SCS-C02 Security Logging and Monitoring Practice Test 10 — 15 Questions

Question 1

Refer to the exhibit. An IAM policy is attached to an IAM user. The user reports that they can upload objects to the S3 bucket but cannot list the contents of the bucket. Which statement explains this behavior?

Accepted Answer

The policy does not include the s3:ListBucket action.. Option A is correct because the policy only grants s3:PutObject and s3:GetObject actions, but does not grant s3:ListBucket. The ListBucket action is required to list objects in the bucket. Option B is wrong because the policy allows PutObject and GetObject, not Deny. Option C is wrong because the policy does not include s3:ListBucket. Option D is wrong because the policy does not explicitly deny ListBucket; it just does not allow it.

Answer

The policy includes s3:ListBucket but is missing the bucket ARN.

Answer

The policy denies the s3:ListBucket action.

Answer

The policy explicitly denies s3:ListBucket.

Question 2

Refer to the exhibit. A security engineer runs the above AWS CLI command to search for CreateKeyPair events in CloudTrail. The command returns no results, but the engineer knows that a key pair was created during that time. What is the most likely reason for the missing events?

Accepted Answer

The command was run in a different region than where the key pair was created.. Option C is correct because CloudTrail events are delivered within about 15 minutes of the API call. The command looks for events in the past, so delivery time is not an issue. However, the most common reason for missing events is that the command is run in a different region than where the event occurred, or the trail is not logging management events. Option A is wrong because CloudTrail logs management events by default. Option B is wrong because key pair creation is a management event. Option D is wrong because events are delivered quickly.

Answer

CreateKeyPair is a data event and not recorded by CloudTrail.

Answer

CloudTrail events are only available after 24 hours.

Answer

CloudTrail is not enabled for management events.

Question 3

A company has a multi-account AWS environment using AWS Organizations. The security team has enabled AWS CloudTrail with an organization trail that delivers logs to a centralized S3 bucket in the management account. They have also enabled Amazon GuardDuty in all accounts. Recently, they noticed that some EC2 instances in a member account are exhibiting unusual network behavior, such as outbound traffic to known malicious IP addresses. The security engineer needs to quickly determine the source of the traffic and identify which EC2 instances are affected. The engineer has access to the management account and the member account. Which course of action should the engineer take to most efficiently investigate this incident?

Accepted Answer

Use Amazon Detective to investigate the GuardDuty findings and analyze VPC Flow Logs to identify the affected instances.. Option A is correct because Amazon Detective can automatically analyze VPC Flow Logs, CloudTrail logs, and GuardDuty findings to provide a visual investigation of the incident, including identifying the affected EC2 instances and the source of the traffic. Option B is wrong because manually querying VPC Flow Logs with Athena is time-consuming and less efficient. Option C is wrong because AWS Config does not provide network traffic analysis. Option D is wrong because Amazon Inspector is for vulnerability assessment, not network traffic analysis.

Answer

Use AWS Config to review the configuration changes of the EC2 instances and identify any anomalies.

Answer

Use Amazon Inspector to scan the EC2 instances for vulnerabilities and correlate with network traffic.

Answer

Query the VPC Flow Logs stored in the centralized S3 bucket using Amazon Athena to find the source IP and affected instances.

Question 4

A company uses AWS Organizations with multiple accounts. The security team needs to centralize CloudTrail logs from all accounts into a single S3 bucket in the management account. Which configuration ensures that only the management account can delete the log files?

Accepted Answer

Use an S3 bucket policy that denies s3:DeleteObject unless the principal is the management account.. Option D is correct because using a bucket policy with a condition that denies s3:DeleteObject unless the principal is the management account ensures that only the management account can delete objects. Option A is wrong because CloudTrail does not automatically delete logs. Option B is wrong because S3 bucket policies can be set to restrict deletion. Option C is wrong because S3 Object Lock can prevent deletion but is not specific to the management account.

Answer

Enable S3 Object Lock on the bucket with governance mode.

Answer

Use an S3 bucket policy that denies s3:DeleteObject for all principals.

Answer

Enable MFA Delete on the S3 bucket.

Answer

Configure CloudTrail to automatically delete logs older than 90 days.

Question 5

A security engineer is investigating a potential data exfiltration from an EC2 instance. CloudTrail logs show that an IAM user created a new access key for an existing IAM role and used it to call S3 GetObject from an unfamiliar IP address. What is the MOST likely reason the CloudTrail logs captured this activity?

Accepted Answer

CloudTrail was enabled to capture management events.. Option B is correct because CloudTrail records IAM user actions, including creating access keys and API calls. Option A is wrong because VPC Flow Logs do not capture IAM actions. Option C is wrong because CloudTrail is enabled by default for management events. Option D is wrong because S3 server access logs do not capture IAM user actions.

Answer

S3 server access logs were enabled on the bucket containing the objects.

Answer

VPC Flow Logs were enabled for the EC2 instance's subnet.

Answer

The security engineer had enabled CloudTrail Insights.

Answer

AWS Config was enabled to record resource changes.

Question 6

A company is required to retain CloudTrail logs for 7 years for compliance. Which solution meets this requirement with the LEAST operational overhead?

Accepted Answer

Configure an S3 Lifecycle policy to transition logs to S3 Glacier Deep Archive after 90 days and expire after 7 years.. Option D is correct because it uses an S3 Lifecycle policy to automatically transition CloudTrail logs to S3 Glacier Deep Archive after 90 days (reducing storage costs) and then expire (delete) the objects after 7 years, meeting the retention requirement with zero ongoing operational effort. This is the least operational overhead solution as it is fully automated within S3, requiring no custom code, manual intervention, or additional services.

Answer

Store logs in CloudWatch Logs with a retention period of 7 years.

Answer

Configure CloudTrail to automatically delete logs older than 7 years.

Answer

Use an AWS Lambda function to delete logs older than 7 years.

Answer

Export logs to AWS Snowball for offline archival.

Question 7

A company has enabled AWS Config to record resource changes. The security team needs to be notified when a security group is modified to allow inbound SSH from 0.0.0.0/0. Which AWS service should be used to evaluate the Config rules and trigger notifications?

Accepted Answer

AWS Config with a custom rule that triggers an SNS notification. Option B is correct because AWS Config rules evaluate resource configurations and can trigger SNS notifications. Option A is wrong because CloudTrail logs API calls but does not evaluate rules. Option C is wrong because Lambda can be used as a remediation action but not the trigger itself. Option D is wrong because GuardDuty is for threat detection. Option E is wrong because Security Hub centralizes findings but does not directly evaluate Config rules.

Answer

AWS Lambda

Answer

AWS Security Hub

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 8

A security engineer notices that an S3 bucket containing sensitive data has been accessed from an IP address outside the allowed range. CloudTrail logs show the access was made using temporary credentials from an assumed role. What additional logging is needed to trace the access back to the original IAM user who assumed the role?

Accepted Answer

Enable AWS Config to record S3 bucket policies.. Option A is correct because CloudTrail logs include the 'sessionIssuer' field for assumed roles, which identifies the user who assumed the role. Option B is wrong because VPC Flow Logs do not contain IAM user information. Option C is wrong because CloudWatch Logs is a destination, not a source of identity info. Option D is wrong because S3 server access logs do not include session issuer details. Option E is wrong because AWS Config does not record API calls.

Answer

Enable CloudTrail to log data events for the S3 bucket.

Answer

Enable VPC Flow Logs for the VPC where the request originated.

Answer

Configure CloudWatch Logs to capture the EC2 instance's system logs.

Answer

Enable S3 server access logging for the bucket.

Question 9

A company uses Amazon GuardDuty for threat detection. The security team wants to automatically isolate an EC2 instance that is communicating with a known malicious IP address. Which combination of services should be used?

Accepted Answer

GuardDuty -> EventBridge -> Lambda -> modify security group. Option B is correct because GuardDuty findings can be sent to EventBridge, which triggers a Lambda function to modify the security group. Option A is wrong because CloudWatch Alarms do not directly process GuardDuty findings. Option C is wrong because AWS Config is for configuration management. Option D is wrong because Systems Manager is for patch management. Option E is wrong because AWS Shield is for DDoS protection.

Answer

GuardDuty -> AWS Config -> Lambda -> modify security group

Answer

GuardDuty -> CloudWatch Alarm -> Lambda -> modify security group

Answer

GuardDuty -> AWS Shield -> modify security group

Answer

GuardDuty -> AWS Systems Manager -> modify security group

Question 10

A company is required to audit all changes to IAM policies. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity in your AWS account, including all IAM policy changes made via the AWS Management Console, SDKs, CLI, or AWS services. Each event is captured as a CloudTrail event with details such as the identity making the request, the time of the request, and the request parameters, enabling a complete audit trail of IAM policy modifications.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

Amazon S3

Answer

IAM Access Analyzer

Question 11

A security engineer needs to monitor AWS API calls for potential unauthorized access. The engineer wants to be alerted when a specific IAM user performs a high-risk action like deleting a CloudTrail trail. What is the MOST efficient way to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches the API call and sends an SNS notification.. Option A is correct because CloudWatch Events can filter for specific API calls and trigger an SNS notification. Option B is wrong because CloudTrail does not have built-in alerting. Option C is wrong because Athena is for querying logs, not real-time alerting. Option D is wrong because GuardDuty does not monitor for specific API calls by a user. Option E is wrong because VPC Flow Logs are for network traffic.

Answer

Configure CloudTrail to send logs to CloudWatch Logs and create a metric filter with an alarm.

Answer

Enable VPC Flow Logs and analyze with Elasticsearch.

Answer

Use Amazon Athena to query CloudTrail logs daily for the action.

Answer

Enable Amazon GuardDuty with a custom threat list.

Question 12

A company wants to detect and alert on SSH brute force attacks on EC2 instances. Which AWS service should be used?

Accepted Answer

Amazon GuardDuty. Option B is correct because GuardDuty can analyze VPC Flow Logs and DNS logs to detect brute force attempts. Option A is wrong because CloudTrail does not monitor network traffic. Option C is wrong because Inspector is for vulnerability scanning. Option D is wrong because Config is for configuration compliance. Option E is wrong because Shield is for DDoS protection.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

AWS Shield

Question 13

A security engineer is designing a centralized logging solution for multiple AWS accounts. Which TWO services should be used to aggregate logs from all accounts into a single account? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. Option A and Option C are correct. CloudTrail can be configured to deliver logs to a central S3 bucket across accounts, and CloudWatch Logs can use subscription filters to send logs to a central account. Option B is wrong because AWS Config can aggregate config data but not logs. Option D is wrong because VPC Flow Logs can be sent to S3 or CloudWatch, but not directly to a central account. Option E is wrong because S3 is a destination, not an aggregation service.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon S3

Question 14

A company is using AWS Organizations and wants to enable a central security team to view API activity across all member accounts. Which THREE steps are required? (Choose THREE.)

Accepted Answer

Grant the security team read access to the central S3 bucket via bucket policy or IAM.. Option A, Option C, and Option D are correct. CloudTrail must be enabled in each account, logs must be delivered to a central S3 bucket, and the security team must have read access to that bucket. Option B is wrong because CloudTrail can be enabled per account without Organizations. Option E is wrong because IAM roles are not needed for read access if bucket policy is used.

Answer

Enable CloudTrail in the management account only.

Answer

Create an IAM role in each account for the security team to assume.

Question 15

A security engineer is investigating a potential security incident. Which TWO AWS services can be used to analyze historical network traffic patterns? (Choose TWO.)

Accepted Answer

VPC Flow Logs. Option A and Option D are correct. VPC Flow Logs capture IP traffic information, and Amazon Athena can query VPC Flow Logs stored in S3. Option B is wrong because CloudTrail records API calls, not network traffic. Option C is wrong because GuardDuty is for real-time threat detection. Option E is wrong because CloudWatch Logs can store flow logs but is not primarily for analysis.

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

SCS-C02 Security Logging and Monitoring Practice Test 10 — 15 Questions

Exhibit

SCS-C02 Security Logging and Monitoring Practice Test 10 — 15 Questions

Exhibit