Your company is making extensive use of the AWS KMS service. They have defined a number of CMK keys. They want to be notified of any request that was made with the root user to create a key in the KMS service.
How could you achieve this? (SELECT TWO.)

Answer options:

A.Use a CloudWatch Event rule to detect the AWS root user events in KMS.
B.Use the CloudWatch metrics service to monitor the AWS root user activities in KMS. 
C.Use the SNS service to send notifications.
D.Use the SQS service to send notifications.

Answer: A and C
Option A is CORRECT because we can use the CloudWatch event rule to monitor root user activities on the AWS account for the KMS service.
Option B is incorrect because the AWS CloudWatch metric provides a variable to monitor. The data points represent the values of that variable over time, but it does not provide information on the root user activity.
Option A is CORRECT because we can use the CloudWatch event rule to monitor root user activity on the AWS account and use AWS SNS as a target for sending out notifications for the same.
Option D is incorrect because the AWS SQS provides a fully managed message queuing service that enables you to decouple and scale microservices, distributed systems, and serverless applications, but SQS would provide neither monitoring of root user activity nor event notification performed by the root account.
Reference:
https://aws.amazon.com/blogs/mt/monitor-and-notify-on-aws-account-root-user-activity/