Metric Filters for Security Events Quiz

What you'll be asked

1. What is the primary purpose of a CloudWatch Metric Filter in the context of security monitoring?
2. You are monitoring CloudTrail logs for unauthorized API calls. Which component is required to receive an email notification when a specific metric filter pattern is matched?
3. When defining a metric filter pattern to detect 'UnauthorizedOperation' errors in CloudTrail logs, what is the best practice for capturing only relevant events?
4. You have created a metric filter to track 'root' user logins. After testing, you notice the metric is not incrementing even though 'root' logins are occurring. What is the most likely cause?
5. You need to monitor for multiple distinct security events (e.g., 'ConsoleLoginFailure' and 'UnauthorizedApiCall') within the same log group. How should you configure your metric filters?

Answers and explanations come after you submit.