A company recently deployed a new AWS account and wants to be notified immediately if a specific number of unauthorized AWS API requests are detected. A security engineer has turned on AWS CloudTrail for the account and is sending CloudTrail logs to Amazon CloudWatch.
Which other action must the security engineer perform to receive automated alerts about unauthorized AWS API calls?
A. Create a CloudWatch metric filter that looks for API call error codes. Configure an alarm that is based on that metric’s rate to send an Amazon Simple Notification Service (Amazon SNS) notification when the threshold is exceeded.
B. Configure CloudTrail to stream event data to Amazon Kinesis Data Streams. Configure an AWS Lambda function on the stream to initiate an alarm when the threshold is exceeded.
C. Run an Amazon Athena SQL query against CloudTrail log files for unauthorized API requests. Use Amazon QuickSight to create an operational dashboard.
D. Use the AWS Personal Health Dashboard to monitor the account’s use of AWS services and to provide an alert if service error rates increase.
