SCS-C02 Practice Test 29 — 15 Questions

Question 1

A company uses Amazon RDS for MySQL and needs to monitor database activity for suspicious queries, such as unauthorized access attempts or SQL injection. The security team wants to centralize the logs from multiple RDS instances and analyze them in near real-time. Which solution should be implemented?

Accepted Answer

Enable database audit logs on each RDS instance, stream them to Amazon CloudWatch Logs, and use CloudWatch Logs Insights to query the logs.. Option C is correct because enabling RDS Enhanced Monitoring provides OS-level metrics, not SQL queries, so it is not suitable. Option A is correct: RDS provides database audit logs that can be streamed to CloudWatch Logs, and CloudWatch Logs Insights allows querying and analyzing logs in near real-time. Option B is wrong because VPC Flow Logs capture network traffic, not SQL queries. Option D is wrong because AWS CloudTrail records API calls, not database queries.

Answer

Enable RDS Enhanced Monitoring and stream the metrics to Amazon CloudWatch.

Answer

Enable VPC Flow Logs for the RDS instances and analyze the logs using Amazon Athena.

Answer

Enable AWS CloudTrail for RDS API calls and use Amazon GuardDuty to analyze the logs.

Question 2

A company is using Amazon CloudWatch Logs to store application logs. The security team needs to ensure that logs are encrypted at rest using a customer-managed KMS key (CMK). What configuration is required?

Accepted Answer

Associate the CMK with the CloudWatch Logs log group by specifying the key ARN in the log group's encryption configuration.. Option B is correct because CloudWatch Logs uses the KMS key specified in the log group's encryption setting. Option A is wrong because CloudWatch Logs does not support KMS key via bucket policy. Option C is wrong because S3 encryption policies are for S3 buckets, not CloudWatch Logs. Option D is wrong because KMS key policies grant permissions, but the log group must be associated with the key.

Answer

Add a KMS key policy that allows CloudWatch Logs to use the key.

Answer

Enable default encryption on the S3 bucket used for log export with a CMK.

Answer

Configure the S3 bucket policy to require SSE-KMS for log delivery.

Question 3

A security engineer notices that an Amazon S3 bucket has been accessed from an IP address outside the company's allowed range. The engineer needs to identify the IAM user who made the request. Which AWS service should be used to find this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls made to AWS services, including the identity of the caller. Option B is correct. Option A is wrong because VPC Flow Logs capture network traffic metadata but do not include IAM user details. Option C is wrong because CloudWatch Logs can store logs but do not directly capture API caller identity. Option D is wrong because S3 server access logs contain requester information but are not as comprehensive as CloudTrail for IAM user identification.

Answer

S3 server access logs

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 4

A security team needs to detect unauthorized API calls made from a compromised IAM user. Which AWS service should be used to monitor and alert on specific API activities?

Accepted Answer

AWS CloudTrail. CloudTrail logs all API calls and can be used with CloudWatch Alarms to trigger alerts on specific actions. Option B is correct because CloudTrail is designed for API activity monitoring. Option A is wrong because Config tracks resource configuration changes, not API calls. Option C is wrong because GuardDuty is for threat detection, not specific API monitoring. Option D is wrong because VPC Flow Logs capture network traffic, not API calls.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

VPC Flow Logs

Question 5

A security engineer is designing a logging strategy for a multi-account environment. The engineer needs to ensure that all API activity across accounts is logged and that logs are immutable and centrally accessible. Which THREE actions should the engineer take?

Accepted Answer

Create an AWS CloudTrail organization trail that logs to a central S3 bucket.. To log all API activity across accounts, use an organization trail with CloudTrail. To make logs immutable, enable S3 Object Lock in Compliance mode. To centralize access, store logs in a central S3 bucket. Options A, B, and D are correct. Option C is wrong because CloudWatch Logs is not for immutable storage. Option E is wrong because VPC Flow Logs capture network traffic, not API calls.

Answer

Stream logs to CloudWatch Logs for real-time monitoring.

Answer

Enable VPC Flow Logs in all accounts and send to the central bucket.

Question 6

A security engineer needs to monitor AWS account activity for suspicious API calls and receive alerts. Which AWS service should the engineer use to meet this requirement?

Accepted Answer

AWS CloudTrail with CloudWatch Alarms. Option C is correct because CloudTrail logs API activity and can be integrated with CloudWatch Alarms for alerts. Option A is wrong because GuardDuty focuses on threat detection from various data sources, not specifically API monitoring. Option B is wrong because VPC Flow Logs capture network traffic. Option D is wrong because AWS Config tracks configuration changes.

Answer

VPC Flow Logs

Answer

AWS Config with AWS Config Rules

Answer

Amazon GuardDuty

Question 7

A company needs to monitor for root account usage and receive immediate notifications. Which combination of AWS services should be used?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Logs, and Amazon SNS. Option A is correct because CloudTrail can be configured to send events to CloudWatch Logs, and a CloudWatch metric filter can detect root account activity, triggering an SNS notification. Option B is wrong because GuardDuty does not specifically monitor root account usage. Option C is wrong because Config records resource changes, not API calls. Option D is wrong because S3 server access logs are for S3 access, not root usage.

Answer

AWS Config and AWS Lambda

Answer

Amazon GuardDuty and AWS Lambda

Answer

S3 server access logs and Amazon Inspector

Question 8

A security engineer runs the CLI command above to investigate a console login event. The output shows: {"type":"Root","principalId":"123456789012","arn":"arn:aws:iam::123456789012:root"}. What does this indicate?

Accepted Answer

The AWS account root user performed the console login.. Option B is correct because the principalId and arn show the root user of account 123456789012. Option A is wrong because it is the root user, not an IAM user. Option C is wrong because it is the root user, not a federated user. Option D is wrong because the root user is not a service.

Answer

A federated user performed the console login.

Answer

An AWS service performed the console login.

Answer

An IAM user in the account performed the console login.

Question 9

A security engineer is investigating a potential security incident involving an EC2 instance. The engineer needs to determine if any unauthorized SSH keys were added to the instance's authorized_keys file. Which AWS service should be used to detect this change?

Accepted Answer

AWS Config. Option C is correct because AWS Config can track changes to EC2 instance configurations, including file changes if using AWS Systems Manager Inventory or custom rules, but more directly, AWS Config can monitor for changes to security groups and IAM roles, not file contents. However, for file changes, AWS Systems Manager (SSM) Inventory can track file changes. Option A is wrong because AWS CloudTrail records API calls, not file changes. Option B is wrong because Amazon GuardDuty detects threats based on network and API activity. Option D is wrong because Amazon Inspector assesses vulnerabilities, not file integrity. The correct answer is actually not listed perfectly, but among the options, AWS Config with a custom rule can monitor for changes to the authorized_keys file if integrated with SSM. However, the best answer is AWS Config (option C) because it can be used with SSM to detect file changes. Option D is wrong because Inspector does not detect file changes.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Question 10

A company has a CloudTrail trail that logs management events and delivers them to an S3 bucket. The security team notices that some expected API calls are missing from the logs. They suspect that the calls were made by a service that is not tracked by CloudTrail. Which AWS service is NOT tracked by CloudTrail?

Accepted Answer

Amazon CloudFront. Option D is correct because Amazon CloudFront does not log management events via CloudTrail; it uses its own access logs. Option A, B, and C are all tracked by CloudTrail.

Answer

AWS Lambda

Answer

Amazon S3

Answer

Amazon EC2

Question 11

A company uses AWS Organizations with multiple accounts. The security team wants to centralize the collection of VPC Flow Logs and AWS CloudTrail logs from all accounts into a single Amazon S3 bucket in the management account. The S3 bucket policy must allow cross-account log delivery. Which condition in the bucket policy should be used to restrict log delivery to only the organization's accounts?

Accepted Answer

aws:SourceOrgId. Using the aws:SourceOrgId condition key ensures that only principals from the specified AWS Organization can write to the bucket. Option B is correct. Option A is wrong because aws:SourceAccount would require specifying each account individually, which is not scalable. Option C is wrong because aws:PrincipalOrgID is not a valid condition key. Option D is wrong because aws:SourceArn could be too restrictive if the ARN format is not consistent across services.

Answer

aws:SourceArn

Answer

aws:SourceAccount

Answer

aws:PrincipalOrgID

Question 12

Which TWO of the following are valid ways to grant an IAM user permissions to access an S3 bucket? (Choose 2.)

Accepted Answer

Attach an IAM policy to the user.. IAM policies can be attached to users, and S3 bucket policies can grant access to specific users.

Answer

Assign an instance profile to the user.

Answer

Create a VPC endpoint policy.

Answer

Use an SCP to allow access.

Question 13

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that all accounts have CloudTrail enabled and that logs are delivered to a centralized S3 bucket in the management account. Which solution meets these requirements?

Accepted Answer

Use AWS CloudTrail with Organizations to create an organization trail that logs all accounts to the central bucket.. Using CloudTrail with AWS Organizations, you can create a trail that applies to all accounts in the organization, logging to a single S3 bucket. Option D is correct. Option A is wrong because manual per-account setup is not scalable. Option B is wrong because Config does not enable CloudTrail. Option C is wrong because Lambda functions would be complex and not native.

Answer

Write a script that runs in each account using AWS Lambda to enable CloudTrail and point to the central bucket.

Answer

Use AWS Config rules in each account to check CloudTrail status and remediate via Lambda.

Answer

Create an IAM role that each account assumes to enable CloudTrail and log to the central bucket.

Question 14

A security engineer is configuring AWS CloudTrail to log management events for all AWS regions. The engineer needs to ensure that log files are encrypted at rest and that access to the log files is logged. Which solution meets these requirements?

Accepted Answer

Enable CloudTrail with SSE-KMS encryption and enable S3 server access logging on the destination bucket.. Option C is correct because CloudTrail can be configured to use SSE-KMS for encryption, and S3 server access logs can log access to the log files. Option A is wrong because SSE-S3 does not provide access logging. Option B is wrong because SSE-C is not supported by CloudTrail. Option D is wrong because CloudWatch Logs does not encrypt log files at rest by default.

Answer

Enable CloudTrail with SSE-C encryption and enable AWS CloudTrail Insights to log access.

Answer

Enable CloudTrail with SSE-S3 encryption and enable S3 server access logging on the destination bucket.

Answer

Enable CloudTrail with default encryption and enable AWS Config to log access.

Question 15

A security team wants to implement a centralized logging solution for multiple AWS accounts. The team needs to collect VPC Flow Logs, CloudTrail logs, and DNS query logs from all accounts. Which THREE services should the team use to aggregate these logs? (Choose THREE.)

Accepted Answer

Amazon Route 53 Resolver query logging. Options A, B, and D are correct. CloudTrail can be set up with an organization trail to aggregate management events. Route 53 Resolver query logging can publish to a central S3 bucket. VPC Flow Logs can be published to a central S3 bucket or CloudWatch Logs. Option C is wrong because AWS Config does not aggregate logs. Option E is wrong because CloudHSM is a hardware security module, not for log aggregation.

Answer

AWS CloudHSM

Answer

AWS Config