SCS-C02 Security Logging and Monitoring Practice Test 12 — 15 Questions

Question 1

A company uses AWS Organizations with multiple accounts. The security team wants to centrally monitor and analyze all CloudTrail logs from all accounts. The logs must be stored in a centralized S3 bucket with encryption and access logging enabled. Additionally, the team needs to detect anomalous API activity across accounts using machine learning. Which combination of services meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CloudTrail to deliver logs to a centralized S3 bucket with default encryption and S3 server access logs; Amazon GuardDuty enabled in all accounts.. It combines AWS CloudTrail for centralized log delivery to an S3 bucket with default encryption and server access logs, and Amazon GuardDuty, which uses machine learning to detect anomalous API activity across accounts. GuardDuty analyzes CloudTrail management events, VPC flow logs, and DNS logs to identify suspicious behavior, meeting the requirement for ML-based anomaly detection.

Answer

AWS CloudTrail to deliver logs to a centralized S3 bucket with default encryption; AWS Config to monitor API activity; S3 server access logs enabled.

Answer

AWS CloudTrail to deliver logs to a centralized S3 bucket with default encryption; Amazon Macie to detect anomalous API activity; S3 server access logs enabled.

Answer

AWS CloudTrail to deliver logs to a centralized S3 bucket with default encryption; Amazon Detective to analyze API activity; S3 server access logs enabled.

Question 2

A company wants to receive real-time notifications when specific API calls are made in their AWS account, such as IAM user creation or S3 bucket policy changes. Which AWS service should be used to trigger notifications based on these API events?

Accepted Answer

Amazon CloudWatch Events (Amazon EventBridge). Amazon CloudWatch Events (now part of Amazon EventBridge) is the correct service because it can capture AWS API calls in real time via CloudTrail integration. You can create a rule that matches specific API calls (e.g., CreateUser, PutBucketPolicy) and route those events to a target such as an SNS topic or Lambda function for immediate notification. This provides the real-time, event-driven notification required by the scenario.

Answer

Amazon GuardDuty

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS Config

Question 3

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team wants to analyze web request logs to identify potential SQL injection attacks. Which AWS service should be used to collect and analyze the ALB access logs?

Accepted Answer

Amazon Athena. Amazon Athena is the correct service because it allows you to query ALB access logs stored in Amazon S3 directly using standard SQL, without needing to load or transform the data. This makes it ideal for ad-hoc analysis of web request logs to identify patterns like SQL injection attempts, as you can run complex queries against the raw log data.

Answer

VPC Flow Logs

Answer

AWS WAF

Answer

Amazon CloudWatch Logs Insights

Question 4

A security engineer needs to monitor for unauthorized changes to IAM roles and policies in an AWS account. The engineer wants to receive an email notification whenever an IAM policy is attached to a role. Which AWS services should be combined to achieve this?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events (Amazon EventBridge). AWS CloudTrail logs all API calls, including AttachRolePolicy, and CloudWatch Events (EventBridge) can filter for that specific event and trigger an action such as sending an email via SNS. This combination allows real-time monitoring and notification for unauthorized IAM policy attachments to roles.

Answer

Amazon GuardDuty and Amazon Simple Email Service (SES)

Answer

AWS Config and Amazon Simple Notification Service (SNS)

Answer

Amazon Inspector and Amazon CloudWatch Logs

Question 5

A company has enabled AWS CloudTrail in all regions and is delivering logs to an S3 bucket. The security team wants to ensure that any attempt to disable CloudTrail logging is detected and alerted. Which approach should be used?

Accepted Answer

Create a CloudWatch Events rule that matches the StopLogging API call and sends a notification via SNS.. CloudTrail's `StopLogging` API call is an AWS API event that can be captured by a CloudWatch Events (now Amazon EventBridge) rule. By creating a rule that matches the `StopLogging` event source and detail type, you can trigger an SNS notification to alert the security team immediately when any attempt to disable CloudTrail logging occurs. This provides real-time detection and response, which is the most direct and effective approach for this specific requirement. While GuardDuty can also detect CloudTrail disablement, CloudWatch Events is the most direct event-driven option and gives full control over alerting.

Answer

Enable Amazon GuardDuty to detect CloudTrail disablement.

Answer

Use AWS Config to create a rule that checks if CloudTrail is enabled.

Answer

Enable VPC Flow Logs to capture traffic to the CloudTrail endpoint.

Question 6

A security engineer is investigating a potential security incident involving an EC2 instance. The engineer needs to determine if any unauthorized SSH keys were added to the instance's authorized_keys file. Which AWS service should be used to detect this change?

Accepted Answer

AWS Config. AWS Config is the correct service because it can be used to monitor configuration changes to EC2 instances, including changes to the authorized_keys file when integrated with AWS Systems Manager. While AWS Config does not natively track guest OS file changes, you can create a custom AWS Config rule that invokes a Lambda function to check the instance's Systems Manager inventory or run a command to verify the file contents. CloudTrail tracks API calls but does not monitor internal OS changes. Amazon Inspector and GuardDuty focus on vulnerabilities and threats, not configuration changes. Therefore, AWS Config, with appropriate custom rules, is the best choice among the options.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Question 7

A company is designing a centralized logging solution for multiple AWS accounts. The solution must meet the following requirements: 1) Logs from all accounts must be stored in a centralized S3 bucket. 2) The logs must be encrypted at rest using AWS KMS. 3) Access to the logs must be logged and monitored. Which TWO services should be used to meet the requirements? (Choose TWO.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it can be configured to deliver log files from multiple AWS accounts into a single centralized S3 bucket, meeting the requirement for centralized logging. It also integrates with AWS KMS to encrypt the log files at rest using customer-managed keys, satisfying the encryption requirement.

Answer

Amazon GuardDuty

Answer

Amazon Macie

Answer

AWS Config

Question 8

A security engineer is configuring Amazon GuardDuty in a multi-account environment using AWS Organizations. The engineer needs to ensure that all findings from member accounts are visible in the administrator account. Additionally, the engineer wants to receive real-time notifications for high-severity findings. Which TWO actions should the engineer take? (Choose TWO.)

Accepted Answer

Designate an administrator account in GuardDuty to manage the multi-account environment.. Designating an administrator account in GuardDuty is the required step to centrally manage findings from all member accounts in an AWS Organizations multi-account setup. This configuration enables the administrator account to view and aggregate all findings from member accounts without needing to log into each account individually.

Answer

Enable Amazon Detective to analyze GuardDuty findings.

Answer

Enable AWS CloudTrail in all member accounts to log GuardDuty API calls.

Answer

Use AWS Config to monitor GuardDuty configuration.

Question 9

A company needs to monitor its AWS environment for compliance with the CIS AWS Foundations Benchmark. The security team wants to automatically check for non-compliant resources and receive reports. Which THREE services should be used together to meet these requirements? (Choose THREE.)

Accepted Answer

AWS Security Hub. AWS Security Hub (B) provides a single pane of glass for security posture management, including automated compliance checks against the CIS AWS Foundations Benchmark. AWS Config (C) defines and evaluates resource configurations against the benchmark rules, identifying non-compliant resources. Amazon GuardDuty (D) continuously monitors for malicious activity and unauthorized behavior, providing threat detection findings that Security Hub aggregates. Together, these three services enable automated compliance checks, detection of security threats, and consolidated reporting.

Answer

Amazon Detective

Answer

Amazon Macie

Question 10

A security engineer is investigating a potential compromise. They notice that an IAM user 'svc-backup' has been making unusual API calls from an IP address outside the company's VPC. The engineer wants to ensure all future API calls from this user are logged with full event details. However, the current CloudTrail trail is set to log only management events. What should the engineer do to capture the required details?

Accepted Answer

Update the existing trail to log data events for IAM.. CloudTrail trails configured to log only management events do not capture IAM user activity such as API calls made by the user. By updating the existing trail to log data events for IAM, the engineer ensures that all future API calls from 'svc-backup' are logged with full event details, including the source IP address and request parameters. This directly addresses the requirement without creating unnecessary additional trails or services.

Answer

Enable VPC Flow Logs and correlate with CloudTrail logs.

Answer

Create a new trail that logs data events for S3 and configure it to deliver to a separate S3 bucket.

Answer

Enable CloudTrail Insights to detect unusual activity for the user.

Question 11

A security engineer is troubleshooting why Amazon GuardDuty is not generating findings for suspicious S3 API calls made by an IAM role. The engineer has verified that GuardDuty is enabled in the account and region. What is a likely reason for the missing findings?

Accepted Answer

CloudTrail management events are not being logged for the IAM role.. Amazon GuardDuty relies on CloudTrail management events to analyze S3 API calls at the bucket level (e.g., PutBucketPolicy, DeleteBucket) for suspicious activity. If CloudTrail management events are not being logged for the IAM role, GuardDuty will not receive the necessary data to generate findings for these specific calls. Note that for object-level operations such as GetObject or PutObject, S3 data events would need to be enabled, but the question refers to suspicious S3 API calls that are management events.

Answer

VPC Flow Logs are not enabled for the VPC where the role is used.

Answer

The account is not a Delegated Admin for GuardDuty.

Answer

S3 data events are not enabled in CloudTrail.

Question 12

A company uses AWS Organizations and wants to enable Amazon GuardDuty across all member accounts. The security team wants to centrally manage findings and automate responses. What is the MOST efficient way to achieve this?

Accepted Answer

Designate a Delegated Administrator account for GuardDuty in AWS Organizations and enable GuardDuty for all accounts from that account.. AWS Organizations allows you to designate a Delegated Administrator account for GuardDuty, which can then enable GuardDuty and manage findings centrally across all member accounts without manual per-account setup. This approach is the most efficient as it leverages the Organizations integration to automatically enable GuardDuty in new accounts and centralize finding management, reducing operational overhead.

Answer

Use AWS CloudFormation StackSets to deploy a GuardDuty detector in each account.

Answer

Enable AWS Security Hub in the management account and configure it to ingest GuardDuty findings from member accounts.

Answer

Enable GuardDuty in each member account individually and configure cross-account access to a central S3 bucket.

Question 13

A company has a CloudTrail trail that logs management events and delivers them to an S3 bucket. The security team notices that some expected API calls are missing from the logs. They suspect that the calls were made by a service that is not tracked by CloudTrail. Which AWS service is NOT tracked by CloudTrail?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is not tracked by CloudTrail because CloudFront uses a different logging mechanism: it generates its own access logs that are delivered to an S3 bucket, but these logs are not CloudTrail events. CloudTrail only records API calls made to AWS services via the AWS Management Console, SDKs, or CLI, and CloudFront does not expose its configuration changes or data plane operations through CloudTrail. Therefore, if expected API calls are missing, they could be CloudFront operations that are simply not captured by CloudTrail.

Answer

AWS Lambda

Answer

Amazon S3

Answer

Amazon EC2

Question 14

A security engineer is configuring Amazon Inspector to assess EC2 instances for software vulnerabilities. The engineer has installed the SSM Agent on all instances and ensured that the instances have internet access. However, Amazon Inspector shows the instances as 'Unmanaged'. What is the MOST likely cause?

Accepted Answer

The SSM Agent is not running or is not registered with AWS Systems Manager.. Amazon Inspector requires EC2 instances to be managed by AWS Systems Manager (SSM) to install the SSM Agent and register it with the Systems Manager service. If the SSM Agent is not running or not registered, the instance cannot communicate with Systems Manager, and Inspector will report it as 'Unmanaged'. Even with internet access and the agent installed, the agent must be actively running and registered for the instance to be properly managed.

Answer

The IAM role attached to the EC2 instance does not have permissions to publish metrics to CloudWatch.

Answer

The security group attached to the instance blocks outbound traffic to the Amazon Inspector service.

Answer

The instance does not have the EC2 instance metadata service enabled.

Question 15

A company wants to detect and respond to potential security threats in near real-time. Which THREE AWS services should the company use together? (Select THREE.)

Accepted Answer

AWS Security Hub. AWS Security Hub (A) aggregates security findings from multiple AWS services, including Amazon GuardDuty (E) and Amazon Detective (C), into a single dashboard. GuardDuty provides near real-time threat detection by analyzing VPC Flow Logs, DNS logs, and CloudTrail events using machine learning. Detective automates the investigation of those findings by correlating historical data to identify root causes. Together, these three services enable near real-time detection and response to security threats.

Answer

Amazon Inspector

Answer

AWS CloudTrail