SCS-C02 Security Logging and Monitoring — 20 Questions

Question 1

A company uses Amazon GuardDuty and wants to suppress low-severity findings that are known false positives. What is the recommended approach?

Accepted Answer

Create a GuardDuty filter to suppress the findings. GuardDuty filters allow you to automatically suppress low-severity findings that are known false positives by setting the filter action to 'ARCHIVE'. This prevents the findings from appearing in the active findings list without disabling detection or deleting data. Filters are the recommended approach because they are purpose-built for this use case and preserve the audit trail.

Answer

Configure a CloudWatch Events rule to ignore the findings

Answer

Manually delete the findings from the GuardDuty console

Answer

Disable the GuardDuty detector for the affected accounts

Question 2

A security engineer needs to capture all network traffic between EC2 instances in a VPC for forensic analysis. Which TWO services should be used together? (Choose TWO.)

Accepted Answer

Amazon VPC Flow Logs. Amazon VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions. To perform forensic analysis on this raw flow log data, you can use Amazon Athena to query the logs directly from S3 using standard SQL, enabling efficient filtering and pattern detection across large volumes of network traffic.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon GuardDuty

Question 3

Which TWO AWS services provide native integration with Amazon CloudWatch Logs for real-time monitoring of application logs? (Choose TWO.)

Accepted Answer

Amazon EC2. Amazon EC2 is correct because the CloudWatch agent (or the legacy CloudWatch Logs agent) can be installed on EC2 instances to stream application and OS logs directly to CloudWatch Logs log groups in near real time, where metric filters and alarms can act on them. AWS Lambda is correct because it natively integrates with CloudWatch Logs: every invocation automatically writes stdout/stderr to a log group named /aws/lambda/<function-name>, enabling real-time monitoring without any agent installation. Amazon S3 is not a log-streaming source for CloudWatch Logs; it only stores objects and would require custom code or subscription filters to forward data. Amazon Route 53 publishes DNS query logs, but these are delivered to CloudWatch Logs only via explicit query logging configuration and are not application logs. AWS CloudTrail records API activity and delivers events to S3 and CloudWatch Logs, but it captures control-plane audit events, not application logs.

Answer

Amazon S3

Answer

Amazon Route 53

Answer

AWS CloudTrail

Question 4

A security engineer needs to monitor cross-account access to resources. Which THREE AWS services can be used to log or detect such access? (Choose THREE.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it logs all API calls made to the AWS environment, including cross-account access events such as AssumeRole, GetFederationToken, or any action performed by an IAM role from another account. These logs capture the source identity, target resource, and request parameters, enabling security engineers to detect and audit cross-account activity.

Answer

Amazon VPC Flow Logs

Answer

Amazon Inspector

Question 5

Refer to the exhibit. A security engineer reviews a CloudTrail log entry. What is the MOST concerning security issue?

Accepted Answer

The root user is performing actions. The root user has unrestricted access and should be used only for a few account-level tasks. Although CloudTrail audits root user activity, any routine API call by the root user violates the principle of least privilege and indicates a serious security misconfiguration. The most concerning issue is the root user performing actions beyond its limited scope, as it can indicate credential compromise or lack of proper IAM governance.

Answer

The security group rule allows SSH from 0.0.0.0/0

Answer

The API call failed as indicated by null response elements

Answer

The request came from an external IP address

Question 6

A company runs a multi-account AWS environment using AWS Organizations. The security team needs to implement centralized logging for all AWS CloudTrail events across all accounts. They create a new trail in the management account with the following configuration: trail name 'central-trail', apply to all accounts in the organization, enable data events for all S3 buckets, and store logs in a centralized S3 bucket. After one week, they notice that some accounts are not delivering CloudTrail logs to the central bucket. The security engineer verifies that the trail is still configured to apply to all accounts and that the S3 bucket policy allows cross-account access. What is the MOST likely reason for the missing logs?

Accepted Answer

Some accounts were added to the organization after the trail was created, and the trail was not updated to include them. When a trail is created in the management account with 'apply to all accounts in the organization', it automatically includes all current member accounts. However, if new accounts are added to the AWS Organization after the trail is created, the trail does not automatically extend to those new accounts. The trail must be updated (e.g., via the CloudTrail console or API) to include the newly added accounts, or the organization trail feature must be re-enabled. This is why logs from accounts added after trail creation are missing.

Answer

The member accounts have not enabled CloudTrail Insights

Answer

The S3 bucket policy does not grant the correct permissions to the member accounts

Answer

The trail is not configured as a multi-region trail

Question 7

A company is using AWS Organizations with multiple accounts. The security team needs to centrally monitor all root user API activity across all accounts and receive alerts within minutes. What is the MOST efficient solution?

Accepted Answer

Create an organization trail in CloudTrail that logs all accounts. Use CloudWatch Logs metric filters and alarms to detect root login events.. An organization trail in AWS CloudTrail logs API activity for all accounts in AWS Organizations from a single point, eliminating the need to manage per-account trails. By sending these logs to CloudWatch Logs, you can create metric filters to detect root user login events (e.g., the 'RootLogin' event) and configure CloudWatch Alarms to trigger SNS notifications within minutes, meeting the requirement for centralized monitoring and rapid alerts.

Answer

Enable CloudTrail in each account and aggregate logs to a centralized S3 bucket. Use Athena queries to detect root activity and send alerts via SNS.

Answer

Use AWS Lambda functions in each account to poll CloudTrail logs and send root activity to a central SQS queue.

Answer

Enable AWS Config rules in each account to detect root user activity and send notifications to a central SNS topic.

Question 8

A company runs a critical application on an Auto Scaling group of EC2 instances behind an Application Load Balancer. The security team enabled VPC Flow Logs, CloudTrail, and CloudWatch Logs for the application tier. Recently, they noticed that some EC2 instances are being terminated unexpectedly by an unknown IAM user. The CloudTrail logs show the TerminateInstances API call, but the source IP address is from within the VPC CIDR range. The security team suspects the action is coming from an EC2 instance that has been compromised. They need to identify the specific compromised instance and the IAM role it used. Which combination of steps will provide the necessary information? (Choose TWO.)

Accepted Answer

Examine the CloudTrail event for TerminateInstances and note the 'userIdentity' field to identify the IAM role. Then use the 'sourceIPAddress' field to find the instance's private IP. Cross-reference with VPC Flow Logs to find the network interface with that IP at the time of the event.. CloudTrail provides the IAM role (userIdentity) and the source private IP (sourceIPAddress) for the TerminateInstances call. To identify the specific compromised instance, cross-reference the source IP with VPC Flow Logs to find the network interface (ENI) associated with that IP at the time of the event. Flow logs include the ENI ID, which can be mapped to an EC2 instance. Option A is not a reliable method because VPC Flow Logs capture network traffic but do not indicate which API call a flow corresponds to; you cannot determine 'the source IP that made the API call' from flow logs alone without the CloudTrail timestamp and destination IP. Therefore, only B is a correct step.

Answer

Review the VPC Flow Logs for any traffic to the EC2 API endpoint. Look for the source IP that made the API call. Then use that IP to find the instance in the EC2 console. Check the IAM role attached to that instance.

Answer

Use AWS Config to find all EC2 instances that were terminated around that time. Then check the CloudTrail event for the IAM role. Finally, use the instance ID from the termination event to identify the source.

Answer

Check the CloudWatch Logs for the Auto Scaling group to find any error messages around the termination time. Correlate with the CloudTrail event to identify the IAM role. Then use the EC2 console to list all instances and check their IAM roles manually.

Question 9

Refer to the exhibit. A security engineer is reviewing an IAM policy attached to a user. The policy is intended to allow the user to get and put objects in the S3 bucket 'example-bucket' only from the IP range 203.0.113.0/24. However, the user reports that they are unable to put objects from an IP within that range. What is the most likely cause of this issue?

Accepted Answer

The policy lacks a separate statement to allow 's3:ListBucket' on the bucket resource.. The policy only grants s3:GetObject and s3:PutObject actions on the bucket's objects (arn:aws:s3:::example-bucket/*), but does not include a separate statement allowing s3:ListBucket on the bucket resource (arn:aws:s3:::example-bucket). Without s3:ListBucket, the user cannot list the bucket's contents, which is often required by the AWS CLI or SDK to resolve object keys before performing put operations. The IP condition is correctly applied, so the issue is the missing list permission.

Answer

The condition key should be 'aws:sourceIp' (lowercase 's').

Answer

The policy should use the 'NotIpAddress' condition operator instead of 'IpAddress'.

Answer

The resource ARN should be 'arn:aws:s3:::example-bucket' without the '/*' suffix.

Question 10

A security engineer is troubleshooting an issue where Amazon GuardDuty is not generating findings for a specific EC2 instance that is known to be compromised. The instance is in a VPC with VPC Flow Logs enabled. What could be the reason for the lack of findings?

Accepted Answer

VPC Flow Logs are not being delivered to CloudWatch Logs.. GuardDuty relies on VPC Flow Logs as a data source to analyze network traffic for threats. If VPC Flow Logs are not being delivered to CloudWatch Logs, GuardDuty cannot ingest the flow data, and therefore cannot generate findings for that EC2 instance, even if the instance is compromised.

Answer

CloudTrail is not enabled in the account.

Answer

AWS Config is not enabled for the EC2 instance.

Answer

VPC Flow Logs are only enabled for the subnet, not the instance's ENI.

Question 11

A company has enabled AWS CloudTrail in all regions and is delivering logs to a central S3 bucket. The security team needs to ensure that any attempt to delete or modify CloudTrail logs is detected and alerted. What should be done?

Accepted Answer

Enable S3 server access logging on the bucket and monitor for DELETE requests.. Enabling S3 server access logging on the bucket directly records all requests, including DELETE operations, providing the data needed to detect and alert on unauthorized attempts to delete or modify CloudTrail logs. By integrating these logs with monitoring services (e.g., Amazon CloudWatch, AWS Lambda), the security team can meet the explicit requirement for detection and alerting. While options B, C, and D prevent deletion or modification, they do not inherently provide detection or alerting mechanisms. Therefore, option A is the most direct and correct solution.

Answer

Enable S3 Object Lock in governance mode on the bucket.

Answer

Enable MFA Delete on the S3 bucket.

Answer

Use a bucket policy that denies s3:DeleteObject for all principals.

Question 12

A company is using Amazon CloudWatch Logs to collect application logs. The security team wants to detect patterns that indicate security threats, such as multiple failed login attempts. Which TWO services can be used together to perform real-time log analysis and alerting?

Accepted Answer

Amazon OpenSearch Service. Amazon OpenSearch Service (B) is correct because it ingests CloudWatch Logs via a subscription filter and provides real-time search, pattern matching, and alerting through its alerting plugin, making it ideal for detecting threat patterns like repeated failed logins. AWS Lambda (C) is correct because it can be invoked as the subscription filter destination for CloudWatch Logs, allowing real-time processing of each log event to detect patterns and trigger alerts (e.g., via Amazon SNS). Together, CloudWatch Logs subscription filters stream data to Lambda for real-time inspection and to OpenSearch for indexing, dashboards, and alerting. Amazon Kinesis Data Analytics (A) is for SQL-based stream analytics, not log pattern alerting, and is not marked correct. AWS Glue (D) is a batch ETL service, not real-time log analysis. Amazon Athena (E) queries data at rest in S3, so it is not real-time.

Answer

Amazon Kinesis Data Analytics

Answer

AWS Glue

Answer

Amazon Athena

Question 13

A company uses AWS Organizations and wants to enforce that all member accounts enable VPC Flow Logs for all VPCs. Which THREE services or features should be used to enforce this policy automatically?

Accepted Answer

AWS Organizations Service Control Policies (SCPs). Option C (AWS Organizations Service Control Policies) is correct because SCPs set the maximum available permissions for member accounts and can deny actions such as ec2:DeleteFlowLogs or restrict the ability to disable flow logs, providing the guardrail that enforces the policy across the organization. Option D (AWS CloudFormation StackSets) is correct because StackSets deploy a CloudFormation template that creates the VPC Flow Log resources (AWS::EC2::FlowLog) across all accounts and regions in the organization, automatically provisioning the required logging configuration. Option E (AWS Config Conformance Packs) is correct because a conformance pack bundles AWS Config managed rules (for example, vpc-flow-logs-enabled) that continuously detect and, with remediation actions, auto-remediate accounts where flow logs are missing, enforcing compliance. Option A (AWS Service Catalog) is not correct because it only offers approved products for users to launch and does not automatically enforce configuration across existing accounts. Option B (AWS CloudTrail) is not correct because it records API activity and does not configure or enforce VPC Flow Logs.

Answer

AWS Service Catalog

Answer

AWS CloudTrail

Question 14

A company wants to centrally collect VPC Flow Logs from multiple accounts into a single S3 bucket in the security account. Which solution is the MOST operationally efficient?

Accepted Answer

Log in to each account and configure VPC Flow Logs to deliver to the central S3 bucket.. VPC Flow Logs can be delivered directly to an S3 bucket in another account by configuring the flow log with the destination bucket ARN and ensuring the bucket policy grants write permissions to the flow log service. This eliminates the need for Lambda processing, S3 replication, or any unsupported central management feature. Configuring each account's VPC Flow Logs to deliver directly to the central S3 bucket is the simplest and most operationally efficient approach.

Answer

Use CloudWatch Logs to stream flow logs to a Lambda function that writes to S3.

Answer

Configure each account's VPC Flow Logs to a local S3 bucket, then use S3 replication to copy to the central bucket.

Answer

Use AWS Organizations to centrally enable VPC Flow Logs in all accounts and deliver to the central S3 bucket.

Question 15

A company has a CloudTrail trail that logs management events for all regions in the management account. They want to also log data events for all S3 buckets in the organization. Which configuration change will meet this requirement with the LEAST operational overhead?

Accepted Answer

Modify the existing trail to add an event selector for S3 data events with a scope of all buckets.. CloudTrail trails can be configured with an event selector that includes data events for S3, and setting the scope to 'all buckets' logs data events for every S3 bucket in the account without needing separate configurations. This approach reuses the existing management trail, minimizing operational overhead by avoiding additional trails, services, or aggregation steps.

Answer

Use Amazon EventBridge to capture S3 events and forward them to CloudTrail.

Answer

Enable S3 server access logs for all buckets and aggregate them using Athena.

Answer

Create a new trail in each member account to log S3 data events and deliver to a central S3 bucket.

Question 16

A company is designing a centralized logging solution for VPC Flow Logs across multiple AWS accounts. The solution must meet the following requirements: - Centralized storage in an S3 bucket in the security account. - Real-time analysis of flow logs. - Minimal operational overhead. Which TWO actions should the company take? (Choose two.)

Accepted Answer

Use AWS Organizations to enable VPC Flow Logs in all accounts and deliver to a central S3 bucket.. Option A is correct because AWS Organizations allows you to centrally enable VPC Flow Logs across all member accounts and configure them to deliver directly to a central S3 bucket in the security account, satisfying centralized storage with minimal operational overhead. Option C is correct because Amazon Kinesis Data Firehose can deliver VPC Flow Logs to the central S3 bucket and supports real-time analysis by streaming data to destinations such as Amazon OpenSearch Service or Splunk, meeting the real-time analysis requirement. Option B is incorrect because a VPC Flow Log subscription is created per VPC (or per ENI/subnet), not in a single security account that can capture logs from all VPCs across accounts. Option D is incorrect because CloudWatch Logs subscription filters stream logs to a destination like Kinesis or Lambda, not directly to a central S3 bucket, and would require additional configuration in every account. Option E is incorrect because S3 replication copies objects between buckets but does not enable VPC Flow Logs or provide real-time analysis, adding operational overhead.

Answer

Create a single VPC Flow Log subscription in the security account that captures logs from all VPCs.

Answer

Create a CloudWatch Logs subscription filter in each account to stream logs to the security account.

Answer

Configure S3 replication from each account's bucket to the central bucket.

Question 17

A company is using Amazon GuardDuty to detect threats. The security team wants to receive alerts for specific findings. Which TWO AWS services can be used to forward GuardDuty findings to a custom application for analysis? (Choose two.)

Accepted Answer

Amazon CloudWatch Events (Amazon EventBridge). Amazon GuardDuty can publish findings to Amazon CloudWatch Events (now part of Amazon EventBridge) as events. These events can then be routed to a custom application via targets like AWS Lambda, SQS, or Kinesis, enabling real-time analysis and alerting. This is the primary, native integration for forwarding GuardDuty findings to downstream systems.

Answer

Amazon Kinesis Data Streams

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Lambda

Question 18

A company uses AWS WAF to protect a web application. The security team needs to analyze blocked requests to identify attack patterns. Which service should be used to query and visualize WAF logs?

Accepted Answer

Amazon Athena. Amazon Athena is the correct service because it allows you to query AWS WAF logs stored in Amazon S3 directly using standard SQL. WAF logs are not natively indexed for real-time querying like CloudWatch Logs, but Athena's serverless query engine can efficiently analyze large volumes of these logs for attack pattern identification. Combined with Amazon QuickSight for visualization, Athena provides a cost-effective and scalable solution for ad-hoc log analysis.

Answer

Amazon CloudWatch Logs Insights

Answer

Amazon QuickSight

Answer

AWS WAF console

Question 19

Refer to the exhibit. A security engineer created this S3 bucket policy to allow CloudTrail to deliver logs. However, log delivery is failing. What is the most likely cause?

Accepted Answer

The bucket policy does not allow s3:GetBucketAcl. CloudTrail requires the S3 bucket policy to grant the `s3:GetBucketAcl` permission to the CloudTrail service principal (`cloudtrail.amazonaws.com`) so that it can verify the bucket's ACL before delivering logs. Without this permission, CloudTrail cannot confirm it has write access, causing log delivery to fail. The missing `s3:GetBucketAcl` action is the most likely cause because the policy must explicitly allow both `s3:PutObject` and `s3:GetBucketAcl` for the service to function.

Answer

The bucket is not in the same region as the trail

Answer

The bucket policy does not specify a condition

Answer

The bucket is encrypted with SSE-KMS

Question 20

Refer to the exhibit. A security engineer creates this CloudWatch Logs metric filter on a CloudTrail log group to detect root account usage. However, no metrics are generated. What is the most likely issue?

Accepted Answer

The metric filter pattern is incorrectly formatted. The most likely issue is that the metric filter pattern is incorrectly formatted. CloudWatch Logs metric filters require a valid JSON pattern that matches the log event structure. For detecting root account usage, the pattern must correctly reference the `userIdentity.type` field as `Root`. If the pattern syntax is wrong (e.g., missing quotes, incorrect key path, or invalid JSON), no metrics will be generated even if the log group and CloudTrail are properly configured.

Answer

The log group does not exist

Answer

CloudTrail is not enabled for the account

Answer

The metric namespace is invalid