SCS-C02 Practice Test 19 — 15 Questions

Question 1

A security engineer is investigating a potential security incident involving an EC2 instance that was used to launch an outbound DDoS attack. The engineer needs to determine the source of the attack and the commands executed on the instance. Which logs should be analyzed?

Accepted Answer

EC2 instance OS logs (e.g., /var/log/secure) and CloudTrail logs for API calls that launched the instance. Option A is correct because EC2 instance logs (OS logs) capture commands executed on the instance. Option B is wrong because VPC Flow Logs only show network traffic, not commands. Option C is wrong because CloudTrail logs API calls, not OS commands. Option D is wrong because S3 access logs track S3 access, not EC2 activity.

Answer

VPC Flow Logs and Network ACL logs

Answer

S3 server access logs and CloudWatch Logs

Answer

AWS CloudTrail and AWS Config history

Question 2

A company has enabled AWS CloudTrail in all regions and is delivering logs to a central S3 bucket. The security team needs to ensure that any attempt to delete or modify CloudTrail logs is detected and alerted. What should be done?

Accepted Answer

Enable S3 Object Lock in governance mode on the bucket.. Option D is correct because enabling S3 Object Lock on the bucket prevents deletion or modification of log files. Option A is wrong because MFA Delete alone does not prevent deletion by authorized users. Option B is wrong because S3 server access logs track access but do not prevent deletion. Option C is wrong because bucket policies cannot prevent deletion by the bucket owner.

Answer

Enable S3 server access logging on the bucket and monitor for DELETE requests.

Answer

Enable MFA Delete on the S3 bucket.

Answer

Use a bucket policy that denies s3:DeleteObject for all principals.

Question 3

A company uses AWS Organizations and wants to enforce that all member accounts enable VPC Flow Logs for all VPCs. Which THREE services or features should be used to enforce this policy automatically?

Accepted Answer

AWS Organizations Service Control Policies (SCPs). Options A, B, and D are correct because AWS Organizations can use SCPs to restrict actions, AWS Config Rules can evaluate compliance, and AWS CloudFormation StackSets can deploy VPC Flow Logs across accounts. Option C is wrong because AWS CloudTrail records API calls, not resource configurations. Option E is wrong because AWS Service Catalog is for creating and managing IT services, not for enforcing logging.

Answer

AWS Service Catalog

Answer

AWS CloudTrail

Question 4

A security engineer needs to detect when an EC2 instance is terminated in an AWS account. The solution must provide near-real-time notification. Which combination of services should be used?

Accepted Answer

AWS CloudTrail and Amazon EventBridge. Option C is correct because CloudTrail logs the TerminateInstances API call, and CloudWatch Events (now Amazon EventBridge) can match the event and trigger a notification via SNS. Option A is wrong because AWS Config evaluates configuration changes, but it is not near-real-time for API calls. Option B is wrong because VPC Flow Logs do not capture EC2 instance termination. Option D is wrong because CloudWatch Alarms monitor metrics, not API calls.

Answer

VPC Flow Logs and Amazon CloudWatch Logs

Answer

AWS Config and Amazon SNS

Answer

Amazon CloudWatch Alarms and Amazon SNS

Question 5

A company has a CloudTrail trail that logs management events for all regions. The security team notices that some S3 data events are not being logged. How should the team enable logging for all S3 data events?

Accepted Answer

Update the existing CloudTrail trail to include data events for S3. CloudTrail data events must be explicitly enabled. The existing trail can be updated to include data events. Creating a new trail with management events only would not capture data events. S3 server access logs are separate.

Answer

Create a new CloudTrail trail that logs only data events

Answer

Use Amazon GuardDuty to monitor S3 access

Answer

Enable S3 server access logging on each bucket

Question 6

A company uses AWS CloudTrail to log all API calls in their AWS account. They need to ensure that log files are not tampered with after they are delivered to the S3 bucket. Which feature should be enabled to provide integrity validation?

Accepted Answer

Enable CloudTrail log file integrity validation.. Option B is correct because CloudTrail log file integrity validation uses SHA-256 hashing and digital signatures to verify that log files have not been altered. Option A is incorrect because server-side encryption (SSE-S3) only encrypts data at rest, not integrity. Option C is incorrect because S3 Versioning helps preserve object versions but does not validate integrity. Option D is incorrect because S3 Object Lock prevents deletion but not modification detection.

Answer

Enable S3 Versioning on the CloudTrail bucket.

Answer

Enable S3 server-side encryption with SSE-S3.

Answer

Enable S3 Object Lock on the CloudTrail bucket.

Question 7

Which THREE are best practices for securing AWS CloudTrail log files? (Choose three.)

Accepted Answer

Restrict access to the S3 bucket using a bucket policy that requires MFA and encryption.. Option A is correct because encrypting logs at rest protects confidentiality. Option C is correct because enabling log file integrity validation ensures tamper detection. Option D is correct because limiting access to the S3 bucket using bucket policies ensures only authorized principals can access logs. Option B is incorrect because CloudTrail logs should be retained for at least one year, not 30 days. Option E is incorrect because CloudTrail does not support cross-region delivery to a single bucket automatically without additional configuration.

Answer

Deliver logs to an S3 bucket in the same region as the trail.

Answer

Set a lifecycle policy to delete logs after 30 days.

Question 8

A company is using Amazon Macie to discover sensitive data in S3. The security team wants to be notified when Macie finds a high-severity alert. Which integration should be used?

Accepted Answer

Create an Amazon EventBridge rule that matches Macie findings and targets an SNS topic.. Option D is correct because Macie can publish findings to Amazon EventBridge (formerly CloudWatch Events), which can then trigger SNS notifications. Option A is incorrect because Macie does not send to CloudWatch Logs directly. Option B is incorrect because Macie does not send to S3 directly; it stores findings in its own service. Option C is incorrect because Macie does not natively integrate with Security Hub for alerting; EventBridge is the direct method.

Answer

Configure Macie to store findings in an S3 bucket and enable S3 event notifications.

Answer

Integrate Macie with AWS Security Hub and create a custom action to send to SNS.

Answer

Configure Macie to send findings to CloudWatch Logs and create a metric filter.

Question 9

An organization has a requirement to retain all security logs for at least 7 years for compliance. The logs are stored in Amazon S3 and are rarely accessed. Which storage class is the MOST cost-effective for this retention period?

Accepted Answer

S3 Glacier Deep Archive. Option C is correct because S3 Glacier Deep Archive is designed for long-term retention of data that is accessed rarely, with a retrieval time of 12 hours, and is the lowest cost storage class. Option A is wrong because S3 Standard is for frequently accessed data and is expensive. Option B is wrong because S3 Intelligent-Tiering is for data with unknown access patterns but still not cheapest for 7 years. Option D is wrong because S3 One Zone-IA is for infrequent access but not designed for long-term archival.

Answer

S3 Standard

Answer

S3 One Zone-IA

Answer

S3 Intelligent-Tiering

Question 10

A security engineer notices that S3 server access logs are not being delivered to the specified destination bucket. The source bucket has a bucket policy that grants s3:PutObject permission to the Log Delivery group. The destination bucket is in the same AWS account but a different region. What is the most likely cause of the failure?

Accepted Answer

The destination bucket is in a different AWS region.. S3 server access logs cannot be delivered to a bucket in a different region; the destination bucket must be in the same region as the source bucket. Option A is wrong because cross-account delivery is possible with proper permissions. Option B is wrong because no additional IAM role is needed for server access logs. Option D is wrong because enabling versioning is not required for log delivery.

Answer

The destination bucket does not have versioning enabled.

Answer

The destination bucket is in a different AWS account.

Answer

The Log Delivery group does not have an IAM role assigned.

Question 11

A security engineer is investigating a possible data exfiltration from an S3 bucket. Which THREE AWS services can be used to detect and alert on suspicious activity? (Choose THREE.)

Accepted Answer

Amazon GuardDuty. Option A is correct: CloudTrail can log S3 API calls. Option C is correct: GuardDuty can detect suspicious S3 activity. Option D is correct: Macie can identify sensitive data and anomalous access patterns. Option B is wrong because CloudWatch Logs is a log destination, not a detection service. Option E is wrong because AWS Config is for configuration compliance, not threat detection.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 12

A security engineer is troubleshooting why CloudTrail logs are not being delivered to an S3 bucket. The bucket policy allows CloudTrail to write objects, and the trail is configured to log management events. However, no log files appear in the bucket. What is the MOST likely cause?

Accepted Answer

The S3 bucket uses SSE-KMS encryption and the trail does not have permission to use the KMS key.. Option C is correct because if the S3 bucket is using SSE-KMS encryption, CloudTrail requires explicit permissions to use the KMS key. Option A is wrong because CloudTrail can deliver logs to buckets in different accounts with proper cross-account permissions. Option B is wrong because management events are logged by default. Option D is wrong because the bucket policy is not missing.

Answer

The trail is not logging data events.

Answer

The S3 bucket is in a different AWS account.

Answer

The bucket policy is missing a Deny statement.

Question 13

A security engineer is investigating a potential security incident. The engineer has enabled CloudTrail and VPC Flow Logs. Which THREE pieces of information can the engineer obtain from CloudTrail logs that are NOT available in VPC Flow Logs? (Choose three.)

Accepted Answer

The AWS Region where the API call was made.. Options A, B, and D are correct because CloudTrail logs API calls, including details like the IAM user who made the call, the source IP address (could be the same as flow logs but identity is unique), and the AWS region of the API endpoint. Options C and E are wrong because packet payloads are not logged by either service, and VPC Flow Logs provide network traffic metadata (source/destination IP, ports, protocol) not available in CloudTrail.

Answer

The payload of the API request.

Answer

The destination IP address and port of the network traffic.

Question 14

A company uses AWS Organizations to manage multiple accounts. The security team wants to enable CloudTrail for all accounts and centrally store logs. What is the most efficient way to achieve this?

Accepted Answer

Create a CloudTrail trail in the management account and apply it to all accounts in the organization. AWS Organizations can create a trail in the management account that logs all accounts. Deleting existing trails is not required. Each account creating its own trail is inefficient. S3 bucket policy alone does not enable logging.

Answer

Use an S3 bucket policy to allow cross-account log delivery

Answer

Use AWS Lambda to create trails in each account

Answer

Ask each account admin to create their own CloudTrail trail and deliver to a central S3 bucket

Question 15

A company has a multi-account AWS environment using AWS Organizations. The security team wants to centralize all CloudTrail logs from all accounts into a single S3 bucket in the management account. The bucket policy allows cross-account access. However, logs from member accounts are not being delivered. What is the most likely cause?

Accepted Answer

The S3 bucket policy does not grant `s3:PutObject` permission to the member accounts.. Option B is correct because CloudTrail in member accounts must have permissions via a bucket policy that grants the `s3:PutObject` action. Option A is incorrect because CloudTrail is enabled by default for the last 90 days, but that is not related to delivery. Option C is incorrect because CloudTrail supports delivering logs to another account's S3 bucket. Option D is incorrect because CloudTrail logs are delivered to a prefix, not a separate bucket.

Answer

CloudTrail cannot deliver logs to a bucket in a different account.

Answer

The S3 bucket is not configured with a CloudTrail prefix.

Answer

CloudTrail is not enabled in the member accounts.