A company uses AWS Organizations and wants its monitoring system to receive an alert when a root user signs in. The company also needs a dashboard that shows any activity generated by the root user. Which combination of steps will meet these requirements? (Choose three.)

To detect root user activity across an organization, an AWS CloudTrail organization trail must be created and configured to send events to Amazon CloudWatch Logs. This centralizes all CloudTrail logs, including root user sign-ins, in a single CloudWatch Logs log group. For alerting, a CloudWatch Logs metric filter can be created to identify root user login events within the CloudTrail logs. This metric filter then triggers a CloudWatch alarm, which publishes notifications to an Amazon SNS topic. The monitoring system can subscribe to this SNS topic to receive immediate alerts. For a dashboard, an Amazon CloudWatch dashboard can be created. This dashboard can visualize root user activity by using a CloudWatch Logs Insights query to analyze the CloudTrail logs stored in CloudWatch Logs. Incorrect options: Enabling AWS Config and forwarding logs to CloudWatch Logs is not directly used for detecting or alerting on root user logins; CloudTrail is the service for logging API activity. An Amazon QuickSight dashboard could be used, but a CloudWatch dashboard with CloudWatch Logs Insights is a more direct and often simpler solution for operational data within AWS. A CloudWatch Logs subscription filter could forward events, but a metric filter with an alarm is the standard and more robust approach for alerting on specific log patterns.