SCS-C02 Security Logging and Monitoring Practice Test 10 — 15 Questions

Question 1

A company has enabled CloudTrail in all regions and is logging to a single S3 bucket. The security team needs to ensure that any attempted deletion of CloudTrail logs generates an immediate alert. Which solution meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an S3 event notification on the bucket for s3:ObjectRemoved:* events, invoke a Lambda function to publish to an SNS topic.. S3 event notifications can be configured to trigger a Lambda function on `s3:ObjectRemoved:*` events, which captures all object deletion actions (including DeleteObject and DeleteObjects API calls). The Lambda function can then publish a message to an SNS topic, enabling immediate alerting. This approach provides real-time, event-driven monitoring directly from S3, without relying on CloudTrail log ingestion delays.

Answer

Use AWS Config to create a rule that checks for deleted objects and sends an SNS notification.

Answer

Enable CloudTrail Insights to detect unusual deletion activity and send alerts.

Answer

Create a CloudWatch Logs metric filter on the CloudTrail log group for DeleteObject events and trigger an alarm.

Question 2

A security engineer is investigating a potential data exfiltration incident. The engineer has enabled VPC Flow Logs for the VPC and CloudTrail for the account. Which combination of actions would provide the most comprehensive visibility into network traffic and API calls?

Accepted Answer

Enable VPC Flow Logs to capture network traffic and use CloudTrail to capture API calls. Correlate both logs for a complete view.. VPC Flow Logs capture network metadata, and CloudTrail records API calls. Correlating these logs provides comprehensive visibility. Both option A (enabling and using both) and option C (analyzing CloudTrail and correlating with VPC Flow Logs) are valid approaches, especially since the engineer has already enabled both services. Therefore, C should also be considered correct.

Answer

Use AWS Config to track resource changes and CloudTrail to detect network anomalies.

Answer

Use VPC Flow Logs to identify API calls and network traffic.

Question 3

A security team needs to monitor for failed login attempts to an EC2 instance running Linux. The team wants to send a real-time alert when more than 10 failed SSH attempts occur within 5 minutes. Which solution is the most efficient?

Accepted Answer

Install the CloudWatch Logs agent on the EC2 instance to stream /var/log/secure to CloudWatch Logs. Create a metric filter for 'Failed password' and set a CloudWatch alarm.. The CloudWatch Logs agent can stream /var/log/secure (which logs SSH authentication events) to CloudWatch Logs. A metric filter on the 'Failed password' pattern counts failed SSH attempts, and a CloudWatch alarm with a threshold of 10 within a 5-minute period triggers a real-time alert. This is the most efficient solution as it directly monitors the specific log source for SSH failures without additional overhead.

Answer

Enable VPC Flow Logs and filter for SSH traffic to detect failed attempts.

Answer

Configure the EC2 instance to write failed attempts to a file in S3 and use S3 events to trigger a Lambda function for alerting.

Answer

Enable Amazon GuardDuty and create a custom threat list for failed SSH attempts.

Question 4

A security analyst needs to receive an alert when an IAM user attempts to perform an action they are not authorized to perform. Which AWS service can be used to monitor and alert on such authorization failures?

Accepted Answer

AWS CloudTrail with CloudWatch metric filter and alarm. AWS CloudTrail logs all API calls made by IAM users, including authorization failures (e.g., AccessDenied errors). By creating a CloudWatch metric filter on CloudTrail logs for specific error codes like 'AccessDenied' or 'UnauthorizedOperation', you can trigger a CloudWatch alarm to send notifications via SNS. This is the standard AWS approach for monitoring and alerting on unauthorized actions.

Answer

AWS Organizations SCPs

Answer

AWS IAM Access Analyzer

Answer

AWS Config

Question 5

A security engineer is configuring a centralized logging solution for multiple AWS accounts. The engineer needs to ensure that log files are encrypted at rest and that access to the logs is audited. Which combination of services and features should be used?

Accepted Answer

Use S3 SSE-KMS and enable CloudTrail for S3 data events.. It uses S3 SSE-KMS to encrypt log files at rest with AWS KMS, providing centralized key management and fine-grained access control. Enabling CloudTrail for S3 data events (e.g., GetObject, PutObject) ensures that every access to the logs is audited, meeting both encryption and audit requirements.

Answer

Use S3 SSE-S3 and enable S3 access logs.

Answer

Use AWS KMS to encrypt the logs before uploading to S3.

Answer

Use S3 SSE-C and enable CloudTrail for S3 data events.

Question 6

A security engineer is designing a logging strategy for a multi-account environment. The engineer needs to ensure that all API activity across accounts is logged and that logs are immutable and centrally accessible. Which THREE actions should the engineer take?

Accepted Answer

Create an AWS CloudTrail organization trail that logs to a central S3 bucket.. AWS CloudTrail organization trails automatically aggregate API activity from all member accounts in an AWS Organizations setup, delivering log files to a single, centrally managed S3 bucket. This eliminates the need to configure individual trails per account, ensuring comprehensive and centralized logging of all API calls across the multi-account environment.

Answer

Stream logs to CloudWatch Logs for real-time monitoring.

Answer

Enable VPC Flow Logs in all accounts and send to the central bucket.

Question 7

A company wants to monitor for unauthorized changes to security group rules in their VPC. Which TWO AWS services can be used together to detect and alert on such changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it records API calls made to the EC2 service, including AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress, and CreateSecurityGroup. By monitoring CloudTrail events for these specific API actions, you can detect unauthorized changes to security group rules. AWS Config is correct because it provides a managed rule called 'restricted-common-ports' or custom rules that can evaluate security group configurations against desired policies, and it can trigger alerts via Amazon SNS when a security group rule is changed.

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Answer

Amazon Macie

Question 8

Refer to the exhibit. A security engineer has attached this IAM policy to a user. What is the effect of this policy?

Accepted Answer

Allows uploads with KMS encryption or without encryption.. The IAM policy uses a `Deny` effect with a `NotPrincipal` condition that denies uploads unless the request includes the `s3:x-amz-server-side-encryption` header with value `aws:kms`. However, the `Condition` block uses `StringNotEquals`, which means any request that does NOT have the encryption header set to `aws:kms` is denied. This effectively allows uploads with KMS encryption (header matches) or without encryption (no header present, because `StringNotEquals` does not match a missing header — the condition evaluates to false, so the Deny does not apply). Therefore, uploads without encryption are allowed by default (since there is no explicit Allow), and uploads with KMS encryption are also allowed.

Answer

Allows uploads only when encryption is not specified.

Answer

Denies uploads when encryption is not provided.

Answer

Allows uploads only when using KMS encryption.

Question 9

Refer to the exhibit. A security engineer runs this CloudWatch Logs Insights query on a log group. What is the purpose of this query?

Accepted Answer

Retrieve the 20 most recent log events that contain 'ERROR' or 'WARN'.. The CloudWatch Logs Insights query uses `filter @message like /(?i)(ERROR|WARN)/` to match log events containing either 'ERROR' or 'WARN' (case-insensitive), then `sort @timestamp desc` orders them by most recent first, and `limit 20` restricts the output to the top 20 results. This retrieves the 20 most recent log events that contain either term, making option B correct.

Answer

Retrieve the 20 most recent log events that contain only 'ERROR'.

Answer

Display all log events grouped by log level.

Answer

Count the number of ERROR and WARN events in the last hour.

Question 10

A security engineer is configuring AWS CloudTrail to log management events for all AWS regions. The engineer needs to ensure that log files are encrypted at rest and that access to the log files is logged. Which solution meets these requirements?

Accepted Answer

Enable CloudTrail with SSE-S3 encryption and enable S3 server access logging on the destination bucket.. Both SSE-S3 and SSE-KMS are valid encryption options for CloudTrail log files. Enabling S3 server access logging on the destination bucket logs all access requests to the log files regardless of whether SSE-S3 or SSE-KMS is used. The requirement does not specify a need for customer-managed keys or key auditing, so SSE-S3 (option B) is equally valid as SSE-KMS (option D). The current explanation incorrectly states that SSE-KMS is the only option that provides both requirements.

Answer

Enable CloudTrail with SSE-C encryption and enable AWS CloudTrail Insights to log access.

Answer

Enable CloudTrail with default encryption and enable AWS Config to log access.

Question 11

A security team has enabled AWS CloudTrail in all regions and is delivering logs to an S3 bucket. The team has also enabled S3 server access logging for the CloudTrail bucket. The team needs to detect any unauthorized access to the CloudTrail logs. Which combination of services should the team use to achieve near-real-time detection?

Accepted Answer

Amazon GuardDuty and Amazon CloudWatch Events. Amazon GuardDuty continuously monitors S3 data plane events, including CloudTrail log delivery and S3 server access logs, to detect suspicious API calls or unauthorized access patterns. Amazon CloudWatch Events (now part of Amazon EventBridge) can trigger near-real-time alerts when GuardDuty generates findings, enabling immediate response. This combination provides the required near-real-time detection without relying on batch analysis or configuration rules.

Answer

AWS CloudTrail Insights and Amazon CloudWatch

Answer

Amazon Athena and Amazon QuickSight

Answer

AWS Config and Amazon SNS

Question 12

A company wants to centralize logging from multiple AWS accounts into a single logging account. The logs include AWS CloudTrail, AWS Config, and VPC Flow Logs. Which solution should the company implement to meet these requirements with minimal operational overhead?

Accepted Answer

Configure each account to deliver logs to its own S3 bucket and use S3 cross-region replication to copy logs to the central bucket.. It uses S3 cross-region replication, which can replicate any log data delivered to S3 from CloudTrail, AWS Config, and VPC Flow Logs in each account to a central bucket. This approach centralizes all three log types with minimal ongoing operational overhead—only initial configuration of replication rules is required. Options A, C, and D either do not cover all log types or require more complex per-account setups.

Answer

Use Amazon Kinesis Data Firehose in each account to send logs to a central Amazon S3 bucket.

Answer

Use AWS Organizations to create a CloudTrail trail that applies to all accounts and delivers logs to a central S3 bucket.

Answer

Use AWS Lambda functions in each account to copy log files to a central S3 bucket.

Question 13

A security engineer needs to monitor AWS account activity for suspicious API calls and receive alerts. Which AWS service should the engineer use to meet this requirement?

Accepted Answer

AWS CloudTrail with CloudWatch Alarms. AWS CloudTrail records all API calls made to the AWS environment, providing a detailed audit trail of account activity. By sending these logs to Amazon CloudWatch, you can create metric filters that match suspicious API call patterns and trigger CloudWatch Alarms to send notifications via SNS. This combination directly meets the requirement to monitor and alert on specific API calls.

Answer

VPC Flow Logs

Answer

AWS Config with AWS Config Rules

Answer

Amazon GuardDuty

Question 14

A company has a requirement to retain AWS CloudTrail logs for 7 years for compliance. The logs are stored in an S3 bucket. The company wants to reduce storage costs by automatically moving older logs to a cheaper storage class. Which solution should the company implement?

Accepted Answer

Configure an S3 Lifecycle policy to transition objects from S3 Standard to S3 Glacier after a specified number of days.. An S3 Lifecycle policy can automatically transition CloudTrail logs from S3 Standard to S3 Glacier after a specified number of days, meeting the 7-year retention requirement while reducing storage costs. S3 Glacier is designed for long-term archival at low cost, and lifecycle rules can be configured to transition objects directly or through intermediate classes like S3 Standard-IA. S3 Intelligent-Tiering (Option A) also automatically optimizes costs and supports archival tiers, but it works based on access patterns, not fixed age-based rules, and incurs per-object monitoring fees. For compliance-driven, age-based retention, a Lifecycle policy is the more direct and cost-effective solution.

Answer

Use S3 Intelligent-Tiering to automatically move logs to the most cost-effective access tier.

Answer

Move logs to S3 Standard-IA after 30 days.

Answer

Use S3 Batch Operations to manually copy logs to S3 Glacier.

Question 15

A company is using Amazon CloudWatch Logs to collect logs from its EC2 instances. The security team wants to ensure that logs are encrypted at rest and that access to the logs is controlled. Which solution should the team implement?

Accepted Answer

Enable encryption using AWS KMS customer managed keys (CMK) and apply IAM policies to control access.. CloudWatch Logs supports encryption at rest using AWS KMS customer managed keys (CMK), which allows the security team to control access to the encrypted log data via IAM policies and key policies. This ensures both encryption and fine-grained access control, meeting the requirements.

Answer

Use SSE-C with a customer-provided key to encrypt log data.

Answer

Use SSE-S3 to encrypt the log data in CloudWatch Logs.

Answer

Enable default encryption on the log group and use S3 bucket policies.