A company has secured the root user of its AWS account and enabled AWS CloudTrail with logs delivered to Amazon S3. A security engineer needs near real-time alerts when the root user successfully signs in to the AWS Management Console. Which solutions will provide these notifications? (Choose two.)

The two correct options provide near real-time alerts for root user sign-ins. The first correct option leverages CloudTrail's integration with CloudWatch Logs. By sending CloudTrail logs to CloudWatch Logs, a metric filter can be created to specifically identify successful root user console logins. A CloudWatch alarm then triggers an SNS notification when this metric is detected. The second correct option uses Amazon EventBridge to directly process CloudTrail events. An EventBridge rule can be configured to match the specific CloudTrail management event for a successful root user sign-in and then publish this event to an SNS topic for notifications. The incorrect options are less suitable. AWS Trusted Advisor does not directly monitor individual root user sign-ins in real-time for alerting. IAM Access Analyzer focuses on analyzing resource access, not real-time login events. While CloudTrail can publish log delivery notifications, parsing these with Lambda adds unnecessary complexity and potential latency compared to direct integration with CloudWatch Logs or EventBridge for event-driven alerting.