AWS Certified Security – Specialty — Question 186

A company's security officer is concerned about the risk of AWS account root user logins and has assigned a security engineer to implement a notification solution for near-real-time alerts upon account root user logins.
How should the security engineer meet these requirements?

Answer options

• A. Create a cron job that runs a script to download the AWS IAM security credentials file, parse the file for account root user logins, and email the security team's distribution list.
• B. Run AWS CloudTrail logs through Amazon CloudWatch Events to detect account root user logins and trigger an AWS Lambda function to send an Amazon SNS notification to the security team's distribution list.
• C. Save AWS CloudTrail logs to an Amazon S3 bucket in the security team's account. Process the CloudTrail logs with the security engineer's logging solution for account root user logins. Send an Amazon SNS notification to the security team upon encountering the account root user login events.
• D. Save VPC Flow Logs to an Amazon S3 bucket in the security team's account, and process the VPC Flow Logs with their logging solutions for account root user logins. Send an Amazon SNS notification to the security team upon encountering the account root user login events.

Correct answer: B

Explanation

Option B is correct because it leverages AWS CloudTrail and Amazon CloudWatch Events to provide near-real-time monitoring of account root user logins, triggering an automated alert through AWS Lambda and Amazon SNS. Option A is inefficient as it relies on a scheduled job and manual parsing, while Option C is slower due to log processing from S3, and Option D is incorrect as VPC Flow Logs do not capture account root user logins.