SCS-C02 Practice Test 22 — 15 Questions

Question 1

A company has a requirement to retain CloudTrail logs for 7 years to meet regulatory compliance. They want to minimize storage costs while ensuring logs are immutable and cannot be deleted by anyone, including the root user. What should they do?

Accepted Answer

Enable S3 Object Lock in Compliance mode on the destination bucket.. S3 Object Lock with Compliance mode ensures that objects cannot be deleted or overwritten by any user, including the root user, for the specified retention period. Governance mode allows some users to override. Option A is wrong because MFA Delete does not prevent deletion by root. Option C is wrong because S3 Glacier Deep Archive is a storage class, not immutability. Option D is wrong because CloudTrail does not provide immutability.

Answer

Configure the S3 bucket with MFA Delete enabled.

Answer

Use CloudTrail log file validation and enable AWS CloudTrail Insights.

Answer

Store the logs in Amazon S3 Glacier Deep Archive with a vault lock policy.

Question 2

A company is using AWS CloudTrail to log API calls and wants to ensure that log files are not tampered with after delivery to S3. Which feature should be enabled to validate the integrity of CloudTrail log files?

Accepted Answer

Enable CloudTrail log file validation. Option B is correct because CloudTrail log file validation creates a hash for each log file, allowing you to verify that the log files have not been modified. Option A is wrong because S3 Versioning helps recover from accidental deletion or overwriting, but does not validate integrity. Option C is wrong because S3 Server-Side Encryption encrypts data at rest, but does not provide integrity validation. Option D is wrong because MFA Delete adds an extra layer of protection for deletion, but does not validate integrity.

Answer

Enable MFA Delete on the S3 bucket

Answer

Enable S3 Versioning on the bucket

Answer

Enable S3 bucket default encryption

Question 3

A company is using Amazon Route 53 and wants to log DNS queries for investigative purposes. The logs must be stored in a centralized S3 bucket in the security account. What is the MOST efficient way to achieve this?

Accepted Answer

Configure Route 53 Resolver query logging to deliver to the central S3 bucket.. Option B is correct because Route 53 resolver query logs can be sent directly to S3, and by using AWS Organizations, you can centralize logging. Option A is wrong because CloudWatch Logs adds an extra step. Option C is wrong because VPC Flow Logs are for network traffic, not DNS queries. Option D is wrong because Route 53 does not have a built-in Lambda integration for this purpose.

Answer

Enable VPC Flow Logs and analyze DNS traffic.

Answer

Enable CloudWatch Logs for Route 53 and stream to a Lambda function that writes to S3.

Answer

Use a custom Lambda function to poll Route 53 logs and write to S3.

Question 4

A company wants to monitor failed SSH login attempts to EC2 instances. Which approach should be used?

Accepted Answer

Use the CloudWatch Logs agent to send /var/log/auth.log to CloudWatch Logs. Publish OS-level logs to CloudWatch Logs using the CloudWatch agent. CloudTrail does not capture OS login attempts. VPC Flow Logs capture network traffic, not OS events. Config is for resource compliance.

Answer

Enable AWS CloudTrail for EC2 instances

Answer

Enable VPC Flow Logs

Answer

Use AWS Config to detect SSH access

Question 5

Refer to the exhibit. The security team is investigating a security incident in us-west-2 region. They notice that management events from us-west-2 are not appearing in the CloudTrail logs. Based on the exhibit, what is the most likely reason?

Accepted Answer

The trail is not a multi-region trail. The trail is not multi-region (IsMultiRegionTrail: false), so it only logs events in us-east-1. Global service events are included but that does not capture other regions.

Answer

The S3 bucket is in a different region

Answer

The trail is not logging data events

Answer

The trail does not have log file validation enabled

Question 6

A security engineer is investigating a potential security incident. They suspect that an IAM user's credentials were compromised and used to launch EC2 instances in a region where the user normally does not operate. Which AWS service can help the engineer identify the source IP address and user agent of the API calls that launched the instances?

Accepted Answer

AWS CloudTrail. Option B is correct because AWS CloudTrail records all API calls with details like source IP address and user agent. Option A is incorrect because Amazon Inspector is for vulnerability assessment. Option C is incorrect because AWS CloudHSM is for hardware security modules. Option D is incorrect because AWS Artifact is for compliance reports.

Answer

AWS CloudHSM

Answer

Amazon Inspector

Answer

AWS Artifact

Question 7

A company wants to receive real-time notifications for every root user login to the AWS Management Console. Which service should be used?

Accepted Answer

Amazon CloudWatch Events. Option B is correct because CloudWatch Events can match the RootLogin event from CloudTrail and trigger an SNS notification. Option A is incorrect because CloudTrail itself does not send notifications. Option C is incorrect because GuardDuty may detect unusual root activity but is not designed for real-time notifications of all root logins. Option D is incorrect because AWS Config does not monitor root logins.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Config

Question 8

A security engineer needs to monitor for failed SSH login attempts to EC2 instances and send alerts. Which combination of AWS services should be used?

Accepted Answer

CloudWatch Logs agent on EC2, CloudWatch Logs metric filter, and CloudWatch Alarm.. Option A is correct because CloudWatch Logs agent can capture /var/log/secure (or auth.log) and send to CloudWatch Logs, which can then trigger a metric filter and alarm. Option B is wrong because CloudTrail does not capture OS-level logs. Option C is wrong because VPC Flow Logs capture network traffic, not SSH login attempts. Option D is wrong because S3 event notifications are for object-level events.

Answer

VPC Flow Logs and Amazon Athena.

Answer

AWS CloudTrail and Amazon SNS.

Answer

Amazon S3 event notifications and AWS Lambda.

Question 9

Refer to the exhibit. This is a line from a VPC Flow Log. A security analyst notices that the log shows an ACCEPT record for a connection from 10.0.1.5 to 10.0.2.10 on port 443. However, the analyst expected the connection to be denied. Which field in the flow log record indicates that the connection was accepted?

Accepted Answer

The action field (ACCEPT). Option D is correct. The 11th field (ACCEPT) is the action field, which indicates whether the traffic was accepted or rejected. Option A is wrong because the version field (1st field) is 2. Option B is wrong because the protocol field (7th field) is 6 (TCP). Option C is wrong because the destination port (5th field) is 443.

Answer

The version field (2)

Answer

The protocol field (6)

Answer

The destination port field (443)

Question 10

A company uses Amazon GuardDuty and wants to automatically isolate a compromised EC2 instance by removing it from the security group. Which approach should be used?

Accepted Answer

Create an Amazon EventBridge rule that triggers an AWS Lambda function to remove the instance from the security group.. GuardDuty can send findings to EventBridge, which triggers a Lambda function to modify the security group. Option A is wrong because GuardDuty does not have native remediation actions. Option C is wrong because Systems Manager Automation is possible but requires a runbook. Option D is wrong because AWS Config does not react to GuardDuty findings.

Answer

Set up an AWS Config rule to detect the finding and remediate.

Answer

Configure GuardDuty to directly modify the security group.

Answer

Use AWS Systems Manager Automation to automatically modify the security group based on GuardDuty findings.

Question 11

A company wants to monitor CPU utilization of their EC2 instances and receive an alert when utilization exceeds 80% for 5 consecutive minutes. Which AWS service should be used to set up this metric alarm?

Accepted Answer

Amazon CloudWatch Alarms. Option A is correct because CloudWatch Alarms can monitor any CloudWatch metric and trigger actions when a threshold is breached. Option B is wrong because AWS CloudTrail logs API calls. Option C is wrong because AWS Config monitors configuration changes. Option D is wrong because Amazon Inspector is a vulnerability assessment service.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS CloudTrail

Question 12

A company uses AWS CloudTrail to log all API calls. The security team notices that some PutObject API calls are not appearing in the CloudTrail logs. The S3 bucket in question has server access logging enabled. What is the MOST likely reason for the missing CloudTrail events?

Accepted Answer

CloudTrail was not configured to log data events for S3.. Option A is correct because CloudTrail data events for S3 must be explicitly enabled; by default, only management events are logged. Option B is wrong because server access logs are separate from CloudTrail. Option C is wrong because S3 events are logged regardless of whether the request is from the console or CLI. Option D is wrong because the bucket policy does not affect CloudTrail logging; CloudTrail logs all API calls that it is configured to log.

Answer

Server access logs are interfering with CloudTrail.

Answer

The PutObject calls were made via the AWS Management Console.

Answer

The S3 bucket policy denies CloudTrail from logging.

Question 13

A company uses AWS WAF to protect a web application. The security team needs to analyze blocked requests to identify attack patterns. Which service should be used to query and visualize WAF logs?

Accepted Answer

Amazon Athena. Amazon Athena can query WAF logs stored in S3. CloudWatch Logs Insights is for CloudWatch Logs, not directly for S3. QuickSight can visualize but cannot query directly. WAF does not have a built-in query service.

Answer

Amazon CloudWatch Logs Insights

Answer

Amazon QuickSight

Answer

AWS WAF console

Question 14

Refer to the exhibit. A security engineer creates this CloudWatch Logs metric filter on a CloudTrail log group to detect root account usage. However, no metrics are generated. What is the most likely issue?

Accepted Answer

The metric filter pattern is incorrectly formatted. The filter pattern syntax is incorrect. CloudWatch Logs filter patterns for JSON use a different syntax, e.g., { ($.userIdentity.type = "Root") }. The backslashes are not needed.

Answer

The log group does not exist

Answer

CloudTrail is not enabled for the account

Answer

The metric namespace is invalid

Question 15

Which TWO actions should a security engineer take to ensure that Amazon GuardDuty can effectively monitor for suspicious activity in a VPC? (Choose two.)

Accepted Answer

Enable DNS query logging and publish to CloudWatch Logs.. Option B is correct because GuardDuty can analyze VPC Flow Logs for network activity. Option C is correct because GuardDuty can analyze DNS logs for suspicious domain queries. Option A is incorrect because CloudTrail management events are already analyzed by GuardDuty, but enabling data events is not necessary. Option D is incorrect because GuardDuty does not analyze Config history. Option E is incorrect because GuardDuty does not analyze S3 access logs directly.

Answer

Enable CloudTrail data events for S3.

Answer

Enable S3 server access logs.

Answer

Enable AWS Config configuration history.