Create a CloudWatch Logs subscription filter that sends matching log events to an AWS Lambda function, tag the instance that produced the login entry, and use an Amazon EventBridge scheduled rule to invoke a second Lambda function hourly to terminate tagged instances is correct because it enables near real time detection and it guarantees termination well within 12 hours by persisting state with instance tags and scheduling periodic enforcement.

This CloudWatch Logs subscription filter that sends matching log events to an AWS Lambda function, tag the instance that produced the login entry, and use an Amazon EventBridge scheduled rule to invoke a second Lambda function hourly to terminate tagged instances approach uses the unified CloudWatch agent to stream instance system logs to CloudWatch Logs and it uses a subscription filter to trigger a Lambda that identifies and tags the instance that had a manual OS login. Tags persist the detection result on the instance and they let a scheduled remediation job safely and idempotently find and terminate affected instances within the required time window.

Create a CloudWatch alarm that triggers on AWS API call events in CloudTrail, send the alarm to an Amazon SQS queue, and run an AWS Lambda function from the queue to terminate instances that generated the login event is wrong because OS level logins do not generate AWS API calls and they do not appear in CloudTrail. CloudTrail records API activity and it will not contain instance syslog entries.

Create a CloudWatch Logs subscription filter that sends events to AWS Step Functions, use the state machine to tag the resources that produced the login entry, and add an EventBridge rule that runs daily to invoke a Lambda function to terminate instances with that tag is incorrect because CloudWatch Logs subscription filters can only deliver to Lambda, Kinesis Data Streams, or Kinesis Data Firehose, and a daily enforcement schedule risks missing the 12 hour requirement.

Configure an AWS Config custom rule to detect SSH or RDP logins from instance system logs and invoke an SSM Automation runbook that terminates the instance is not viable because AWS Config evaluates resource configuration and compliance and it does not ingest or analyze ephemeral OS syslog events.

Full AWS Practitioner Certification Question