SCS-C02 Security Logging and Monitoring Practice Test 10 — 15 Questions

Question 1

A Security Engineer is troubleshooting why AWS CloudTrail is not delivering logs to an S3 bucket. The bucket policy allows CloudTrail access. What is a likely cause of the issue?

Accepted Answer

The S3 bucket uses SSE-KMS and the key policy does not grant CloudTrail permission. When an S3 bucket uses SSE-KMS (Server-Side Encryption with AWS KMS), CloudTrail must have explicit permissions in the KMS key policy to decrypt the key and encrypt log files. Even if the S3 bucket policy grants CloudTrail access, the KMS key policy is a separate authorization layer; without a statement allowing CloudTrail to use the kms:GenerateDataKey and kms:Decrypt actions, log delivery will fail silently or with access denied errors.

Answer

The S3 bucket has a lifecycle policy that deletes objects too quickly

Answer

CloudTrail is not enabled in the region

Answer

The S3 bucket is in a different region than the trail

Question 2

A company wants to monitor failed SSH login attempts to EC2 instances. Which approach should be used?

Accepted Answer

Use the CloudWatch Logs agent to send /var/log/auth.log to CloudWatch Logs. Failed SSH login attempts are logged by the SSH daemon (sshd) to the system's authentication log file, typically /var/log/auth.log on Debian-based systems or /var/log/secure on Red Hat-based systems. The CloudWatch Logs agent can be configured to tail this log file and send the entries to CloudWatch Logs, where you can create metric filters to detect patterns like 'Failed password' and trigger alarms or automated responses.

Answer

Enable AWS CloudTrail for EC2 instances

Answer

Enable VPC Flow Logs

Answer

Use AWS Config to detect SSH access

Question 3

A company has a CloudTrail trail that logs management events for all regions. The security team notices that some S3 data events are not being logged. How should the team enable logging for all S3 data events?

Accepted Answer

Update the existing CloudTrail trail to include data events for S3. CloudTrail trails can be configured to log data events for S3 in addition to management events. By updating the existing trail to include S3 data events (e.g., GetObject, PutObject), the security team can capture all object-level API activity without creating a separate trail. This ensures comprehensive logging while maintaining the existing management event logging for all regions.

Answer

Create a new CloudTrail trail that logs only data events

Answer

Use Amazon GuardDuty to monitor S3 access

Answer

Enable S3 server access logging on each bucket

Question 4

A company needs to be alerted when root account credentials are used in their AWS account. Which service should be used to create a metric filter and alarm for this event?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs can monitor CloudTrail log events for root account usage by creating a metric filter that matches the `userIdentity.type` field with a value of `Root`. When the filter detects a match, it triggers a CloudWatch alarm to notify the operations team. This is the standard AWS-recommended approach for alerting on root activity.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

AWS CloudTrail

Question 5

A company uses AWS Organizations to manage multiple accounts. The security team wants to enable CloudTrail for all accounts and centrally store logs. What is the most efficient way to achieve this?

Accepted Answer

Create a CloudTrail trail in the management account and apply it to all accounts in the organization. AWS Organizations allows you to create a single CloudTrail trail in the management account that automatically applies to all member accounts within the organization. This is the most efficient method as it eliminates the need for manual per-account configuration or custom automation, and it ensures consistent logging across the entire organization with centralized log delivery to a single S3 bucket.

Answer

Use an S3 bucket policy to allow cross-account log delivery

Answer

Use AWS Lambda to create trails in each account

Answer

Ask each account admin to create their own CloudTrail trail and deliver to a central S3 bucket

Question 6

A security engineer needs to analyze VPC Flow Logs to identify traffic to a known malicious IP address. The logs are stored in Amazon S3. Which approach is the most cost-effective for querying the logs?

Accepted Answer

Use Amazon Athena to query the logs in S3. Amazon Athena is the most cost-effective option because it is a serverless query service that allows you to run SQL queries directly on data stored in S3, including VPC Flow Logs, without needing to load or transform the data. You pay only for the data scanned per query, and with partitioning (e.g., by date or region), you can minimize costs by scanning only relevant log files. This avoids the overhead of provisioning clusters or managing infrastructure, making it ideal for ad-hoc analysis of malicious IP traffic.

Answer

Load the logs into an Amazon Redshift cluster

Answer

Use Amazon EMR to run Spark jobs

Answer

Use Amazon QuickSight to connect to S3

Question 7

A company wants to receive notifications when AWS CloudTrail logs are delivered to an S3 bucket. Which TWO AWS services can be used together to achieve this? (Choose TWO.)

Accepted Answer

Amazon S3 Event Notifications. Amazon S3 Event Notifications can be configured to publish events (like `s3:ObjectCreated:*`) when CloudTrail logs are delivered to the S3 bucket. These notifications can be sent directly to Amazon SNS, which then delivers the notification to subscribers (e.g., email, SMS, or HTTP endpoints). Together, S3 Event Notifications and SNS provide a serverless, real-time notification pipeline without needing custom polling or compute resources.

Answer

AWS CloudTrail

Answer

AWS Lambda

Answer

Amazon Simple Queue Service (SQS)

Question 8

A security engineer needs to monitor DNS query logs for malicious domain names. Which THREE services can be used together to collect, analyze, and alert on DNS logs? (Choose THREE.)

Accepted Answer

Amazon CloudWatch Logs. Amazon Route 53 Resolver Query Logs (C) is the correct source because it captures DNS queries made by resources in a VPC, including the queried domain name, query type, and response code, which is exactly the raw DNS log data needed for detecting malicious domains. Amazon CloudWatch Logs (A) is correct because Resolver query logs can be published to a CloudWatch Logs log group, where they are stored and made available for metric filters, subscriptions, and retention management. AWS Lambda (B) is correct because a CloudWatch Logs subscription filter can stream matching log events to a Lambda function, which can then parse the DNS records, check domains against threat intelligence, and trigger alerts via SNS or other services. Amazon GuardDuty (D) is not part of this collection/analysis/alerting pipeline for raw DNS query logs; it is a managed threat detection service that analyzes its own findings rather than ingesting and processing Resolver query logs for custom alerting. Amazon Athena (E) is a query service for data in S3 and, while it can analyze logs stored in S3, it is not one of the three services used together here to collect, process, and alert on DNS logs in this scenario.

Answer

Amazon GuardDuty

Answer

Amazon Athena

Question 9

A company wants to ensure that all API calls in their AWS account are logged and immutable. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Enable S3 Object Lock on the CloudTrail S3 bucket. Enabling S3 Object Lock on the CloudTrail S3 bucket ensures that log files are immutable and cannot be overwritten or deleted by any user, including root. This is achieved through a write-once-read-many (WORM) model, which is essential for maintaining a tamper-proof audit trail of all API calls.

Answer

Enable MFA delete on the S3 bucket

Answer

Use AWS Config rules to monitor CloudTrail configuration

Answer

Encrypt the S3 bucket with AWS KMS

Question 10

Refer to the exhibit. The security team is investigating a security incident in us-west-2 region. They notice that management events from us-west-2 are not appearing in the CloudTrail logs. Based on the exhibit, what is the most likely reason?

Accepted Answer

The trail is not a multi-region trail. The exhibit shows a single-region CloudTrail trail. A single-region trail only logs events in the region where it is created. Since management events from us-west-2 are not appearing, the trail must have been created in a different region. To capture events from us-west-2, the trail would need to be multi-region. Therefore, the most likely reason is that the trail is not a multi-region trail.

Answer

The S3 bucket is in a different region

Answer

The trail is not logging data events

Answer

The trail does not have log file validation enabled

Question 11

A company uses AWS CloudTrail to log all API calls in their AWS account. They need to ensure that log files are not tampered with after they are delivered to the S3 bucket. Which feature should be enabled to provide integrity validation?

Accepted Answer

Enable CloudTrail log file integrity validation.. CloudTrail log file integrity validation uses a SHA-256 hash chain to detect if log files have been modified, deleted, or tampered with after delivery to S3. When enabled, CloudTrail delivers a digest file that contains hashes of the log files, allowing you to verify that no unauthorized changes have occurred. This is the only feature specifically designed for integrity validation of CloudTrail logs.

Answer

Enable S3 Versioning on the CloudTrail bucket.

Answer

Enable S3 server-side encryption with SSE-S3.

Answer

Enable S3 Object Lock on the CloudTrail bucket.

Question 12

A company uses Amazon RDS for MySQL and wants to monitor database activity for security analysis. Which AWS service should be used to capture detailed database activity logs such as login attempts and query execution?

Accepted Answer

Amazon RDS Database Activity Streams. Amazon RDS Database Activity Streams is the correct service because it captures a near-real-time stream of database activity, including login attempts, query execution, and other operations at the database engine level. It integrates with AWS CloudWatch and third-party monitoring tools, providing granular audit logs for security analysis that go beyond what CloudTrail or Enhanced Monitoring offer.

Answer

AWS CloudTrail

Answer

Amazon RDS Enhanced Monitoring

Answer

AWS Config

Question 13

A security team wants to collect and analyze logs from multiple AWS services including CloudTrail, VPC Flow Logs, and AWS WAF. They need a centralized solution that can filter, transform, and route logs to multiple destinations in near real-time. Which AWS service should they use?

Accepted Answer

Amazon Kinesis Data Streams combined with Amazon Kinesis Data Firehose. Amazon Kinesis Data Streams combined with Amazon Kinesis Data Firehose is the correct choice because it provides a fully managed, scalable, and near real-time pipeline for collecting, filtering, transforming, and routing logs from multiple AWS services (CloudTrail, VPC Flow Logs, WAF) to multiple destinations such as Amazon S3, Amazon Redshift, or Amazon Elasticsearch Service. Kinesis Data Streams captures and stores the data stream, while Kinesis Data Firehose can invoke AWS Lambda for transformation and reliably deliver the processed logs to the specified sinks, meeting the requirement for centralized, near real-time log processing.

Answer

Amazon CloudWatch Logs Insights

Answer

Amazon CloudWatch Logs subscription filters with AWS Lambda

Answer

Amazon S3 with S3 Event Notifications

Question 14

A company wants to detect and alert on unauthorized API calls in their AWS account. Which AWS service can provide real-time notifications when specific API calls are made?

Accepted Answer

Amazon CloudWatch Events (EventBridge). Amazon CloudWatch Events (now part of Amazon EventBridge) can capture real-time API calls made to AWS services by using a rule that matches specific API calls via CloudTrail integration. When a matching API call occurs, EventBridge can trigger a target such as an SNS topic or Lambda function to send a notification, enabling immediate alerting on unauthorized API calls.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 15

A company uses AWS CloudTrail and wants to ensure that logs are encrypted at rest using a customer-managed KMS key. The CloudTrail trail is configured to deliver logs to an S3 bucket. After enabling SSE-KMS on the S3 bucket, the logs are not being delivered. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant CloudTrail permission to use the key.. CloudTrail requires explicit permissions in the KMS key policy to use the key for encrypting log files. Even if SSE-KMS is enabled on the S3 bucket, CloudTrail must have `kms:GenerateDataKey` and `kms:Decrypt` permissions granted via the key policy. Without these, CloudTrail cannot encrypt the logs, causing delivery to fail.

Answer

CloudTrail does not support SSE-KMS.

Answer

The KMS key is in a different AWS account.

Answer

The S3 bucket policy does not allow CloudTrail to write logs.