SCS-C02 Practice Test 16 — 15 Questions

Question 1

The above IAM policy is attached to an AWS Lambda function. The function is failing to write logs to CloudWatch Logs. What is the likely cause?

Accepted Answer

The resource ARN does not include the log group itself; only log streams. The IAM policy grants `logs:CreateLogStream` and `logs:PutLogEvents` but specifies a resource ARN that only covers log streams (`arn:aws:logs:us-east-1:123456789012:log-group:MyLogGroup:log-stream:*`). The Lambda function first needs to write to the log group itself (e.g., to create the log group or confirm its existence), which requires `logs:CreateLogGroup` or `logs:DescribeLogGroups` permissions on the log group resource ARN (`arn:aws:logs:us-east-1:123456789012:log-group:MyLogGroup`). Without that, the initial API call to the log group fails, preventing any log stream creation or log event delivery.

Answer

The actions list does not include logs:DescribeLogGroups

Answer

The policy is missing an explicit deny for other actions

Answer

The region in the ARN does not match the Lambda function's region

Question 2

A security team detects that an IAM user's access keys are being used from an unusual geographic location. Which AWS service provides this type of anomaly detection?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, including anomalous API calls from unusual geographic locations. It uses machine learning models and integrated threat intelligence to analyze AWS CloudTrail management events, VPC Flow Logs, and DNS logs, making it the correct service for detecting IAM user access key usage from an unexpected region.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

AWS Config

Question 3

A security team wants to detect unauthorized API calls in real time and automatically block the source IP address using network ACLs. Which AWS service should be used for detection?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is the correct choice because it is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, including API calls from unusual or known-bad IP addresses. It uses machine learning, anomaly detection, and integrated threat intelligence to generate findings that can trigger automated remediation, such as updating network ACLs via AWS Lambda and Amazon EventBridge. This aligns with the requirement for real-time detection and automated blocking of source IPs.

Answer

AWS CloudTrail

Answer

AWS WAF

Answer

AWS Config

Question 4

A company uses AWS CloudTrail to log all API activity. The security team wants to be alerted when an IAM user creates a new access key. They have created a CloudWatch metric filter on the CloudTrail log group for the event name 'CreateAccessKey' and set up a CloudWatch alarm that sends an email via Amazon SNS. However, the alarm is not triggering even though the team knows that access keys have been created. The metric filter has been tested and shows data points in CloudWatch. What should the security team check next?

Accepted Answer

Review the CloudWatch alarm configuration, including the period and threshold.. Option C is correct because the metric filter is producing data points, which means logs are being ingested and the filter is matching events. The most likely issue is that the CloudWatch alarm's period or threshold is misconfigured—for example, the evaluation period might be too long or the threshold too high, causing the alarm to not transition to ALARM state despite the metric having values. The security team should verify the alarm's settings, such as the period (e.g., 5 minutes) and the threshold (e.g., >= 1), to ensure they align with the expected frequency of access key creation events.

Answer

Ensure that the CloudTrail trail is delivering logs to the correct CloudWatch Logs log group.

Answer

Verify that the CloudTrail trail is logging data events.

Answer

Check that the IAM user has permissions to create access keys.

Question 5

During a security incident, a security engineer needs to capture network traffic from an EC2 instance for forensic analysis. The instance is part of an Auto Scaling group and may be terminated. What is the MOST efficient way to capture the traffic without affecting the instance's performance?

Accepted Answer

Use VPC Traffic Mirroring to mirror the instance's network traffic.. VPC Traffic Mirroring allows you to copy network traffic from an EC2 instance to a monitoring appliance without impacting the instance. Option A (tcpdump) is intrusive. Option B (VPC Flow Logs) captures metadata, not full packets. Option D (Network Load Balancer) forwards traffic but is not designed for forensic capture.

Answer

Enable VPC Flow Logs for the subnet.

Answer

SSH into the instance and run tcpdump to capture packets.

Answer

Attach a Network Load Balancer in front of the instance.

Question 6

A company has an incident response (IR) process that includes isolating compromised EC2 instances. During a security incident, the IR team needs to block all traffic to and from a compromised instance while preserving the instance for forensic analysis. Which approach should the team take?

Accepted Answer

Modify the security group associated with the instance to remove all inbound and outbound rules.. Modifying the security group to deny all traffic is the quickest way to isolate an instance while keeping it running. Detaching the instance stops it and may lose volatile data. Deleting the instance destroys evidence. Changing network ACLs affects the entire subnet, not just the instance.

Answer

Detach the instance from the Auto Scaling group and stop it.

Answer

Update the network ACL for the subnet to deny all traffic.

Answer

Terminate the instance immediately.

Question 7

A security engineer is configuring automated response to a GuardDuty finding of type 'UnauthorizedAccess:EC2/SSHBruteForce'. The engineer needs to isolate the compromised instance by modifying the security group to deny all inbound traffic. Which AWS service should be used to orchestrate this response?

Accepted Answer

AWS Systems Manager Automation. Option A is correct because AWS Systems Manager Automation can run a runbook to modify security group rules in response to a GuardDuty finding via EventBridge. Option B is wrong because Lambda can be used but is not the orchestration service; it is a compute service. Option C is wrong because Config is for compliance, not response. Option D is wrong because CloudFormation is for infrastructure provisioning, not real-time response.

Answer

AWS Lambda

Answer

AWS CloudFormation

Answer

AWS Config

Question 8

A company uses AWS Organizations and wants to implement a centralized incident response process. Which THREE steps should be taken to ensure that security teams can respond to incidents across all accounts effectively?

Accepted Answer

Create IAM roles in each member account that grant incident responders cross-account access from the security account. Option A (delegated administrator for GuardDuty) centralizes findings. Option C (centralized S3 bucket for CloudTrail logs) enables log analysis. Option D (cross-account IAM roles) allows incident responders to access affected accounts. Option B (single CloudTrail trail in management account) is not sufficient; organization trail logs all accounts. Option E (separate Incident Manager per account) is not centralized.

Answer

Set up AWS Systems Manager Incident Manager in each account independently

Answer

Create a single CloudTrail trail in the management account to log events from all accounts

Question 9

A security engineer is investigating a potential data exfiltration from an S3 bucket. The engineer has enabled S3 server access logs and CloudTrail data events. Which log source would provide the most granular details about the request, including the requester's IP address and user agent?

Accepted Answer

Amazon S3 server access logs. S3 server access logs provide detailed records of each request, including requester IP, user agent, and operation. CloudTrail data events also log S3 operations but may not include the user agent. VPC Flow Logs capture network traffic but not application-level details. AWS CloudWatch Logs is not the source.

Answer

VPC Flow Logs

Answer

AWS CloudTrail data events

Answer

Amazon CloudWatch Logs

Question 10

A security engineer is investigating a potential data breach. AWS CloudTrail logs show that an IAM user 'svc-backup' created an S3 bucket in the us-east-1 region and then uploaded a large number of objects. The engineer suspects that the user's credentials were compromised. What is the MOST efficient way to quickly identify the source IP address and user agent of the API calls made by this user?

Accepted Answer

Query AWS CloudTrail logs in Amazon Athena for the user's API calls.. Option B is correct because CloudTrail logs contain the sourceIPAddress and userAgent fields for each API call, which can be queried using CloudTrail Insights or Athena to identify the source. Option A is wrong because VPC Flow Logs capture network traffic but do not include IAM user information. Option C is wrong because GuardDuty detects threats but does not store historical API call details. Option D is wrong because Config records resource configuration changes but not API call source details.

Answer

Analyze VPC Flow Logs for traffic to the S3 bucket.

Answer

Enable Amazon GuardDuty and review the generated findings.

Answer

Use AWS Config to review the configuration history of the S3 bucket.

Question 11

A company uses AWS Organizations with multiple accounts. The security team wants to centrally collect and analyze VPC Flow Logs from all accounts. The team has set up a central logging account with an S3 bucket that has a bucket policy allowing cross-account writes. However, VPC Flow Logs from member accounts are not appearing. What is the most likely cause?

Accepted Answer

VPC Flow Logs cannot be published directly to an S3 bucket in a different account. The logs must be published to a bucket in the same account as the VPC, and then replicated to the central account.. Option A is correct because VPC Flow Logs can be published to Amazon S3 only if the log group and stream are in the same account as the VPC; cross-account publishing is not supported directly. Option B is wrong because CloudTrail is not involved in Flow Log collection. Option C is wrong because S3 bucket policies are not the issue as they allow cross-account writes. Option D is wrong because Flow Logs can be published to a central bucket via cross-account delivery with proper permissions, but the key point is that the bucket must be in the same account as the VPC or use S3 replication.

Answer

AWS CloudTrail is not enabled in the member accounts.

Answer

The VPC Flow Logs must be delivered to CloudWatch Logs first, then exported to S3.

Answer

The S3 bucket policy does not allow the s3:PutObject action for the member accounts.

Question 12

Which THREE steps should a security engineer take to ensure that an incident response plan for an AWS environment is effective? (Choose three.)

Accepted Answer

Regularly test the incident response plan through tabletop exercises and simulations.. Options A, B, and C are correct. Testing the plan via simulations (A) validates its effectiveness. Automating containment actions (B) reduces response time. Documenting procedures and contacts (C) ensures clarity. Option D is wrong because using the root user for incident response is a security risk. Option E is wrong because storing evidence in public S3 buckets is insecure.

Answer

Use the AWS account root user for incident response actions to ensure full permissions.

Answer

Store all evidence in an S3 bucket with public read access for easy sharing.

Question 13

A security team wants to automatically revoke public access to an S3 bucket when Amazon GuardDuty detects a suspicious API call from a known malicious IP address. Which AWS service should be used to orchestrate this automated response?

Accepted Answer

AWS Systems Manager Automation. AWS Systems Manager Automation can run a runbook to change the S3 bucket policy. GuardDuty can send findings to Amazon EventBridge, which triggers the automation. Option A (Lambda) is possible but Systems Manager is more structured for runbooks. Option B (Config) is reactive. Option D (CloudTrail) is logging.

Answer

AWS Config

Answer

AWS Lambda

Answer

AWS CloudTrail

Question 14

A security engineer is configuring AWS CloudWatch Logs to monitor for suspicious activity. They want to create a metric filter that detects when an IAM user calls the `iam:CreateAccessKey` API. The engineer writes the following filter pattern: `{ ($.eventName = "CreateAccessKey") }`. After testing, the filter does not trigger. What is the most likely reason?

Accepted Answer

The filter pattern does not include the eventSource field, so it might match events from other services.. CloudTrail logs are JSON objects. The filter pattern must match the JSON structure. The correct pattern should include the eventSource or use the proper path. Typically, the pattern should be `{ ($.eventSource = "iam.amazonaws.com") && ($.eventName = "CreateAccessKey") }`. Without eventSource, the filter may match other services with the same event name.

Answer

The filter pattern syntax is incorrect; it should use square brackets.

Answer

The metric filter is not associated with the correct log group.

Answer

CloudWatch Logs does not support metric filters for CloudTrail logs.

Question 15

A company uses AWS CloudTrail to log all API calls. During an incident investigation, the security team needs to identify who deleted an S3 bucket. CloudTrail logs are stored in a centralized S3 bucket with server-side encryption using AWS KMS. Which additional step is required to ensure the CloudTrail logs can be queried quickly for this investigation?

Accepted Answer

Use Amazon Athena with a table defined over the S3 bucket. Option D is correct because CloudTrail logs are JSON files, and Athena can query them directly using DDL and DML. Option A is wrong because CloudTrail Lake is a managed query service but not necessary if logs are in S3; Athena is more direct. Option B is wrong because CloudWatch Logs Insights queries CloudWatch Logs, not S3 objects. Option C is wrong because GuardDuty is for threat detection, not log query.

Answer

Enable CloudTrail Lake

Answer

Stream logs to CloudWatch Logs and use CloudWatch Logs Insights

Answer

Enable Amazon GuardDuty

SCS-C02 Practice Test 16 — 15 Questions

Exhibit

SCS-C02 Practice Test 16 — 15 Questions

Exhibit