Q84 — AWS SAA-C03 Ch.16

Question 84 of 100 | ← Chapter 16

Q1284. A company wants to receive an email notification when IAM users are added to or deleted from an AWS account.Which solution will meet these requirements?

Correct Answer: D. Enable management events in AWS CloudTrai1. Create an Amazon EventBridge rule that responds to AWS API calls through CloudTrail. Configure an event pattern for CreateUser and DeleteUser actions.Set the target as an Amazon Simple Notification Service(Amazon SNS) topic. Set the company's email address as a subscriber to the SNS topic.

Explanation

The correct solution must trigger an email notification specifically when IAM users are added or deleted in an AWS account. Let's evaluate each option:Correct Answer: D. Enable management events in AWS CloudTrail. Create an Amazon EventBridge rule that responds to AWS API calls through CloudTrail. Configure an event pattern for CreateUser and DeleteUser actions. Set the target as an Amazon Simple Notification Service (Amazon SNS) topic. Set the company's email address as a subscriber to the SNS topic.Why Option D is Best:Directly Monitors IAM User Changes:AWS CloudTrail logs all management API calls, including CreateUser (adding) and DeleteUser (deleting) IAM users.Amazon EventBridge (formerly CloudWatch Events) can detect these specific API calls via an event pattern.Amazon SNS sends an email notification when the event occurs.Precise & Cost-Effective:No unnecessary services (unlike Inspector, GuardDuty, or Macie).Only triggers on relevant IAM actions, reducing noise.Why Other Options Fail:A. Enable Amazon Inspector. Create an Amazon EventBridge rule that responds to Amazon Inspector findings. Set the target as an Amazon Simple Notification Service (Amazon SNS) topic. Set the company's email address as a subscriber to the SNS topic.Incorrect Use Case:Amazon Inspector is for vulnerability scanning (e.g., EC2 security issues). It does not track IAM user changes, so no relevant events will trigger SNS. B. Enable Amazon GuardDuty. Create an Amazon EventBridge rule that responds to GuardDuty findings. Configure an event pattern of Impact:IAMUser/AnomalousBehavior. Set the target as an Amazon Simple Notification Service (Amazon SNS) topic. Set the company's email address as a subscriber to the SNS topic.Incorrect Use Case:Amazon GuardDuty detects threats (e.g., unusual API calls, compromised credentials). It does not monitor routine IAM user creation/deletion (unless suspicious activity occurs). C. Enable Amazon Macie. Create an Amazon EventBridge rule that responds to Macie findings. Set the target as an Amazon Simple Notification Service (Amazon SNS) topic. Set the company's email address as a subscriber to the SNS topic.Incorrect Use Case:Amazon Macie is for data privacy (e.g., detecting sensitive data in S3).It does not track IAM user management events.Key Comparison:RequirementOption DOther OptionsTriggers on IAM user creation/deletion(CloudTrail logs CreateUser/DeleteUser) (A: Inspector; B:GuardDuty; C: Macie -- none track IAM changes)Uses the right AWS service for IAM monitoring(CloudTrail + EventBridge) (A: Inspector; B: GuardDuty; C:Macie -- wrong services)Cost-effective (no unnecessary features)(Only pays for CloudTrail, EventBridge, SNS) (A/B/C enable expensive, irrelevant services)Conclusion:Option D is the only solution that:Directly monitors IAM user changes via CloudTrail.Triggers notifications only for CreateUser/DeleteUser (no false positives). Uses minimal, cost-effective services (no Inspector/GuardDuty/Macie overhead).Final Answer: D