SCS-C02 Security Logging and Monitoring Practice Test 11 — 15 Questions

Question 1

A company wants to monitor AWS account activity and receive real-time notifications for specific API calls. Which TWO services should the company use together? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Events (Amazon EventBridge). AWS CloudTrail (Option E) records all API calls made in the account, providing the raw audit log. Amazon CloudWatch Events (now part of Amazon EventBridge) (Option B) can filter these CloudTrail events in real time and trigger notifications. Together, they enable monitoring and alerting for specific API calls without polling.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon Simple Notification Service (SNS)

Question 2

A security engineer needs to ensure that all API calls made to AWS are logged and retained for at least 7 years for compliance. Which AWS service should be enabled to meet this requirement?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS, including the identity of the caller, the time of the call, the source IP address, and the request parameters. CloudTrail logs can be stored in an S3 bucket with lifecycle policies to retain logs for exactly 7 years, meeting the compliance requirement for long-term retention.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon Inspector

Question 3

A company is experiencing unauthorized access attempts to an S3 bucket. Which AWS service can be used to detect and alert on such events in real time?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads. It uses machine learning, anomaly detection, and integrated threat intelligence to analyze AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs. When it detects unauthorized access attempts to an S3 bucket, such as suspicious API calls or anomalous data access patterns, it generates real-time security findings that can be sent to Amazon CloudWatch Events for alerting and automated response.

Answer

Amazon Macie

Answer

AWS Config

Answer

AWS CloudTrail

Question 4

A company needs to monitor for root account usage and receive immediate notifications. Which combination of AWS services should be used?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Logs, and Amazon SNS. AWS CloudTrail captures all root account API calls, CloudWatch Logs can monitor those events for root activity using a metric filter, and Amazon SNS delivers immediate notifications when the filter triggers. This combination provides the logging, monitoring, and alerting pipeline required for real-time root account usage detection.

Answer

AWS Config and AWS Lambda

Answer

Amazon GuardDuty and AWS Lambda

Answer

S3 server access logs and Amazon Inspector

Question 5

A security engineer is troubleshooting an issue where CloudTrail logs are not being delivered to the specified S3 bucket. The bucket policy allows CloudTrail to write objects. What is the MOST likely cause?

Accepted Answer

The S3 bucket has a bucket policy that denies access to the CloudTrail service principal.. The most likely cause is that the S3 bucket policy explicitly denies access to the CloudTrail service principal. Even if a bucket policy allows CloudTrail to write logs, an explicit deny statement overrides any allow, preventing log delivery. This is a common misconfiguration where a deny rule is inadvertently applied to the CloudTrail principal.

Answer

The S3 bucket uses server-side encryption with customer-provided keys (SSE-C).

Answer

The S3 bucket does not have versioning enabled.

Answer

The S3 bucket is in a different AWS account.

Question 6

A company uses AWS CloudTrail to log all management events and data events for S3. The security team wants to detect any PutObject API calls that upload objects with server-side encryption disabled. Which solution is MOST efficient?

Accepted Answer

Enable CloudTrail data events for S3 and create a CloudWatch metric filter to alert on PutObject calls without the x-amz-server-side-encryption header.. CloudTrail data events for S3 capture PutObject API calls, including request parameters. A CloudWatch metric filter can be configured to match PutObject events that lack the 'x-amz-server-side-encryption' header, indicating the object was uploaded without server-side encryption. This approach is efficient as it uses existing logging infrastructure without additional scanning or parsing overhead.

Answer

Use Amazon GuardDuty to detect unencrypted uploads.

Answer

Use Amazon Macie to scan S3 objects for missing encryption.

Answer

Enable S3 server access logs and parse them with Amazon Athena.

Question 7

A company wants to receive an alert when an IAM user creates a new access key. Which AWS service should be used to trigger the alert?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events. AWS CloudTrail captures API calls made by or on behalf of an IAM user, including CreateAccessKey events. These events can be sent to Amazon CloudWatch Events (now part of Amazon EventBridge) using a rule that matches the specific API call, which then triggers an alert (e.g., via SNS or Lambda). This combination enables real-time monitoring and notification for security-sensitive actions like access key creation.

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Answer

AWS Config

Question 8

A security engineer needs to monitor for unusual outbound network traffic from an EC2 instance. Which AWS service provides this capability?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic going to and from network interfaces in a VPC, including source/destination IPs, ports, protocols, and packet counts. This allows a security engineer to analyze outbound traffic patterns from an EC2 instance and detect anomalies such as data exfiltration or communication with known malicious IPs. The logs can be published to Amazon CloudWatch Logs or Amazon S3 for further analysis with tools like Amazon Athena or third-party SIEMs.

Answer

Amazon CloudWatch Logs agent

Answer

Amazon Inspector

Answer

AWS Config

Question 9

A company is using AWS CloudTrail to log all management events and has enabled log file validation. What additional security benefit does log file validation provide?

Accepted Answer

It ensures the integrity of the log files by detecting tampering.. Log file validation uses a digital signature (SHA-256 hash) created for each log file, which is stored in a separate digest file. When validation is enabled, CloudTrail automatically creates a hash for each log file and signs it with a private key, allowing you to verify that the log files have not been modified, deleted, or tampered with after they were delivered. This ensures the integrity of the log files by detecting any unauthorized changes.

Answer

It prevents anyone from deleting the log files.

Answer

It encrypts the log files at rest.

Answer

It provides real-time monitoring for API calls.

Question 10

A company needs to monitor for unauthorized changes to security group rules. Which TWO AWS services can be used together to achieve this?

Accepted Answer

AWS Config. Options B and E are correct. AWS Config can track changes to security group rules, and Amazon CloudWatch Events can trigger a notification when a Config rule detects a change. Option A (GuardDuty) is for threat detection. Option C (Inspector) is for vulnerability scanning. Option D (CloudTrail) logs API calls but is not the best for direct rule-level monitoring.

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 11

Which TWO AWS services can be used to detect and alert on suspicious activity in near real-time?

Accepted Answer

Amazon CloudWatch Events. Amazon CloudWatch Events (now part of Amazon EventBridge) can detect suspicious activity by monitoring AWS API calls, resource state changes, and custom application events in near real-time. It can trigger automated responses, such as invoking a Lambda function or sending an SNS notification, when specific patterns (e.g., unauthorized API calls or unusual resource modifications) are detected. This makes it suitable for near real-time alerting on suspicious activity.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

AWS Config

Question 12

A security engineer configured the S3 bucket policy shown above for CloudTrail log delivery, but CloudTrail is not delivering logs. What is the MOST likely reason?

Accepted Answer

The policy does not include s3:GetBucketAcl permission.. CloudTrail requires the s3:GetBucketAcl permission on the destination S3 bucket to verify that the bucket policy grants the necessary access. Without this permission, CloudTrail cannot confirm it has write access and will fail to deliver logs. The bucket policy must explicitly allow the CloudTrail service principal to perform GetBucketAcl and PutObject actions.

Answer

The bucket is in the wrong region.

Answer

The resource ARN is incorrect.

Answer

The bucket does not have default encryption enabled.

Question 13

A security engineer runs the CLI command above to investigate a console login event. The output shows: {"type":"Root","principalId":"123456789012","arn":"arn:aws:iam::123456789012:root"}. What does this indicate?

Accepted Answer

The AWS account root user performed the console login.. The output shows `"type":"Root"` and `"arn":"arn:aws:iam::123456789012:root"`, which are the exact identifiers AWS CloudTrail uses to record an action performed by the AWS account root user. The root user is the account owner with full administrative access, and its principal ARN always ends with `:root`. This confirms that the console login was performed by the root user, not by any other identity.

Answer

A federated user performed the console login.

Answer

An AWS service performed the console login.

Answer

An IAM user in the account performed the console login.

Question 14

The IAM policy above is attached to a role used by an EC2 instance to send logs to CloudWatch Logs. The instance is unable to send logs. What is the MOST likely issue?

Accepted Answer

The policy is designed for the CloudWatch Logs service, not for an EC2 instance role.. The IAM policy shown in the question is a resource-based policy designed for CloudWatch Logs (e.g., it may use a `Principal` element or be scoped to CloudWatch Logs actions like `logs:PutLogEvents` with a resource ARN). When attached to an EC2 instance role, an identity-based policy is required, not a resource-based policy. The policy lacks the proper format and permissions for an identity-based role, causing the instance to be unable to send logs. The most likely issue is that the policy is intended for direct CloudWatch Logs service access, not for use with an EC2 instance role.

Answer

The policy does not include logs:DescribeLogGroups.

Answer

The resource ARN is incorrect.

Answer

The log group does not exist.

Question 15

A security engineer notices that an EC2 instance is sending outbound traffic to an unknown IP address. The engineer needs to capture and analyze the network traffic to determine what data is being exfiltrated. Which AWS service should be used to capture the traffic for analysis?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) for network interfaces in a VPC. This metadata can be analyzed to identify the unknown IP address, traffic volume, and communication patterns, helping determine if data exfiltration is occurring. However, VPC Flow Logs do not capture packet payloads; for full packet capture, you would need a tool like Amazon VPC Traffic Mirroring or a third-party network appliance.

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Answer

AWS CloudTrail