SCS-C02 Security Logging and Monitoring — 40 Questions

Question 1

A security engineer wants to capture all DNS queries made by EC2 instances to detect potential data exfiltration. Which AWS service should be used to log the DNS requests?

Accepted Answer

Use Route 53 Resolver DNS Firewall with query logging. Route 53 Resolver DNS Firewall with query logging is the correct choice because it is specifically designed to log all DNS queries made by EC2 instances that use the Route 53 Resolver. This service captures the domain names being queried, the source IP, and the response, enabling detection of DNS-based data exfiltration (e.g., DNS tunneling). It integrates directly with the VPC's DNS resolver, ensuring all outbound DNS traffic from EC2 instances is logged without additional agents.

Answer

Use Amazon GuardDuty

Answer

Enable VPC Flow Logs

Answer

Enable AWS CloudTrail

Question 2

A company uses AWS CloudTrail to log management events in all regions. The security team notices that some API calls made by an IAM user are not appearing in the CloudTrail event history. What is the most likely reason?

Accepted Answer

CloudTrail event history only retains events for 90 days; older events are not visible. D is correct because CloudTrail event history only retains the last 90 days of events. If the API calls were made more than 90 days ago, they would no longer appear in the event history, even though the trail itself may still be delivering log files to an S3 bucket for longer-term storage. The security team is likely looking at the event history rather than querying the S3 bucket or using Athena for older events.

Answer

The user used the AWS Management Console, not the CLI

Answer

The trail is configured for a single region only

Answer

The API calls were read-only and excluded by default

Question 3

A company requires real-time analysis of AWS CloudTrail logs to detect unauthorized API calls. The logs are stored in Amazon S3. Which architecture minimizes latency and cost?

Accepted Answer

Send CloudTrail logs to Amazon CloudWatch Logs, then use a subscription filter to Amazon Kinesis Data Firehose delivering to Amazon OpenSearch Service. Option B is correct because it provides the lowest-latency path for real-time analysis: CloudTrail logs are delivered to CloudWatch Logs in near real-time, and a subscription filter streams them to Kinesis Data Firehose, which buffers and delivers directly to Amazon OpenSearch Service for immediate indexing and search. This architecture avoids batch processing, minimizes data movement overhead, and uses managed services that scale automatically, keeping both latency and cost low.

Answer

Use AWS Glue to crawl S3 and load into Amazon Redshift for analysis

Answer

Query CloudTrail logs directly using Amazon Athena

Answer

Configure S3 event notifications to invoke an AWS Lambda function that writes to Amazon OpenSearch Service

Question 4

A security engineer needs to be alerted when an IAM user attempts to modify an S3 bucket policy. Which method is the MOST efficient?

Accepted Answer

Create an Amazon CloudWatch Events rule that matches the PutBucketPolicy API call and triggers an SNS notification. Option C is correct because Amazon CloudWatch Events (now Amazon EventBridge) can directly capture the PutBucketPolicy API call as a real-time event and trigger an SNS notification without any additional compute or polling. This is the most efficient method as it requires no log parsing, no custom code, and no additional infrastructure, providing immediate alerting with minimal overhead.

Answer

Enable VPC Flow Logs and analyze for S3 API traffic

Answer

Configure an AWS Config rule to detect changes and invoke a Lambda function

Answer

Enable S3 server access logs and parse them for PutBucketPolicy entries

Question 5

A company uses Amazon GuardDuty and wants to suppress low-severity findings that are known false positives. What is the recommended approach?

Accepted Answer

Create a GuardDuty filter to suppress the findings. GuardDuty filters allow you to automatically suppress low-severity findings that are known false positives by setting the filter action to 'ARCHIVE'. This prevents the findings from appearing in the active findings list without disabling detection or deleting data. Filters are the recommended approach because they are purpose-built for this use case and preserve the audit trail.

Answer

Configure a CloudWatch Events rule to ignore the findings

Answer

Manually delete the findings from the GuardDuty console

Answer

Disable the GuardDuty detector for the affected accounts

Question 6

A company stores sensitive data in Amazon S3 and wants to detect and alert on any public read access to objects. Which combination of services provides the most comprehensive solution?

Accepted Answer

Enable S3 server access logging and use Amazon Athena to query logs, with CloudWatch Events to alert on specific patterns. Option C is correct because S3 server access logs capture detailed records of all requests made to a bucket, including the requester, bucket name, request time, action, and response status. By using Amazon Athena to query these logs and CloudWatch Events to trigger alerts on patterns indicating public read access (e.g., a specific HTTP method like GET from an anonymous principal), you can detect and alert on unauthorized public reads comprehensively. This combination provides granular, queryable logging with event-driven alerting, covering both current and historical access patterns.

Answer

Enable VPC Flow Logs and analyze for S3 traffic

Answer

Use AWS Config rules to check for public bucket policies and alert via SNS

Answer

Enable S3 event notifications for all object-level events and send to Amazon SNS

Question 7

A security engineer needs to centrally collect and analyze AWS CloudTrail logs from multiple accounts. Which service is designed for this purpose?

Accepted Answer

Use AWS Organizations to create a CloudTrail trail that applies to all accounts. Option D is correct because AWS Organizations allows you to create a single CloudTrail trail that applies to all accounts in the organization, centrally collecting management and data events into a single S3 bucket (and optionally CloudWatch Logs). This eliminates the need to manually configure trails in each account and ensures consistent logging across the entire organization, meeting the requirement for central collection and analysis.

Answer

Configure each account to send logs to a central S3 bucket

Answer

Enable Amazon GuardDuty in each account and aggregate findings

Answer

Use Amazon CloudWatch Logs to stream logs from each account to a central account

Question 8

A company uses AWS CloudTrail and wants to ensure that any modification to the trail itself is detected immediately. What should be done?

Accepted Answer

Create a CloudWatch Events rule that matches the StopLogging or UpdateTrail API calls and sends an alert. Option C is correct because CloudWatch Events (now part of Amazon EventBridge) can be configured with a rule that matches specific API calls like StopLogging or UpdateTrail via CloudTrail. When such an API call is made, the rule triggers an action such as sending an SNS notification or invoking a Lambda function, enabling immediate detection of trail modifications. This approach directly monitors the control plane operations that alter the trail's configuration.

Answer

Configure Amazon GuardDuty to monitor for trail modifications

Answer

Enable CloudTrail Insights to detect unusual activity

Answer

Enable S3 event notifications on the trail's S3 bucket

Question 9

A security engineer needs to capture all network traffic between EC2 instances in a VPC for forensic analysis. Which TWO services should be used together? (Choose TWO.)

Accepted Answer

Amazon VPC Flow Logs. Amazon VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions. To perform forensic analysis on this raw flow log data, you can use Amazon Athena to query the logs directly from S3 using standard SQL, enabling efficient filtering and pattern detection across large volumes of network traffic.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon GuardDuty

Question 10

A company wants to use AWS CloudTrail to monitor data events for all S3 buckets. Which THREE steps are necessary? (Choose THREE.)

Accepted Answer

Specify an S3 bucket to store the log files. Option A is correct because CloudTrail requires a destination S3 bucket to store the log files it generates. Without specifying a bucket, the trail cannot persist logs, and this bucket must have appropriate bucket policies to allow CloudTrail to write logs. This is a mandatory step when creating any trail, whether for management or data events.

Answer

Create a CloudWatch Events rule to forward data events

Answer

Enable CloudTrail Insights to detect unusual data access

Question 11

Which TWO AWS services provide native integration with Amazon CloudWatch Logs for real-time monitoring of application logs? (Choose TWO.)

Accepted Answer

Amazon EC2. Amazon EC2 is correct because it can be configured to send application logs to CloudWatch Logs via the CloudWatch Logs agent or unified CloudWatch agent, enabling real-time monitoring, search, and alerting on log data. AWS Lambda is correct because it natively integrates with CloudWatch Logs: every Lambda function execution automatically streams its logs to a CloudWatch Logs group, providing real-time visibility into function output and errors.

Answer

Amazon S3

Answer

Amazon Route 53

Answer

AWS CloudTrail

Question 12

A security engineer needs to monitor cross-account access to resources. Which THREE AWS services can be used to log or detect such access? (Choose THREE.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it logs all API calls made to the AWS environment, including cross-account access events such as AssumeRole, GetFederationToken, or any action performed by an IAM role from another account. These logs capture the source identity, target resource, and request parameters, enabling security engineers to detect and audit cross-account activity.

Answer

Amazon VPC Flow Logs

Answer

Amazon Inspector

Question 13

Refer to the exhibit. A security engineer reviews a CloudTrail log entry. What is the MOST concerning security issue?

Accepted Answer

The root user is performing actions. Option B is correct because the root user is performing actions. In AWS, the root user has unrestricted access to all resources and services, and its use should be strictly limited to a few account-level tasks (e.g., closing the account, changing support plans). Routine API calls by the root user violate the principle of least privilege and indicate a serious security misconfiguration, as there is no way to audit or restrict root user permissions. CloudTrail logs showing root user activity for non-essential operations are a red flag for potential credential compromise or lack of proper IAM governance.

Answer

The security group rule allows SSH from 0.0.0.0/0

Answer

The API call failed as indicated by null response elements

Answer

The request came from an external IP address

Question 14

Refer to the exhibit. A security engineer reviews the CloudTrail trail configuration. What is a security concern?

Accepted Answer

The logs are not encrypted with a customer-managed KMS key. The security concern is that the CloudTrail logs are not encrypted with a customer-managed KMS key. By default, CloudTrail encrypts log files using SSE-S3 (S3-managed keys), which does not provide the customer with control over key rotation, access policies, or the ability to audit key usage. Using a customer-managed KMS key ensures that only authorized principals can decrypt the logs, and it enables fine-grained access control and audit trails via CloudTrail and CloudWatch Logs, which is critical for compliance and security monitoring.

Answer

The trail is not multi-region

Answer

Log file validation is not enabled

Answer

CloudWatch Logs integration is missing

Question 15

A company runs a multi-account AWS environment using AWS Organizations. The security team needs to implement centralized logging for all AWS CloudTrail events across all accounts. They create a new trail in the management account with the following configuration: trail name 'central-trail', apply to all accounts in the organization, enable data events for all S3 buckets, and store logs in a centralized S3 bucket. After one week, they notice that some accounts are not delivering CloudTrail logs to the central bucket. The security engineer verifies that the trail is still configured to apply to all accounts and that the S3 bucket policy allows cross-account access. What is the MOST likely reason for the missing logs?

Accepted Answer

Some accounts were added to the organization after the trail was created, and the trail was not updated to include them. When a trail is created in the management account with 'apply to all accounts in the organization', it automatically includes all current member accounts. However, if new accounts are added to the AWS Organization after the trail is created, the trail does not automatically extend to those new accounts. The trail must be updated (e.g., via the CloudTrail console or API) to include the newly added accounts, or the organization trail feature must be re-enabled. This is why logs from accounts added after trail creation are missing.

Answer

The member accounts have not enabled CloudTrail Insights

Answer

The S3 bucket policy does not grant the correct permissions to the member accounts

Answer

The trail is not configured as a multi-region trail

Question 16

A security engineer wants to receive real-time notifications when an AWS API call is made to delete an S3 bucket. Which service should be used to capture and forward these events to an Amazon SNS topic?

Accepted Answer

AWS CloudTrail with CloudWatch Events. AWS CloudTrail captures all API calls made to S3, including DeleteBucket. By sending these CloudTrail events to Amazon CloudWatch Events (now part of Amazon EventBridge), you can create a rule that matches the specific API call and forwards it to an SNS topic for real-time notification. This combination provides the exact event-driven pipeline needed for immediate alerting on S3 bucket deletions.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Answer

AWS Config

Question 17

A company is using AWS Organizations with multiple accounts. The security team needs to centrally monitor all root user API activity across all accounts and receive alerts within minutes. What is the MOST efficient solution?

Accepted Answer

Create an organization trail in CloudTrail that logs all accounts. Use CloudWatch Logs metric filters and alarms to detect root login events.. Option A is correct because an organization trail in AWS CloudTrail logs API activity for all accounts in AWS Organizations from a single point, eliminating the need to manage per-account trails. By sending these logs to CloudWatch Logs, you can create metric filters to detect root user login events (e.g., the 'RootLogin' event) and configure CloudWatch Alarms to trigger SNS notifications within minutes, meeting the requirement for centralized monitoring and rapid alerts.

Answer

Enable CloudTrail in each account and aggregate logs to a centralized S3 bucket. Use Athena queries to detect root activity and send alerts via SNS.

Answer

Use AWS Lambda functions in each account to poll CloudTrail logs and send root activity to a central SQS queue.

Answer

Enable AWS Config rules in each account to detect root user activity and send notifications to a central SNS topic.

Question 18

A company uses AWS CloudTrail to log all API calls. The security team notices that some expected log entries are missing for actions performed by an IAM role assumed by an EC2 instance. The instance has the required permissions. What is the MOST likely cause of the missing log entries?

Accepted Answer

The IAM role used by the EC2 instance has a permissions boundary that excludes cloudtrail:PutLogEvents.. Option D is correct because CloudTrail logs are delivered to an S3 bucket, and the IAM role must have permissions to write logs via `cloudtrail:PutLogEvents`. If a permissions boundary on the role explicitly denies this action, the role cannot deliver log entries to CloudTrail, even if the role has other required permissions. This explains why expected log entries are missing despite the instance having the necessary permissions to perform the API calls.

Answer

The EC2 instance is in a VPC that has a VPC endpoint for CloudTrail, but the endpoint policy denies logging.

Answer

CloudTrail is not logging read-only API calls by default; the trail must be configured to log read events.

Answer

CloudTrail trail is not configured to log data events for EC2.

Question 19

A security engineer is designing a monitoring solution for a multi-account AWS environment using AWS Organizations. The solution must provide a centralized view of all API activities and send alerts for suspicious events. Which TWO services together can achieve this? (Choose TWO.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it records all API activity across an AWS environment, and when integrated with AWS Organizations, it can deliver a centralized view of API calls from all accounts into a single CloudTrail trail. Amazon CloudWatch Logs is correct because it can ingest CloudTrail logs from a centralized logging account, allowing the security engineer to create metric filters and alarms that trigger alerts for suspicious events based on specific API patterns.

Answer

Amazon GuardDuty

Answer

AWS Lambda

Answer

AWS Config

Question 20

A company runs a critical application on an Auto Scaling group of EC2 instances behind an Application Load Balancer. The security team enabled VPC Flow Logs, CloudTrail, and CloudWatch Logs for the application tier. Recently, they noticed that some EC2 instances are being terminated unexpectedly by an unknown IAM user. The CloudTrail logs show the TerminateInstances API call, but the source IP address is from within the VPC CIDR range. The security team suspects the action is coming from an EC2 instance that has been compromised. They need to identify the specific compromised instance and the IAM role it used. Which combination of steps will provide the necessary information? (Choose TWO.)

Accepted Answer

Review the VPC Flow Logs for any traffic to the EC2 API endpoint. Look for the source IP that made the API call. Then use that IP to find the instance in the EC2 console. Check the IAM role attached to that instance.. Option A is correct because VPC Flow Logs capture traffic to the EC2 API endpoint (at the AWS public IP range for the region). By filtering for traffic to the EC2 API endpoint IP and looking for the source IP that made the API call, you can identify the compromised instance's private IP. Then, checking the IAM role attached to that instance in the EC2 console reveals the role used for the unauthorized action.

Answer

Use AWS Config to find all EC2 instances that were terminated around that time. Then check the CloudTrail event for the IAM role. Finally, use the instance ID from the termination event to identify the source.

Answer

Check the CloudWatch Logs for the Auto Scaling group to find any error messages around the termination time. Correlate with the CloudTrail event to identify the IAM role. Then use the EC2 console to list all instances and check their IAM roles manually.