AWS Certified Solutions Architect – Professional — Question 563
A company is launching a new web application on Amazon EC2 instances. Development and production workloads exist in separate AWS accounts.
According to the company's security requirements, only automated configuration tools are allowed to access the production account. The company's security team wants to receive immediate notification if any manual access to the production AWS account or EC2 instances occurs.
Which combination of actions should a solutions architect take in the production account to meet these requirements? (Choose three.)
Answer options
- A. Turn on AWS CloudTrail logs in the application's primary AWS Region. Use Amazon Athena to query the logs for AwsConsoleSignIn events.
- B. Configure Amazon Simple Email Service (Amazon SES) to send email to the security team when an alarm is activated.
- C. Deploy EC2 instances in an Auto Scaling group. Configure the launch template to deploy instances without key pairs. Configure Amazon CloudWatch Logs to capture system access logs. Create an Amazon CloudWatch alarm that is based on the logs to detect when a user logs in to an EC2 instance.
- D. Configure an Amazon Simple Notification Service (Amazon SNS) topic to send a message to the security team when an alarm is activated.
- E. Turn on AWS CloudTrail logs for all AWS Regions. Configure Amazon CloudWatch alarms to provide an alert when an AwsConsoleSignIn event is detected.
- F. Deploy EC2 instances in an Auto Scaling group. Configure the launch template to delete the key pair after launch. Configure Amazon CloudWatch Logs for the system access logs. Create an Amazon CloudWatch dashboard to show user logins over time.
Correct answer: C, D, E
Explanation
Deploying EC2 instances without key pairs (Option C) prevents standard, unauthorized SSH/RDP access, and monitoring system access logs with CloudWatch alarms ensures any manual OS login is immediately flagged. Using CloudTrail globally (Option E) ensures any console login (AwsConsoleSignIn) across any region is captured and sent to CloudWatch for real-time alerting. Finally, an Amazon SNS topic (Option D) is the standard AWS service for sending immediate notifications (such as emails or SMS) to the security team when these CloudWatch alarms are triggered.