AWS Certified Security – Specialty — Question 486

A company wants to monitor the deletion of customer managed CMKs. A security engineer must create an alarm that will notify the company before a CM׀ is deleted. The security engineer has configured the integration of AWS CloudTrail with Amazon CloudWatch.
What should the security engineer do next to meet this requirement?

Answer options

• A. Within AWS Key Management Service (AWS KMS), specify the deletion time of the key material during CMK creation. AWS KMS will automatically create a CloudWatch alarm.
• B. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to look for API calls of DeleteAlias. Create an AWS Lambda function to send an Amazon Simple Notification Service (Amazon SNS) message to the company. Add the Lambda function as the target of the Eventbridge (CloudWatch Events) rule.
• C. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to look for API calls of DisableKey and ScheduleKeyDeletion. Create an AWS Lambda function to send an Amazon Simple Notification Service (Amazon SNS) message to the company. Add the Lambda function as the target of the Eventbridge (CloudWatch Events) rule.
• D. Create an Amazon Simple Notification Service (Amazon SNS) policy to look for AWS Key Management Service (AWS KMS) API calls of RevokeGrant and ScheduleKeyDeletion. Create an AWS Lambda function to generate the alarm and send the notification to the company. Add the Lambda function as the target of the SNS policy.

Correct answer: C

Explanation

To receive a notification before a customer managed CMK is deleted, the system must monitor the DisableKey and ScheduleKeyDeletion API operations, which initiate the mandatory deletion waiting period. Using Amazon EventBridge (Amazon CloudWatch Events) to detect these specific API calls and trigger an AWS Lambda function to send an Amazon SNS alert is the correct architecture. Other options are incorrect because DeleteAlias does not delete the key, AWS KMS does not automatically generate alarms during key creation, and SNS policies are not used to directly monitor API calls.