Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 230 discussion

Correct answer.

I think “C” is better than “D”. The filter pattern can identify the root user's login event and include the content of that event in the SNS. With “C” notification, we only know that the root user logged in.

Option E: Use CloudTrail to capture and forward root user activities. Option C: Set up metric filters and alarms to alert on root user login events. Option F: Create a CloudWatch dashboard for visualizing root user activities. Additional Note: CloudWatch Logs Subscription Filter: - Real-time processing of log events, but typically used for streaming log data to other services like AWS Lambda or Elasticsearch. - Not necessary for the specific task of alerting on root user login events. AWS Config is not directly relevant to capturing and forwarding root user login events to CloudWatch Logs.

---> CEF

E- AWS CloudTrail will log all activities, including root user logins, across all accounts in the organisation. Sending these logs to CloudWatch Logs enables further processing and analysis. C- Creating a metric filter to detect root user login events will allow you to trigger a CloudWatch alarm. The alarm can then send notifications via SNS to the company's monitoring system, ensuring real-time alerts for root user logins. F- Using CloudWatch Logs Insights, you can create queries to extract and visualise log data related to root user activity. This data can be displayed on a CloudWatch dashboard, providing a centralised view of root user actions.

E first, then C, and the last is F E ensures that all events, including root user login events, are captured across all accounts in the organization. By sending these events to CloudWatch Logs, you centralize the logging data, making it accessible for further processing. C creating a metric filter in CloudWatch Logs to detect specific patterns in the log data, such as root user login events. F creating a CloudWatch dashboard that utilizes CloudWatch Logs Insights to query and visualize the log data. This dashboard can be used to display detailed information about root user login activity and other relevant log events.