SCS-C02 Practice Test 21 — 15 Questions

Question 1

A company wants to monitor for unauthorized API calls in real-time. The solution must meet the following requirements: - Detect calls that fail authentication (AccessDenied). - Detect calls that use a revoked IAM role. - Provide a centralized view across multiple accounts. Which THREE services should be used together to implement this solution? (Choose three.)

Accepted Answer

AWS Organizations. Options A, B, and E are correct because CloudTrail logs API calls, CloudWatch Logs can filter for specific error codes, and AWS Organizations enables centralized management across accounts. Option C is wrong because AWS Config does not monitor API calls. Option D is wrong because IAM Access Analyzer analyzes resource policies, not API calls.

Answer

AWS IAM Access Analyzer

Answer

AWS Config

Question 2

A company wants to receive notifications when AWS CloudTrail logs are delivered to an S3 bucket. Which TWO AWS services can be used together to achieve this? (Choose TWO.)

Accepted Answer

Amazon S3 Event Notifications. S3 Event Notifications can be sent to SNS, which can then send notifications. SQS is for queueing, not direct notifications. CloudWatch Events (now Amazon EventBridge) can also trigger on S3 events. CloudTrail does not send notifications directly.

Answer

AWS CloudTrail

Answer

AWS Lambda

Answer

Amazon Simple Queue Service (SQS)

Question 3

A security engineer is configuring VPC Flow Logs for a VPC that hosts a web application. The engineer wants to capture all traffic to and from the internet. Which of the following is the most appropriate configuration?

Accepted Answer

Configure Flow Logs at the VPC level and publish to CloudWatch Logs with a log group name.. Option C is correct because VPC Flow Logs can capture all traffic types, including accepted and rejected traffic. Option A is incorrect because Flow Logs can capture both accepted and rejected traffic. Option B is incorrect because Flow Logs can be published to CloudWatch Logs or S3. Option D is incorrect because Flow Logs are not real-time; they are published periodically.

Answer

Configure Flow Logs at the subnet level and set the traffic type to 'Reject'.

Answer

Configure Flow Logs at the VPC level and set the traffic type to 'All'.

Answer

Configure Flow Logs at the subnet level and set the traffic type to 'Accepted'.

Question 4

A company is using Amazon GuardDuty to detect threats. The security team notices that GuardDuty findings are not triggering the intended automated response via a CloudWatch Events rule. What is the most likely reason?

Accepted Answer

The CloudWatch Events rule's event pattern does not match the GuardDuty finding event structure.. Option D is correct because GuardDuty sends findings as custom events in the 'aws.guardduty' source; the CloudWatch Events rule must have an event pattern that matches this source and detail type. Option A is incorrect because GuardDuty does not require VPC Flow Logs to generate findings. Option B is incorrect because GuardDuty findings are generated in the region where GuardDuty is enabled; cross-region aggregation is not a common issue. Option C is incorrect because IAM roles are not required for CloudWatch Events to trigger a Lambda function; Lambda needs a role to execute, but that wouldn't prevent the event from triggering.

Answer

The GuardDuty detector is in a different region than the CloudWatch Events rule.

Answer

The Lambda function invoked by CloudWatch Events does not have an IAM role assigned.

Answer

VPC Flow Logs are not enabled.

Question 5

Which THREE actions can be performed using AWS CloudTrail to enhance security monitoring?

Accepted Answer

Detect unauthorized API calls by analyzing CloudTrail logs.. Options A, C, and E are correct. CloudTrail logs can be used to detect unusual API activity, monitor IAM user activity, and track S3 bucket policy changes. Option B is incorrect because CloudTrail does not capture operating system logs. Option D is incorrect because CloudTrail does not capture network traffic.

Answer

Monitor SSH login attempts to EC2 instances.

Answer

Capture all network traffic to and from EC2 instances.

Question 6

Which TWO actions are valid ways to send application logs from an EC2 instance to Amazon CloudWatch Logs? (Select TWO.)

Accepted Answer

Install and configure the unified CloudWatch agent on the EC2 instance.. Options A and D are correct. Option A: The unified CloudWatch agent can collect logs and send to CloudWatch Logs. Option D: The older CloudWatch Logs agent (awslogs) can also send logs. Option B is wrong because CloudTrail is for API logging, not application logs. Option C is wrong because S3 does not directly send to CloudWatch Logs. Option E is wrong because VPC Flow Logs are for network traffic.

Answer

Configure the EC2 instance to stream syslog to AWS CloudTrail.

Answer

Write logs to an S3 bucket and use S3 event notifications to send to CloudWatch Logs.

Answer

Enable VPC Flow Logs to capture application traffic.

Question 7

A security analyst wants to monitor unsuccessful login attempts to the AWS Management Console. Which AWS service and log combination should be used?

Accepted Answer

AWS CloudTrail.. AWS CloudTrail logs console sign-in events, including failed attempts. The ConsoleLogin event with a failure status is logged. Option A is wrong because S3 access logs track object-level access. Option B is wrong because VPC Flow Logs track network traffic. Option C is wrong because CloudWatch Logs is a destination, not a source of login events.

Answer

Amazon S3 server access logs.

Answer

VPC Flow Logs.

Answer

Amazon CloudWatch Logs.

Question 8

Refer to the exhibit. A security engineer finds this S3 bucket policy on a bucket that should be private. What is the most effective way to detect if this bucket was accessed by unauthorized users?

Accepted Answer

Query AWS CloudTrail for GetObject API calls.. CloudTrail logs S3 API calls, including GetObject, and can be used to identify who accessed the bucket. Option A is wrong because S3 server access logs are not enabled by default. Option B is wrong because VPC Flow Logs do not capture S3 API calls. Option C is wrong because CloudWatch Logs does not capture S3 API calls directly.

Answer

Enable S3 server access logs on the bucket.

Answer

Use CloudWatch Logs to search for GetObject events.

Answer

Analyze VPC Flow Logs for traffic to the bucket.

Question 9

A company has a CloudTrail trail that logs management events for all regions in the management account. They want to also log data events for all S3 buckets in the organization. Which configuration change will meet this requirement with the LEAST operational overhead?

Accepted Answer

Modify the existing trail to add an event selector for S3 data events with a scope of all buckets.. Option C is correct because a single organization trail can log data events for all S3 buckets across all accounts in the organization. Option A is wrong because creating a new trail in each member account adds overhead. Option B is wrong because CloudTrail supports data events for S3 buckets without needing an event selector per bucket; you can select all buckets. Option D is wrong because CloudWatch Events is not needed; CloudTrail is the correct service.

Answer

Use Amazon EventBridge to capture S3 events and forward them to CloudTrail.

Answer

Enable S3 server access logs for all buckets and aggregate them using Athena.

Answer

Create a new trail in each member account to log S3 data events and deliver to a central S3 bucket.

Question 10

A company needs to centralize security logs from multiple AWS accounts and on-premises servers. The logs must be encrypted at rest and stored in a cost-effective manner. Which solution meets these requirements?

Accepted Answer

Use Amazon S3 with server-side encryption (SSE-S3). Amazon S3 with SSE-S3 provides cost-effective encrypted storage. CloudWatch Logs is more expensive. Kinesis Firehose can deliver to S3 but adds cost. Glacier is for archival, not active logging.

Answer

Use Amazon S3 Glacier with Vault Lock

Answer

Use Amazon Kinesis Data Firehose to deliver logs to Amazon Redshift

Answer

Use Amazon CloudWatch Logs with KMS encryption

Question 11

A company wants to ensure that all API calls in their AWS account are logged and immutable. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Enable S3 Object Lock on the CloudTrail S3 bucket. CloudTrail logs API calls. To ensure immutability, S3 Object Lock prevents deletion or overwriting. MFA delete adds protection. Config does not prevent log tampering. KMS encrypts but does not prevent deletion.

Answer

Enable MFA delete on the S3 bucket

Answer

Use AWS Config rules to monitor CloudTrail configuration

Answer

Encrypt the S3 bucket with AWS KMS

Question 12

A company wants to detect and alert on unauthorized API calls in their AWS account. Which AWS service can provide real-time notifications when specific API calls are made?

Accepted Answer

Amazon CloudWatch Events (EventBridge). Option B is correct because CloudWatch Events (now Amazon EventBridge) can match patterns in CloudTrail events and trigger notifications. Option A is incorrect because AWS Config evaluates resource configurations, not API calls. Option C is incorrect because AWS Trusted Advisor provides recommendations, not real-time alerts. Option D is incorrect because Amazon GuardDuty focuses on threat detection, not specific API call patterns.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 13

A security analyst needs to review all failed SSH login attempts to an EC2 instance. Which combination will provide this information?

Accepted Answer

Enable VPC Flow Logs for the subnet and query the logs in CloudWatch Logs Insights for rejected traffic on port 22.. Option B is correct because VPC Flow Logs capture network traffic metadata including destination port and action (accept/reject), and CloudWatch Logs Insights can query for SSH traffic (port 22) that was rejected. Option A is incorrect because CloudTrail logs API calls, not OS-level login attempts. Option C is incorrect because CloudWatch agent can collect OS logs but is not the simplest way; VPC Flow Logs are more straightforward. Option D is incorrect because Config does not monitor OS logs.

Answer

Use AWS Config to record EC2 instance configuration and check for security group changes.

Answer

Install the CloudWatch agent on the EC2 instance to collect /var/log/secure and stream to CloudWatch Logs.

Answer

Enable AWS CloudTrail and search for EC2-related events.

Question 14

An organization wants to detect and alert on any IAM user that creates a new access key without using multi-factor authentication (MFA). What is the MOST efficient way to achieve this?

Accepted Answer

Create a CloudWatch Events rule that triggers on CreateAccessKey events, and check if the user's MFA status is inactive.. Option B is correct because CloudTrail logs the CreateAccessKey API call, and a CloudWatch Events rule can trigger on this event and evaluate whether MFA was used (via the userIdentity details). Option A is wrong because IAM Access Analyzer is for analyzing resource policies, not monitoring API calls. Option C is wrong because Config rules can evaluate resource configurations, but detecting MFA usage during an API call is better done via CloudTrail. Option D is wrong because S3 server access logs do not capture API events.

Answer

Analyze S3 server access logs to detect access key creation.

Answer

Enable AWS Config managed rule for IAM user MFA, which monitors if users have MFA enabled.

Answer

Use IAM Access Analyzer to monitor for unused access keys.

Question 15

Which TWO AWS services can be used to centrally collect and analyze logs from multiple AWS accounts? (Select TWO.)

Accepted Answer

Amazon Athena (to query logs in S3). Options A and B are correct. Amazon S3 can be used as a central log destination, and Amazon Athena can query logs directly in S3. Option C is wrong because Amazon Inspector is for vulnerability assessment, not log analysis. Option D is wrong because AWS Config is for resource configuration tracking. Option E is wrong because AWS Shield is for DDoS protection.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS Shield