SCS-C02 Practice Test 27 — 15 Questions

Question 1

A company is using Amazon CloudWatch Logs to centralize application logs from EC2 instances. The security team wants to encrypt the log data at rest using a customer-managed KMS key. After enabling encryption on the log group, they notice that new log events are being encrypted, but existing log events are not encrypted. What should the team do to encrypt the existing log events?

Accepted Answer

Export the existing logs to S3, encrypt them with the KMS key, and re-import them into a new log group.. Option C is correct because CloudWatch Logs does not support encrypting existing log events retroactively. The only way to encrypt them is to export them, re-encrypt, and re-import. Option A is wrong because there is no built-in re-encryption. Option B is wrong because you cannot change the KMS key on an existing log group. Option D is wrong because re-encryption is not supported.

Answer

Use the AWS CLI to update the log group's encryption configuration to re-encrypt existing data.

Answer

Enable KMS automatic key rotation on the customer-managed key to encrypt existing logs.

Answer

Change the KMS key to an AWS managed key to automatically encrypt existing logs.

Question 2

A security engineer is configuring Amazon GuardDuty for the first time. The engineer wants to receive alerts when GuardDuty generates a finding of severity HIGH or higher. What is the simplest way to achieve this?

Accepted Answer

Create an Amazon EventBridge rule that matches GuardDuty findings and triggers an SNS topic.. Option B is correct because GuardDuty can send findings directly to CloudWatch Events (EventBridge), which can then invoke a Lambda function or send to an SNS topic. Option A is wrong because GuardDuty does not have native email alerts. Option C is wrong because GuardDuty does not use CloudWatch Logs directly. Option D is wrong because GuardDuty findings are not stored in S3 by default.

Answer

Configure CloudWatch Logs to monitor GuardDuty logs and create a metric filter for high-severity findings.

Answer

Set up an S3 event notification on the GuardDuty findings bucket.

Answer

Configure GuardDuty to send email notifications for all findings.

Question 3

A company uses AWS CloudTrail to log all API calls. The security team wants to ensure that any attempt to disable CloudTrail logging is detected and alerted within minutes. Which solution should they implement?

Accepted Answer

Create a CloudWatch metric filter on CloudTrail logs for StopLogging or DeleteTrail events and set an alarm.. Option C is correct because CloudTrail itself logs the StopLogging or DeleteTrail API calls. Those logs can be streamed to CloudWatch Logs, where a metric filter can detect the event and trigger an alarm that sends an SNS notification. Option A is wrong because Config rules evaluate resource configurations, not API calls. Option B is wrong because GuardDuty does not monitor CloudTrail API calls. Option D is wrong because S3 events are for object-level operations, not CloudTrail API calls.

Answer

Use Amazon GuardDuty to monitor for disablement events.

Answer

Create an AWS Config rule to detect when CloudTrail is disabled.

Answer

Configure S3 event notifications on the CloudTrail bucket.

Question 4

A security engineer is troubleshooting an issue where CloudTrail is not delivering logs to an S3 bucket. The bucket policy appears correct. Which TWO additional steps should the engineer take to diagnose the issue? (Choose TWO.)

Accepted Answer

Verify that the S3 bucket exists and is in the correct region.. Options A and D are correct. Verifying that the bucket exists and checking the CloudTrail error messages in the CloudTrail console are standard troubleshooting steps. Option B is wrong because CloudWatch Logs is not required for S3 delivery. Option C is wrong because S3 server access logs are separate. Option E is wrong because CloudTrail does not use IAM roles for S3 delivery.

Answer

Check CloudWatch Logs for CloudTrail errors.

Answer

Create an IAM role for CloudTrail with S3 write permissions.

Answer

Enable S3 server access logging on the bucket.

Question 5

A company has enabled CloudTrail in all regions and is logging to a single S3 bucket. The security team needs to ensure that any attempted deletion of CloudTrail logs generates an immediate alert. Which solution meets this requirement?

Accepted Answer

Configure an S3 event notification on the bucket for s3:ObjectRemoved:* events, invoke a Lambda function to publish to an SNS topic.. S3 Events can trigger a Lambda function to send a notification via SNS when an object delete action occurs. Option C is correct because it integrates S3 events with Lambda and SNS for real-time alerting. Option A is wrong because CloudWatch Logs does not directly monitor S3 object deletions. Option B is wrong because CloudTrail Insights detects unusual API activity, not specific delete events in S3. Option D is wrong because Config rules evaluate resource configurations, not real-time events.

Answer

Use AWS Config to create a rule that checks for deleted objects and sends an SNS notification.

Answer

Enable CloudTrail Insights to detect unusual deletion activity and send alerts.

Answer

Create a CloudWatch Logs metric filter on the CloudTrail log group for DeleteObject events and trigger an alarm.

Question 6

A security engineer is investigating a potential data exfiltration incident. The engineer has enabled VPC Flow Logs for the VPC and CloudTrail for the account. Which combination of actions would provide the most comprehensive visibility into network traffic and API calls?

Accepted Answer

Enable VPC Flow Logs to capture network traffic and use CloudTrail to capture API calls. Correlate both logs for a complete view.. VPC Flow Logs capture network traffic metadata, and CloudTrail captures API calls. Analyzing both together provides a complete picture. Option B is correct because it combines both services. Option A is wrong because CloudTrail alone does not capture network traffic. Option C is wrong because VPC Flow Logs do not capture API calls. Option D is wrong because Config does not log API calls or network traffic.

Answer

Use AWS Config to track resource changes and CloudTrail to detect network anomalies.

Answer

Analyze CloudTrail logs to identify API calls and correlate with VPC Flow Logs for network traffic.

Answer

Use VPC Flow Logs to identify API calls and network traffic.

Question 7

A company wants to centrally collect and analyze logs from multiple AWS accounts. Which AWS service should be used to aggregate logs from various sources for monitoring and alerting?

Accepted Answer

Amazon CloudWatch Logs. CloudWatch Logs can aggregate logs from multiple accounts using cross-account log groups or with the help of Kinesis. Option B is correct because CloudWatch Logs is the primary log aggregation service. Option A is wrong because CloudTrail is for API logging, not general log aggregation. Option C is wrong because S3 is storage, not a monitoring service. Option D is wrong because Config is for configuration tracking.

Answer

Amazon S3

Answer

AWS Config

Answer

AWS CloudTrail

Question 8

A security team needs to monitor for failed login attempts to an EC2 instance running Linux. The team wants to send a real-time alert when more than 10 failed SSH attempts occur within 5 minutes. Which solution is the most efficient?

Accepted Answer

Install the CloudWatch Logs agent on the EC2 instance to stream /var/log/secure to CloudWatch Logs. Create a metric filter for 'Failed password' and set a CloudWatch alarm.. The CloudWatch Logs agent can send /var/log/secure to CloudWatch Logs, where a metric filter can count failed attempts and trigger an alarm. Option A is correct. Option B is wrong because modifying /etc/hosts.deny is not monitoring. Option C is wrong because VPC Flow Logs do not capture application-level login attempts. Option D is wrong because GuardDuty detects threats but is not as targeted for this specific metric.

Answer

Enable VPC Flow Logs and filter for SSH traffic to detect failed attempts.

Answer

Configure the EC2 instance to write failed attempts to a file in S3 and use S3 events to trigger a Lambda function for alerting.

Answer

Enable Amazon GuardDuty and create a custom threat list for failed SSH attempts.

Question 9

A company uses AWS WAF to protect its web application from common web exploits. The security team wants to block requests that contain SQL injection or cross-site scripting (XSS) in the query string. Which rule type should be used?

Accepted Answer

Managed rule group for SQL injection and XSS. Option B is correct because AWS WAF has managed rule groups for SQL injection and XSS. Option A is wrong because rate-based rules are for rate limiting. Option C is wrong because geographic rules are for location-based blocking. Option D is wrong because regex patterns are custom, but managed rules are more comprehensive.

Answer

Custom regex pattern set

Answer

Rate-based rule

Answer

Geographic match rule

Question 10

Refer to the exhibit. A security engineer created this S3 bucket policy to allow CloudTrail to deliver logs from account 123456789012 to the bucket my-trail-bucket. However, CloudTrail logs are not being delivered. What is the most likely reason?

Accepted Answer

The policy is missing s3:GetBucketAcl permission.. Option D is correct. The bucket policy must also grant the s3:GetBucketAcl permission to allow CloudTrail to verify the bucket's ACL. Without it, CloudTrail will fail. Option A is wrong because the ARN is correct. Option B is wrong because the Action is correct. Option C is wrong because the Principal is correct.

Answer

The Principal should be the CloudTrail service principal for the specific region.

Answer

The Action should be s3:PutObjectAcl instead of s3:PutObject.

Answer

The resource ARN does not include the bucket name.

Question 11

A company has a requirement to retain CloudTrail logs for 7 years for compliance. The logs are stored in an S3 bucket. The security team needs to ensure that logs are not deleted before the retention period ends, even by users with full S3 permissions. Which action should be taken?

Accepted Answer

Enable S3 Object Lock in Compliance mode on the bucket with a retention period of 7 years.. S3 Object Lock with a retention mode of Compliance prevents any user, including the root user, from deleting objects until the retention period expires. Option A is correct. Option B is wrong because MFA Delete can be bypassed by root. Option C is wrong because bucket policies do not prevent deletion by bucket owners with full permissions. Option D is wrong because versioning alone does not prevent deletion.

Answer

Enable MFA Delete on the bucket and require MFA for all delete operations.

Answer

Enable S3 Versioning and set a lifecycle policy to expire noncurrent versions after 7 years.

Answer

Create a bucket policy that denies s3:DeleteObject for all users.

Question 12

A security team has enabled AWS CloudTrail in all regions and is delivering logs to an S3 bucket. The team has also enabled S3 server access logging for the CloudTrail bucket. The team needs to detect any unauthorized access to the CloudTrail logs. Which combination of services should the team use to achieve near-real-time detection?

Accepted Answer

Amazon GuardDuty and Amazon CloudWatch Events. Option D is correct because Amazon GuardDuty can monitor S3 access logs for suspicious activity, and CloudWatch Events can trigger a notification. Option A is wrong because AWS Config does not analyze S3 access logs in real time. Option B is wrong because Athena is for querying, not real-time detection. Option C is wrong because CloudTrail Insights focuses on API activity, not S3 data events.

Answer

AWS CloudTrail Insights and Amazon CloudWatch

Answer

Amazon Athena and Amazon QuickSight

Answer

AWS Config and Amazon SNS

Question 13

A security engineer needs to ensure that all API calls made to AWS are logged and retained for at least 7 years for compliance. Which AWS service should be enabled to meet this requirement?

Accepted Answer

AWS CloudTrail. Option C is correct because AWS CloudTrail logs API activity and can be configured to store logs in S3 with lifecycle policies for long-term retention. Option A is wrong because Amazon GuardDuty is a threat detection service, not for API logging. Option B is wrong because AWS Config records resource configuration changes, not API calls. Option D is wrong because Amazon Inspector is for vulnerability assessments.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon Inspector

Question 14

A security engineer is designing a centralized logging solution for 10 AWS accounts. Which THREE AWS services should be used to aggregate, store, and analyze logs?

Accepted Answer

AWS Organizations. Options B, C, and D are correct. Amazon S3 provides durable storage, Amazon Athena allows querying logs, and AWS Organizations enables centralized management. Option A (Kinesis Data Streams) is for real-time streaming, not necessary. Option E (CloudWatch Logs) is for real-time monitoring but not ideal for long-term analysis.

Answer

Amazon Kinesis Data Streams

Answer

Amazon CloudWatch Logs

Question 15

A security engineer needs to monitor for unauthorized changes to IAM roles and policies in an AWS account. The engineer wants to receive an email notification whenever an IAM policy is attached to a role. Which AWS services should be combined to achieve this?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events (Amazon EventBridge). Option A is correct: CloudTrail records the AttachRolePolicy API call, and CloudWatch Events (EventBridge) can trigger an SNS notification when that event occurs. Option B is wrong because AWS Config can detect configuration changes but does not directly send email; it can integrate with SNS but CloudTrail is more straightforward for API-specific events. Option C is wrong because Amazon Inspector does not monitor IAM changes. Option D is wrong because Amazon GuardDuty detects threats, not specific API calls.

Answer

Amazon GuardDuty and Amazon Simple Email Service (SES)

Answer

AWS Config and Amazon Simple Notification Service (SNS)

Answer

Amazon Inspector and Amazon CloudWatch Logs