the exported files with Amazon Athena each morning for root and failed sign-in events.
Show the answer and explanation
Answer: A
A. Right: Correct. Metric filters turn matching log events into metrics without copying the logs or running code. Alarms on those metrics page the on-call team through SNS within minutes, and the five-in-ten-minutes threshold is a simple alarm setting. Learn more: Creating metrics from log events using filters (opens in a new tab)
B. Wrong: The function can find these events, but an hourly schedule can take up to an hour to alert, which misses the five-minute requirement. The team would also have to write and maintain the custom code that the requirements rule out.
C. Wrong: That Config rule checks whether the root user has MFA turned on. It does not detect a root sign-in or count failed console logins, so the alert requirements are not met.
D. Wrong: Daily exports and morning queries are far too slow for a five-minute alert. The approach also adds an export job and a query routine that the team must run and maintain.
Explanation
Metric filters on the CloudTrail log group count matching events, and CloudWatch alarms on those counts notify the team through SNS. This meets the five-minute alert and the threshold without code or copies of the logs. Hourly searches, daily exports and a Config MFA rule each miss one of the stated requirements.
A university runs 30 AWS accounts for its research groups, teaching systems and administration. A central security operations team sits in a separate monitoring account, and it wants one set of dashboards and alarms that show metrics and logs from every account.
Each department owns its accounts and wants to keep control of its own resources. The central team must not receive IAM access into each account, and the dashboards must show near real-time data without copying metrics or logs into another store.
Which solution meets these requirements?
Choose one answer.
AA. In the monitoring account, create a cross-account observability sink and share it with the source accounts. Each source account links to it, and dashboards and alarms are built in the monitoring account.
BB. Create a metric stream in each source account that sends all metrics to an Amazon Data Firehose stream in the monitoring account, then store the metrics in Amazon S3 for Amazon Athena.
CC. Create an IAM role in each source account that the central team assumes from the monitoring account, then build the dashboards from the metrics that each role returns.
DD. Send CloudWatch alarm state changes from each source account to a central Amazon EventBridge bus, and have the monitoring account post the alerts to a shared chat channel.
Show the answer and explanation
Answer: A
A. Right: Correct. Cross-account observability lets the monitoring account view and alarm on metrics and logs from linked source accounts. Each department keeps its own resources and IAM, and no data is copied out of the source accounts. Learn more: Amazon CloudWatch cross-account observability (opens in a new tab)
B. Wrong: Metric streams work, but the metrics land in S3 and are queried with a delay, which is not the near real-time dashboard the team needs. The approach also copies metrics into a second store, which the requirements rule out.
C. Wrong: This gives the central team access into every department account, which the requirements rule out. Using a separate role per account also means many roles to manage, with no single set of dashboards.
D. Wrong: Forwarded alarm events give alerts but no dashboards of the underlying metrics or logs. The requirement is for one set of dashboards that show metrics and logs from every account.
Explanation
Cross-account observability links source accounts to a monitoring account, so one set of dashboards and alarms can show their metrics and logs. The departments keep their own resources and permissions, and the data is not copied. Metric streams add delay and copies, while roles and forwarded alarms each fail a stated requirement.
Want more on Security metrics, alarms and alert routing (CloudWatch, EventBridge)? The 5 full-length practice sets have 7 more Security metrics, alarms and alert routing (CloudWatch, EventBridge) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Security metrics, alarms and alert routing (CloudWatch, EventBridge)