SCS-C02 Security Logging and Monitoring — 30 Questions

Question 1

A company uses AWS CloudTrail to log management events in all regions. The security team notices that some API calls made by an IAM user are not appearing in the CloudTrail event history. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CloudTrail event history only retains events for 90 days; older events are not visible. D is correct because CloudTrail event history only retains the last 90 days of events. If the API calls were made more than 90 days ago, they would no longer appear in the event history, even though the trail itself may still be delivering log files to an S3 bucket for longer-term storage. The security team is likely looking at the event history rather than querying the S3 bucket or using Athena for older events.

Answer

The user used the AWS Management Console, not the CLI

Answer

The trail is configured for a single region only

Answer

The API calls were read-only and excluded by default

Question 2

A company requires real-time analysis of AWS CloudTrail logs to detect unauthorized API calls. The logs are stored in Amazon S3. Which architecture minimizes latency and cost?

Accepted Answer

Send CloudTrail logs to Amazon CloudWatch Logs, then use a subscription filter to Amazon Kinesis Data Firehose delivering to Amazon OpenSearch Service. It provides the lowest-latency path for real-time analysis: CloudTrail logs are delivered to CloudWatch Logs in near real-time, and a subscription filter streams them to Kinesis Data Firehose, which buffers and delivers directly to Amazon OpenSearch Service for immediate indexing and search. This architecture avoids batch processing, minimizes data movement overhead, and uses managed services that scale automatically, keeping both latency and cost low.

Answer

Use AWS Glue to crawl S3 and load into Amazon Redshift for analysis

Answer

Query CloudTrail logs directly using Amazon Athena

Answer

Configure S3 event notifications to invoke an AWS Lambda function that writes to Amazon OpenSearch Service

Question 3

A security engineer needs to be alerted when an IAM user attempts to modify an S3 bucket policy. Which method is the MOST efficient?

Accepted Answer

Create an Amazon CloudWatch Events rule that matches the PutBucketPolicy API call and triggers an SNS notification. Amazon CloudWatch Events (now Amazon EventBridge) can directly capture the PutBucketPolicy API call as a real-time event and trigger an SNS notification without any additional compute or polling. This is the most efficient method as it requires no log parsing, no custom code, and no additional infrastructure, providing immediate alerting with minimal overhead.

Answer

Enable VPC Flow Logs and analyze for S3 API traffic

Answer

Configure an AWS Config rule to detect changes and invoke a Lambda function

Answer

Enable S3 server access logs and parse them for PutBucketPolicy entries

Question 4

A company uses Amazon GuardDuty and wants to suppress low-severity findings that are known false positives. What is the recommended approach?

Accepted Answer

Create a GuardDuty filter to suppress the findings. GuardDuty filters allow you to automatically suppress low-severity findings that are known false positives by setting the filter action to 'ARCHIVE'. This prevents the findings from appearing in the active findings list without disabling detection or deleting data. Filters are the recommended approach because they are purpose-built for this use case and preserve the audit trail.

Answer

Configure a CloudWatch Events rule to ignore the findings

Answer

Manually delete the findings from the GuardDuty console

Answer

Disable the GuardDuty detector for the affected accounts

Question 5

A company stores sensitive data in Amazon S3 and wants to detect and alert on any public read access to objects. Which combination of services provides the most comprehensive solution?

Accepted Answer

Enable S3 server access logging and use Amazon Athena to query logs, with CloudWatch Events to alert on specific patterns. S3 server access logs capture detailed records of all requests made to a bucket, including the requester, bucket name, request time, action, and response status. By using Amazon Athena to query these logs and CloudWatch Events to trigger alerts on patterns indicating public read access (e.g., a specific HTTP method like GET from an anonymous principal), you can detect and alert on unauthorized public reads comprehensively. This combination provides granular, queryable logging with event-driven alerting, covering both current and historical access patterns.

Answer

Enable VPC Flow Logs and analyze for S3 traffic

Answer

Use AWS Config rules to check for public bucket policies and alert via SNS

Answer

Enable S3 event notifications for all object-level events and send to Amazon SNS

Question 6

A security engineer needs to centrally collect and analyze AWS CloudTrail logs from multiple accounts. Which service is designed for this purpose?

Accepted Answer

Use AWS Organizations to create a CloudTrail trail that applies to all accounts. AWS Organizations allows you to create a single CloudTrail trail that applies to all accounts in the organization, centrally collecting management and data events into a single S3 bucket (and optionally CloudWatch Logs). This eliminates the need to manually configure trails in each account and ensures consistent logging across the entire organization, meeting the requirement for central collection and analysis.

Answer

Configure each account to send logs to a central S3 bucket

Answer

Enable Amazon GuardDuty in each account and aggregate findings

Answer

Use Amazon CloudWatch Logs to stream logs from each account to a central account

Question 7

A company uses AWS CloudTrail and wants to ensure that any modification to the trail itself is detected immediately. What should be done?

Accepted Answer

Create a CloudWatch Events rule that matches the StopLogging or UpdateTrail API calls and sends an alert. CloudWatch Events (now part of Amazon EventBridge) can be configured with a rule that matches specific API calls like StopLogging or UpdateTrail via CloudTrail. When such an API call is made, the rule triggers an action such as sending an SNS notification or invoking a Lambda function, enabling immediate detection of trail modifications. This approach directly monitors the control plane operations that alter the trail's configuration.

Answer

Configure Amazon GuardDuty to monitor for trail modifications

Answer

Enable CloudTrail Insights to detect unusual activity

Answer

Enable S3 event notifications on the trail's S3 bucket

Question 8

A security engineer needs to capture all network traffic between EC2 instances in a VPC for forensic analysis. Which TWO services should be used together? (Choose TWO.)

Accepted Answer

Amazon VPC Flow Logs. Amazon VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions. To perform forensic analysis on this raw flow log data, you can use Amazon Athena to query the logs directly from S3 using standard SQL, enabling efficient filtering and pattern detection across large volumes of network traffic.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon GuardDuty

Question 9

A company wants to use AWS CloudTrail to monitor data events for all S3 buckets. Which THREE steps are necessary? (Choose THREE.)

Accepted Answer

Specify an S3 bucket to store the log files. CloudTrail requires a destination S3 bucket to store the log files it generates. Without specifying a bucket, the trail cannot persist logs, and this bucket must have appropriate bucket policies to allow CloudTrail to write logs. This is a mandatory step when creating any trail, whether for management or data events.

Answer

Create a CloudWatch Events rule to forward data events

Answer

Enable CloudTrail Insights to detect unusual data access

Question 10

A security engineer needs to monitor cross-account access to resources. Which THREE AWS services can be used to log or detect such access? (Choose THREE.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it logs all API calls made to the AWS environment, including cross-account access events such as AssumeRole, GetFederationToken, or any action performed by an IAM role from another account. These logs capture the source identity, target resource, and request parameters, enabling security engineers to detect and audit cross-account activity.

Answer

Amazon VPC Flow Logs

Answer

Amazon Inspector

Question 11

Refer to the exhibit. A security engineer reviews a CloudTrail log entry. What is the MOST concerning security issue?

Accepted Answer

The root user is performing actions. The root user has unrestricted access and should be used only for a few account-level tasks. Although CloudTrail audits root user activity, any routine API call by the root user violates the principle of least privilege and indicates a serious security misconfiguration. The most concerning issue is the root user performing actions beyond its limited scope, as it can indicate credential compromise or lack of proper IAM governance.

Answer

The security group rule allows SSH from 0.0.0.0/0

Answer

The API call failed as indicated by null response elements

Answer

The request came from an external IP address

Question 12

Refer to the exhibit. A security engineer reviews the CloudTrail trail configuration. What is a security concern?

Accepted Answer

The logs are not encrypted with a customer-managed KMS key. The security concern is that the CloudTrail logs are not encrypted with a customer-managed KMS key. By default, CloudTrail encrypts log files using SSE-S3 (S3-managed keys), which does not provide the customer with control over key rotation, access policies, or the ability to audit key usage. Using a customer-managed KMS key ensures that only authorized principals can decrypt the logs, and it enables fine-grained access control and audit trails via CloudTrail and CloudWatch Logs, which is critical for compliance and security monitoring.

Answer

The trail is not multi-region

Answer

Log file validation is not enabled

Answer

CloudWatch Logs integration is missing

Question 13

A security engineer wants to receive real-time notifications when an AWS API call is made to delete an S3 bucket. Which service should be used to capture and forward these events to an Amazon SNS topic?

Accepted Answer

AWS CloudTrail with CloudWatch Events. AWS CloudTrail captures all API calls made to S3, including DeleteBucket. By sending these CloudTrail events to Amazon CloudWatch Events (now part of Amazon EventBridge), you can create a rule that matches the specific API call and forwards it to an SNS topic for real-time notification. This combination provides the exact event-driven pipeline needed for immediate alerting on S3 bucket deletions.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Answer

AWS Config

Question 14

A company uses AWS CloudTrail to log all API calls. The security team notices that some expected log entries are missing for actions performed by an IAM role assumed by an EC2 instance. The instance has the required permissions. What is the MOST likely cause of the missing log entries?

Accepted Answer

CloudTrail is not logging read-only API calls by default; the trail must be configured to log read events.. CloudTrail logs management events by default, but the trail can be configured to log only write events or only read events. If the trail is set to log only write events, read-only API calls (such as Describe* or Get* actions) made by the IAM role will not be recorded. Since the missing log entries are likely read operations, the lack of read event logging would result in missing entries. Option B correctly identifies this scenario.

Answer

The EC2 instance is in a VPC that has a VPC endpoint for CloudTrail, but the endpoint policy denies logging.

Answer

CloudTrail trail is not configured to log data events for EC2.

Answer

The IAM role used by the EC2 instance has a permissions boundary that excludes cloudtrail:PutLogEvents.

Question 15

A security engineer is designing a monitoring solution for a multi-account AWS environment using AWS Organizations. The solution must provide a centralized view of all API activities and send alerts for suspicious events. Which TWO services together can achieve this? (Choose TWO.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it records all API activity across an AWS environment, and when integrated with AWS Organizations, it can deliver a centralized view of API calls from all accounts into a single CloudTrail trail. Amazon CloudWatch Logs is correct because it can ingest CloudTrail logs from a centralized logging account, allowing the security engineer to create metric filters and alarms that trigger alerts for suspicious events based on specific API patterns.

Answer

Amazon GuardDuty

Answer

AWS Lambda

Answer

AWS Config

Question 16

A company runs a critical application on an Auto Scaling group of EC2 instances behind an Application Load Balancer. The security team enabled VPC Flow Logs, CloudTrail, and CloudWatch Logs for the application tier. Recently, they noticed that some EC2 instances are being terminated unexpectedly by an unknown IAM user. The CloudTrail logs show the TerminateInstances API call, but the source IP address is from within the VPC CIDR range. The security team suspects the action is coming from an EC2 instance that has been compromised. They need to identify the specific compromised instance and the IAM role it used. Which combination of steps will provide the necessary information? (Choose TWO.)

Accepted Answer

Examine the CloudTrail event for TerminateInstances and note the 'userIdentity' field to identify the IAM role. Then use the 'sourceIPAddress' field to find the instance's private IP. Cross-reference with VPC Flow Logs to find the network interface with that IP at the time of the event.. CloudTrail provides the IAM role (userIdentity) and the source private IP (sourceIPAddress) for the TerminateInstances call. To identify the specific compromised instance, cross-reference the source IP with VPC Flow Logs to find the network interface (ENI) associated with that IP at the time of the event. Flow logs include the ENI ID, which can be mapped to an EC2 instance. Option A is not a reliable method because VPC Flow Logs capture network traffic but do not indicate which API call a flow corresponds to; you cannot determine 'the source IP that made the API call' from flow logs alone without the CloudTrail timestamp and destination IP. Therefore, only B is a correct step.

Answer

Review the VPC Flow Logs for any traffic to the EC2 API endpoint. Look for the source IP that made the API call. Then use that IP to find the instance in the EC2 console. Check the IAM role attached to that instance.

Answer

Use AWS Config to find all EC2 instances that were terminated around that time. Then check the CloudTrail event for the IAM role. Finally, use the instance ID from the termination event to identify the source.

Answer

Check the CloudWatch Logs for the Auto Scaling group to find any error messages around the termination time. Correlate with the CloudTrail event to identify the IAM role. Then use the EC2 console to list all instances and check their IAM roles manually.

Question 17

Drag and drop the steps to set up AWS Shield Advanced with automatic application layer DDoS mitigation in the correct order.

Accepted Answer

Step 1: Subscribe to AWS Shield Advanced. Step 2: Add protection to AWS resources. Step 3: Integrate with AWS WAF and create a mitigation rule. Step 4: Enable health-based detection.. Shield Advanced requires subscription first, then resource protection, WAF integration, mitigation rule, and health-based detection.

Answer

Step 1: Add protection to AWS resources. Step 2: Subscribe to AWS Shield Advanced. Step 3: Integrate with AWS WAF and create a mitigation rule. Step 4: Enable health-based detection.

Answer

Step 1: Subscribe to AWS Shield Advanced. Step 2: Integrate with AWS WAF and create a mitigation rule. Step 3: Add protection to AWS resources. Step 4: Enable health-based detection.

Answer

Step 1: Subscribe to AWS Shield Advanced. Step 2: Add protection to AWS resources. Step 3: Enable health-based detection. Step 4: Integrate with AWS WAF and create a mitigation rule.

Question 18

Drag and drop the steps to respond to a suspected AWS IAM credential compromise in the correct order.

Accepted Answer

Rotate IAM user access keys, then review CloudTrail logs, then disable the IAM user, then revoke temporary credentials, then notify stakeholders.. Credential compromise response starts with rotation, log review, disabling user, revoking temp creds, and notification.

Answer

Review CloudTrail logs, then rotate IAM user access keys, then disable the IAM user, then revoke temporary credentials, then notify stakeholders.

Answer

Disable the IAM user, then rotate IAM user access keys, then review CloudTrail logs, then revoke temporary credentials, then notify stakeholders.

Answer

Notify stakeholders, then rotate IAM user access keys, then review CloudTrail logs, then disable the IAM user, then revoke temporary credentials.

Question 19

Match each AWS CloudTrail log type to its description.

Accepted Answer

Management events: Records management operations performed on AWS resources, such as creating or deleting VPCs.. CloudTrail has three main log types: Management events (control plane, logged by default), Data events (data plane, optional), and Insight events (anomaly detection, optional). Common confusions include swapping management vs data definitions, or misunderstanding insight events as real-time logs.

Answer

Management events: Records resource operations performed on or within a resource, such as reading or writing S3 objects.

Answer

Insight events: Records all API calls made in your account in real-time.

Question 20

A security engineer is troubleshooting an issue where Amazon GuardDuty is not generating findings for a specific EC2 instance that is known to be compromised. The instance is in a VPC with VPC Flow Logs enabled. What could be the reason for the lack of findings?

Accepted Answer

VPC Flow Logs are not being delivered to CloudWatch Logs.. GuardDuty relies on VPC Flow Logs as a data source to analyze network traffic for threats. If VPC Flow Logs are not being delivered to CloudWatch Logs, GuardDuty cannot ingest the flow data, and therefore cannot generate findings for that EC2 instance, even if the instance is compromised.

Answer

CloudTrail is not enabled in the account.

Answer

AWS Config is not enabled for the EC2 instance.

Answer

VPC Flow Logs are only enabled for the subnet, not the instance's ENI.