SCS-C02 Practice Test 24 — 15 Questions

Question 1

A company uses AWS CloudTrail and wants to ensure that logs are encrypted at rest using a customer-managed KMS key. The CloudTrail trail is configured to deliver logs to an S3 bucket. After enabling SSE-KMS on the S3 bucket, the logs are not being delivered. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant CloudTrail permission to use the key.. Option A is correct because CloudTrail needs explicit permissions to use the KMS key for encrypting log files. Option B is incorrect because CloudTrail can use KMS keys from other accounts. Option C is incorrect because CloudTrail supports SSE-KMS. Option D is incorrect because bucket policies for CloudTrail must allow `s3:PutObject`.

Answer

CloudTrail does not support SSE-KMS.

Answer

The KMS key is in a different AWS account.

Answer

The S3 bucket policy does not allow CloudTrail to write logs.

Question 2

A company has enabled AWS CloudTrail in all accounts and regions, with log file validation enabled. The security team needs to verify that a specific log file has not been modified since it was delivered. Which action should be taken?

Accepted Answer

Use the AWS CLI `validate-logs` command with the digest file from the S3 bucket.. Option A is correct because CloudTrail provides a digest file that contains a hash of each log file; you can use the AWS CLI command `aws cloudtrail validate-logs` to verify integrity. Option B is incorrect because S3 server-side encryption does not provide integrity verification. Option C is incorrect because CloudWatch Logs Insights does not validate log file integrity. Option D is incorrect because S3 Object Lock prevents deletion but not modification of existing objects; it does not verify integrity against a digest.

Answer

Query the log files using Amazon CloudWatch Logs Insights.

Answer

Enable S3 server-side encryption with AWS KMS (SSE-KMS) on the CloudTrail bucket.

Answer

Enable S3 Object Lock on the bucket to prevent modifications.

Question 3

A company uses AWS Organizations and wants to centralize security logs from all member accounts into a single S3 bucket in the management account. The bucket policy allows only the management account's root user to write objects. However, logs are not being delivered from member accounts. What is the MOST likely cause?

Accepted Answer

The bucket policy denies write access to all principals except the management account's root user, preventing cross-account writes.. Option D is correct because S3 bucket policies that restrict writes to a specific root user will deny cross-account writes even if the logging service assumes a role. The logging service (e.g., CloudTrail, Config) in a member account must be able to write to the central bucket; the bucket policy must grant permissions to the logging service's service principal or to the member account. Option A is wrong because S3 Transfer Acceleration is not required. Option B is wrong because KMS key policies might be an issue, but the question states the bucket policy is the restriction. Option C is wrong because VPC endpoints are not required for logging.

Answer

S3 Transfer Acceleration is not enabled.

Answer

VPC endpoints are not configured for the logging service.

Answer

The S3 bucket uses an AWS KMS key, and the key policy does not grant decrypt permissions to the logging service.

Question 4

Refer to the exhibit. A security engineer configured this S3 bucket policy to allow CloudTrail to deliver logs. However, logs are not being delivered. What is the MOST likely reason?

Accepted Answer

The policy is missing s3:GetBucketAcl permission for CloudTrail.. Option B is correct. The bucket policy must also grant the GetBucketAcl permission for CloudTrail to verify bucket ownership. Without s3:GetBucketAcl, CloudTrail cannot validate the bucket and will not deliver logs. Option A is wrong because the Principal is correct. Option C is wrong because the action is PutObject, not GetObject. Option D is wrong because the resource pattern includes the prefix.

Answer

The Resource should be arn:aws:s3:::my-trail-bucket/*, not with AWSLogs prefix.

Answer

The Principal is set to a service, but must be an AWS account ID.

Answer

The Action should be s3:GetObject, not s3:PutObject.

Question 5

A security engineer is investigating a potential security incident and needs to determine if an EC2 instance was launched with a specific AMI ID. Which AWS log should be examined?

Accepted Answer

AWS CloudTrail. CloudTrail logs API calls, including RunInstances, which contains the AMI ID. Option A is wrong because VPC Flow Logs do not contain instance metadata. Option B is wrong because CloudWatch Logs does not capture EC2 launch events by default. Option D is wrong because AWS Config records resource configurations but not the API call details.

Answer

AWS Config timeline

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs (EC2 agent logs)

Question 6

A security team notices that an S3 bucket containing sensitive data has been repeatedly accessed from an IP address outside the company's network. They need to set up a real-time alert when such access occurs. Which combination of services should they use?

Accepted Answer

Amazon GuardDuty and Amazon EventBridge. Option D is correct because Amazon GuardDuty can analyze CloudTrail management events and S3 data events to detect suspicious activity, and it can send alerts to Amazon EventBridge, which can trigger a notification. Option A is wrong because AWS Config evaluates resource configurations, not real-time access patterns. Option B is wrong because VPC Flow Logs would not capture S3 access from outside the VPC. Option C is wrong because CloudWatch Logs Insights is used for querying logs, not for real-time alerting on its own.

Answer

VPC Flow Logs and Amazon QuickSight

Answer

AWS Config and Amazon SNS

Answer

CloudWatch Logs Insights and Amazon SES

Question 7

A company is using AWS CloudTrail and wants to detect when an IAM user performs a specific action, such as stopping an EC2 instance. The security engineer needs to set up a real-time notification. Which THREE steps should the engineer take? (Choose THREE.)

Accepted Answer

Create a metric filter in CloudWatch Logs to match the StopInstances event. Options A, B, and C are correct. Create a CloudTrail trail to log events, create a CloudWatch Logs metric filter to detect the specific API call (StopInstances), and create a CloudWatch alarm that triggers an SNS notification. Option D is wrong because Amazon Athena is used for querying data in S3, not for real-time alerting. Option E is wrong because Amazon QuickSight is for visualization, not alerting.

Answer

Use Amazon QuickSight to visualize CloudTrail logs

Answer

Use Amazon Athena to query CloudTrail logs in S3

Question 8

A security team wants to collect and analyze logs from multiple AWS services including CloudTrail, VPC Flow Logs, and AWS WAF. They need a centralized solution that can filter, transform, and route logs to multiple destinations in near real-time. Which AWS service should they use?

Accepted Answer

Amazon Kinesis Data Streams combined with Amazon Kinesis Data Firehose. Option D is correct because Amazon CloudWatch Logs subscription filter can send logs to Lambda for transformation, but not route to multiple destinations easily. Option A is correct because Amazon Kinesis Data Streams can ingest logs and then use Kinesis Data Analytics for transformation and Kinesis Data Firehose for routing to multiple destinations. Option B is incorrect because S3 is a storage destination, not a processing and routing service. Option C is incorrect because CloudWatch Logs Insights is for querying, not real-time routing.

Answer

Amazon CloudWatch Logs Insights

Answer

Amazon CloudWatch Logs subscription filters with AWS Lambda

Answer

Amazon S3 with S3 Event Notifications

Question 9

A company wants to monitor for unauthorized changes to its Amazon S3 bucket policies. Which AWS service should be used to detect such changes?

Accepted Answer

AWS Config. Option C is correct because AWS Config has managed rules like 's3-bucket-policy-not-more-permissive' that can evaluate bucket policies. Option A is incorrect because CloudTrail logs API calls but does not evaluate policies. Option B is incorrect because GuardDuty detects threats but not policy compliance. Option D is incorrect because CloudWatch Logs Insights can query logs but is not proactive detection.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch Logs Insights

Question 10

A security engineer needs to capture all DNS queries made by EC2 instances in a VPC and send them to a security analytics tool. Which AWS service should be used to capture this traffic?

Accepted Answer

AWS Network Firewall. Option C is correct because VPC Flow Logs capture IP traffic metadata but not DNS queries. AWS CloudTrail does not capture DNS queries. Amazon GuardDuty is a threat detection service. AWS Network Firewall can capture DNS logs. Option A is wrong because VPC Flow Logs do not include DNS query details. Option B is wrong because CloudTrail records API calls, not DNS queries. Option D is wrong because GuardDuty uses DNS logs from other sources.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Question 11

Which THREE are features of Amazon GuardDuty that help with threat detection? (Select THREE.)

Accepted Answer

Analyzes VPC Flow Logs.. Options A, B, and D are correct. GuardDuty uses machine learning and threat intelligence to detect threats. It analyzes CloudTrail events, VPC Flow Logs, and DNS logs. Option C is wrong because GuardDuty does not analyze Config rules; that is AWS Config. Option E is wrong because GuardDuty does not inspect S3 object content; it analyzes S3 data events.

Answer

Analyzes AWS Config configuration history.

Answer

Analyzes S3 object content for malware.

Question 12

A company is using AWS Config to track resource changes. They want to receive notifications when a security group is modified to allow inbound traffic from 0.0.0.0/0. What is the most efficient way to achieve this?

Accepted Answer

Create a custom AWS Config rule with an AWS Lambda function that checks for public inbound traffic.. AWS Config rules can evaluate resources against desired configurations. A custom AWS Config rule using a Lambda function can check security group rules and trigger notifications via SNS. Option A is wrong because CloudTrail logs API calls but requires parsing. Option C is wrong because IAM Access Analyzer focuses on resource policies. Option D is wrong because GuardDuty is for threat detection.

Answer

Use IAM Access Analyzer to detect publicly accessible security groups.

Answer

Enable Amazon GuardDuty and use its findings for security group changes.

Answer

Create a CloudTrail trail and filter on AuthorizeSecurityGroupIngress events.

Question 13

A security engineer needs to capture all API calls made to AWS services for forensic analysis. Which AWS service should be used to store these logs durably and cost-effectively for long-term retention?

Accepted Answer

AWS CloudTrail. Option C is correct because AWS CloudTrail logs all API calls and can be configured to deliver logs to an S3 bucket for durable, cost-effective storage. Option A is wrong because AWS Config records resource configuration changes, not API calls. Option B is wrong because VPC Flow Logs capture network traffic, not API calls. Option D is wrong because Amazon GuardDuty is a threat detection service, not a logging service.

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Answer

AWS Config

Question 14

A company wants to monitor for suspicious IAM activity, such as a user creating access keys without authorization. Which THREE AWS services can be used together to detect and alert on this activity in real-time? (Choose THREE.)

Accepted Answer

Amazon CloudWatch Logs. Options A, D, and E are correct. AWS CloudTrail logs the API call (CreateAccessKey). Amazon CloudWatch Logs can receive CloudTrail logs, and a metric filter can detect the specific event. An alarm can then trigger an SNS notification. Option B is wrong because Amazon Inspector is for vulnerability assessment. Option C is wrong because AWS Trusted Advisor provides recommendations, not real-time alerting.

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 15

A security engineer notices that an S3 bucket containing sensitive data has been accessed from an IP address outside the allowed range. CloudTrail logs show the access was made using temporary credentials from an assumed role. What additional logging is needed to trace the access back to the original IAM user who assumed the role?

Accepted Answer

Enable AWS Config to record S3 bucket policies.. Option A is correct because CloudTrail logs include the 'sessionIssuer' field for assumed roles, which identifies the user who assumed the role. Option B is wrong because VPC Flow Logs do not contain IAM user information. Option C is wrong because CloudWatch Logs is a destination, not a source of identity info. Option D is wrong because S3 server access logs do not include session issuer details. Option E is wrong because AWS Config does not record API calls.

Answer

Enable CloudTrail to log data events for the S3 bucket.

Answer

Enable VPC Flow Logs for the VPC where the request originated.

Answer

Configure CloudWatch Logs to capture the EC2 instance's system logs.

Answer

Enable S3 server access logging for the bucket.