Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 126 discussion

B is correct: <the security team must be notified > means SNS A: irrelevant, inspector is for vulnerability scanning C: cloud trail is for monitoring account activities D: This options uses manual script, which is irrelevant

B is the cheapest and correct solution CloudTrail does not capture: SSH logins to Linux instances. RDP logins to Windows instances. Commands executed on the instances. Local file access or modifications within the instances.

While Option B can provide valuable insights into user logins and send notifications to the security team, it might not guarantee that the security team is notified within 15 minutes of a login occurrence. The time it takes for the CloudWatch metric filter to process and detect the login event, along with the potential delays in the SNS notification, could result in notifications being sent beyond the required 15-minute timeframe. On the other hand, Option C, which uses AWS CloudTrail with Amazon CloudWatch Logs and Amazon Kinesis, allows real-time processing and immediate notifications when a user login event is detected. This makes Option C more suitable for meeting the specific requirement of notifying the security team within 15 minutes of a login occurrence.

https://aws.amazon.com/blogs/security/how-to-monitor-and-visualize-failed-ssh-access-attempts-to-amazon-ec2-linux-instances/

B, Eventhough it's not stated in some questions, the cheapest solution to a problem is always AWS favorite.

Isn't it possible to get login events with CloudTrail?

Subtle difference Cloudtrail is "near" realtime - You can use subscriptions to get access to a real-time feed of log events from CloudWatch Logs and have it delivered to other services such as an Amazon Kinesis stream, an Amazon Kinesis Data Firehose stream, or AWS Lambda for custom processing, analysis, or loading to other systems.

B is the right answer

i think its C, Both B&C solutions are valid and can meet the requirement of notifying the security team within 15 minutes of a DevOps engineer logging into an EC2 instance. However, there are some differences in how quickly each solution can detect and notify the security team of a login event. The CloudTrail-based solution can detect a login event more quickly than the CloudWatch-based solution because CloudTrail captures API events in near-real-time, while CloudWatch logs may have a delay of a few minutes before they appear in the log group. Therefore, the CloudTrail-based solution is more likely to meet the 15-minute notification requirement.