Q12 — AWS SAA-C03 Ch.11

Question 12 of 100 | ← Chapter 11

Q712. A company has a mobile app for customers. The app's data is sensitive and must be encrypted at rest. The company uses AWS Key Management Service (AWS KMS).The company needs a solution that prevents the accidental deletion of KMS keys. The solution must use Amazon Simple Notification Service (Amazon SNS) to send an email notification to administrators when a user attempts to delete a KMS key.Which solution will meet these requirements with the LEAST operational overhead?

• A. Create an Amazon EventBridge rule that reacts when a user tries to delete a KMS key. Configure an AWS Config rule that cancels any deletion of a KMS key. Add the AWS Config rule as a target of the EventBridge rule. Create an SNS topic that notifies the administrators.
• B. Create an AWS Lambda function that has custom logic to prevent KMS key deletion. Create an Amazon CloudWatch alarm that is activated when a user tries to delete a KMS key. Create an Amazon EventBridge rule that invokes the Lambda function when the DeleteKey operation is performed. Create an SNS topic. Configure the EventBridge rule to publish an SNS message that notifies the administrators.
• C. Create an Amazon EventBridge rule that reacts when the KMS DeleteKey operation is performed.Configure the rule to initiate an AWS Systems Manager Automation runbook. Configure the runbook to cancel the deletion of the KMS key. Create an SNS topic. Configure the EventBridge rule to publish an SNS message that notifies the administrators. ✓
• D. Create an AWS CloudTrail trail. Configure the trail to deliver logs to a new Amazon CloudWatch log group. Create a CloudWatch alarm based on the metric filter for the CloudWatch log group. Configure the alarm to use Amazon SNS to notify the administrators when the KMS DeleteKey operation is performed.

Correct Answer: C. Create an Amazon EventBridge rule that reacts when the KMS DeleteKey operation is performed.Configure the rule to initiate an AWS Systems Manager Automation runbook. Configure the runbook to cancel the deletion of the KMS key. Create an SNS topic. Configure the EventBridge rule to publish an SNS message that notifies the administrators.

Explanation

This solution has the least operational overhead compared to the other options: \1. Amazon EventBridge: - EventBridge provides a simple way to react to specific AWS API calls, such as the KMS DeleteKey operation. - Configuring an EventBridge rule to monitor for the DeleteKey operation requires minimal setup. \2. AWS Systems Manager Automation: - Systems Manager Automation allows you to create runbooks to automate various tasks, including canceling the deletion of a KMS key. - Integrating the EventBridge rule with a Systems Manager Automation runbook is a straightforward process. \3. Amazon SNS: - SNS provides a simple way to set up email notifications for specific events, such as KMS key deletion attempts. - Configuring the EventBridge rule to publish an SNS message is a simple process. The other options involve more complex setups and additional AWS services, which would result in higher operational overhead for the company: A. Requires setting up AWS Config, EventBridge, and additional configurations.B. Requires creating a custom Lambda function and additional configurations.D. Requires setting up CloudTrail, CloudWatch, and additional configurations. By using the combination of EventBridge, Systems Manager Automation, and SNS, Option C provides the simplest and most efficient solution to meet the requirements, with the least operational overhead for the company.