SCS-C02 Security Logging and Monitoring Practice Test 12 — 15 Questions

Question 1

A company has a requirement to retain CloudTrail logs for 7 years for compliance. They currently store logs in an S3 bucket with standard storage. The security team wants to minimize storage costs while meeting the retention requirement. The logs must be available for retrieval within 24 hours of a request. Which storage class should the team use for the logs after the first 30 days?

Accepted Answer

S3 Glacier Deep Archive. Option B is correct because Glacier Deep Archive is the lowest cost for long-term archival with retrieval times up to 12 hours, which meets the 24-hour requirement. Option A is wrong because Standard-IA is more expensive than Deep Archive. Option C is wrong because Glacier Flexible Retrieval has retrieval times of minutes to hours, but Deep Archive is cheaper. Option D is wrong because One Zone-IA is not durable enough for compliance data.

Answer

S3 Glacier Flexible Retrieval

Answer

S3 One Zone-IA

Answer

S3 Standard-IA

Question 2

A security engineer is troubleshooting an issue where CloudTrail logs for a single AWS account are not being delivered to the centralized S3 bucket in the logging account. The engineer has verified that the CloudTrail trail is enabled, the S3 bucket policy allows CloudTrail to write, and the bucket exists. However, no log files have been delivered for the past 6 hours. The engineer checks the CloudTrail console and sees that the trail status shows 'Logging' but the latest log file time is from 8 hours ago. The engineer suspects a permission issue but cannot find any explicit deny in the bucket policy. What is the MOST likely cause of this issue?

Accepted Answer

The KMS key policy used by the S3 bucket does not grant CloudTrail permission to use the key.. The issue is likely that the KMS key used for server-side encryption of the S3 bucket is not configured to allow CloudTrail to decrypt logs. CloudTrail requires decrypt permission on the KMS key to write logs, even if the trail uses SSE-S3 for the log files themselves. The bucket policy may allow CloudTrail to write, but if the KMS key policy does not grant kms:Decrypt to the CloudTrail service principal, log delivery will fail. Option A is correct because the KMS key policy likely needs a statement allowing CloudTrail to use the key. Option B is wrong because CloudTrail does not need S3 full access, only write access. Option C is wrong because the bucket exists and is accessible. Option D is wrong because CloudTrail can deliver to a bucket in another account with proper permissions.

Answer

The CloudTrail trail is not configured to deliver to a cross-account bucket.

Answer

The CloudTrail trail is configured with a role that does not have S3 full access.

Answer

The S3 bucket is in a different region than the CloudTrail trail.

Question 3

A company is using Amazon GuardDuty to detect threats in its AWS environment. The security team notices that GuardDuty is generating a high number of 'UnauthorizedAccess:IAMUser/MaliciousIPCaller' findings for an IAM user that is used by a legacy application. The security team has verified that the IP addresses flagged are not malicious but are legitimate IPs used by the application's third-party service. The company wants to suppress these findings without disabling GuardDuty entirely. Which solution is the MOST effective and secure?

Accepted Answer

Create a GuardDuty suppression rule that automatically archives findings for that IAM user.. GuardDuty supports suppression rules that allow you to automatically archive findings that match certain criteria. You can create a suppression rule based on the finding type and the IAM user's ARN to automatically archive these false positives. Option C is correct because it uses GuardDuty's built-in suppression feature. Option A is wrong because disabling the finding type would suppress all similar findings for all users, which is too broad. Option B is wrong because modifying the IAM user's permissions does not affect GuardDuty findings. Option D is wrong because creating a VPC flow log filter does not suppress GuardDuty findings.

Answer

Disable the specific finding type in GuardDuty settings.

Answer

Create a VPC flow log filter to exclude traffic from those IP addresses.

Answer

Modify the IAM user's permissions to restrict the IP addresses it can use.

Question 4

A security engineer is responsible for monitoring AWS account activity. The engineer needs to receive real-time notifications when specific API calls are made, such as 'DeleteTrail' or 'UpdateTrail'. The engineer wants to use AWS services to achieve this with minimal latency. Which combination of services should the engineer use?

Accepted Answer

CloudTrail -> CloudWatch Logs -> CloudWatch metric filter -> CloudWatch alarm -> Amazon SNS. CloudTrail delivers events to CloudWatch Logs in near real-time. You can then create a CloudWatch Logs metric filter to match specific API calls and set up a CloudWatch alarm that triggers an SNS notification. This provides real-time alerts. Option A is correct. Option B is wrong because EventBridge can directly receive CloudTrail events, but CloudTrail logs are not automatically sent to EventBridge; you need to set up a rule. Option C is wrong because CloudWatch Logs subscription filters are for streaming to other services, not for real-time alarms. Option D is wrong because S3 event notifications are not real-time and are for object-level events.

Answer

CloudTrail -> Amazon EventBridge -> Amazon SNS

Answer

CloudTrail -> Amazon S3 -> S3 event notification -> AWS Lambda -> Amazon SNS

Answer

CloudTrail -> CloudWatch Logs -> CloudWatch Logs subscription filter -> AWS Lambda -> Amazon SNS

Question 5

A company has a multi-account AWS environment managed by AWS Organizations. The security team wants to enable a centralized logging solution where all VPC flow logs, CloudTrail logs, and AWS Config configuration items are sent to a single S3 bucket in the security account. The team has already created the S3 bucket with appropriate bucket policies to allow cross-account writes. However, logs are not appearing from all accounts. What is the MOST likely reason for this issue?

Accepted Answer

The member accounts do not have the required IAM roles to allow the logging services to write to the central bucket.. When using AWS Organizations, you can enable trusted access for CloudTrail, Config, and VPC Flow Logs to centrally manage logging. However, the service-linked roles must be created in each member account to allow the logging service to write to the central bucket. Option A is correct because the member accounts need the appropriate IAM roles. Option B is wrong because Organizations does not need to be the master account for logging; a designated account can serve as the central logging account. Option C is wrong because the bucket policy should allow the logging service principal, not the account root. Option D is wrong because KMS encryption is not required for cross-account logging.

Answer

The security account is not the master account of the AWS Organization.

Answer

The S3 bucket policy does not grant write access to the root user of each member account.

Answer

The S3 bucket is encrypted with SSE-KMS and the KMS key policy does not allow cross-account access.

Question 6

A security engineer is configuring CloudTrail to log all management events across all regions. The engineer wants to ensure that log files are delivered to an S3 bucket owned by a separate AWS account for centralized auditing. Which additional configuration is required to allow the S3 bucket in the other account to receive these logs?

Accepted Answer

Add a bucket policy to the destination S3 bucket that allows CloudTrail to write objects.. Option A is correct because cross-account S3 delivery requires a bucket policy on the destination bucket that grants CloudTrail (the service principal) permission to write objects. Option B is wrong because the bucket policy goes on the destination bucket, not the source. Option C is wrong because KMS encryption is not required for cross-account delivery. Option D is wrong because CloudTrail does not use IAM roles for cross-account delivery.

Answer

Create an S3 bucket policy on the source account's bucket to allow cross-account access.

Answer

Enable S3 server-side encryption with KMS on the destination bucket.

Answer

Create an IAM role in the source account and attach a trust policy for CloudTrail.

Question 7

A company uses AWS Organizations with multiple accounts. The security team wants to centralize VPC Flow Logs from all accounts into a single S3 bucket in the security account. The flow logs are created in the member accounts and sent to the centralized bucket. However, the security team notices that flow logs from some member accounts are not being delivered. What is the most likely cause?

Accepted Answer

The S3 bucket policy does not grant write permissions to the member accounts.. Option B is correct because VPC Flow Logs require a resource-based policy on the destination bucket to allow the member accounts to write logs. Option A is wrong because flow logs can be aggregated across accounts. Option C is wrong because CloudTrail is not used for VPC Flow Logs. Option D is wrong because VPC Flow Logs do not require IAM roles on member accounts.

Answer

The member accounts need an IAM role with permissions to write to the centralized bucket.

Answer

CloudTrail must be enabled in each member account before VPC Flow Logs can be sent to a centralized bucket.

Answer

VPC Flow Logs cannot be aggregated across multiple AWS accounts.

Question 8

A company's security team is investigating a potential security incident. They have enabled CloudTrail and CloudWatch Logs. They want to receive real-time alerts when an IAM user creates a new access key. Which combination of services should be used to achieve this?

Accepted Answer

CloudTrail with CloudWatch Logs, metric filter, alarm, and SNS topic. Option D is correct. CloudTrail logs the CreateAccessKey API call to CloudWatch Logs. A CloudWatch Logs metric filter can match that event and trigger a CloudWatch Alarm, which publishes to an SNS topic to send notifications. Option A is wrong because Config is not real-time and does not evaluate API calls. Option B is wrong because GuardDuty detects threats but does not monitor specific API calls. Option C is wrong because Lambda cannot directly read CloudTrail logs without a subscription.

Answer

AWS Config rules with an SNS topic

Answer

Amazon GuardDuty with an SNS topic

Answer

CloudTrail with Lambda function invocation

Question 9

A company is using Amazon GuardDuty to monitor for malicious activity. The security team wants to automatically isolate an EC2 instance that is flagged for outbound communication with a known malicious IP address. Which approach is the most efficient and scalable?

Accepted Answer

Use Amazon EventBridge to invoke an AWS Lambda function that modifies the instance's security group.. Option C is correct because GuardDuty can send findings to EventBridge, which can trigger a Lambda function to modify the instance's security group to isolate it. Option A is wrong because modifying the NACL would affect the entire subnet, not just the instance. Option B is wrong because terminating the instance is too drastic and may cause data loss. Option D is wrong because CloudWatch Alarms cannot directly trigger Lambda for GuardDuty findings.

Answer

Use a CloudWatch Alarm to directly invoke a Lambda function to isolate the instance.

Answer

Use AWS Config to automatically terminate the instance when a GuardDuty finding is reported.

Answer

Create a CloudWatch alarm on GuardDuty findings and modify the subnet's network ACL to block the traffic.

Question 10

A company uses AWS CloudTrail to log API activity. The security team wants to ensure that any modification to CloudTrail configuration is logged and that the logs are tamper-proof. Which feature should be enabled?

Accepted Answer

CloudTrail Log File Integrity Validation. Option B is correct because CloudTrail Log File Integrity Validation uses SHA-256 hashing and digital signatures to detect tampering. Option A is wrong because S3 Versioning does not prevent tampering of logs. Option C is wrong because MFA Delete protects against deletion, not modification. Option D is wrong because CloudWatch Logs does not provide integrity validation.

Answer

S3 MFA Delete on the CloudTrail S3 bucket

Answer

S3 Versioning on the CloudTrail S3 bucket

Answer

CloudWatch Logs log stream encryption

Question 11

A security engineer is setting up centralized logging for an AWS organization. The engineer wants to collect CloudTrail logs, VPC Flow Logs, and AWS Config configuration items from all member accounts into a single S3 bucket in the management account. The engineer creates a new S3 bucket with a bucket policy that grants the required permissions. However, logs from member accounts are not being delivered. What is the most likely reason?

Accepted Answer

The S3 bucket policy does not grant write permissions to the member accounts' service principals.. Option D is correct because the S3 bucket policy must grant the necessary permissions to the member account's service principal (e.g., cloudtrail.amazonaws.com, vpc-flow-logs.amazonaws.com, config.amazonaws.com) to write objects. Option A is wrong because logging does not require AWS Config aggregation. Option B is wrong because CloudTrail organization trail does not need to be created in each account. Option C is wrong because VPC Flow Logs can be delivered to a bucket in a different account.

Answer

VPC Flow Logs cannot be delivered to an S3 bucket in a different account.

Answer

CloudTrail must be enabled in each member account individually.

Answer

AWS Config must be enabled in the management account and configured to aggregate data from member accounts.

Question 12

A company is using Amazon CloudWatch Logs to centralize application logs from EC2 instances. The security team wants to encrypt the log data at rest using a customer-managed KMS key. After enabling encryption on the log group, they notice that new log events are being encrypted, but existing log events are not encrypted. What should the team do to encrypt the existing log events?

Accepted Answer

Export the existing logs to S3, encrypt them with the KMS key, and re-import them into a new log group.. Option C is correct because CloudWatch Logs does not support encrypting existing log events retroactively. The only way to encrypt them is to export them, re-encrypt, and re-import. Option A is wrong because there is no built-in re-encryption. Option B is wrong because you cannot change the KMS key on an existing log group. Option D is wrong because re-encryption is not supported.

Answer

Use the AWS CLI to update the log group's encryption configuration to re-encrypt existing data.

Answer

Enable KMS automatic key rotation on the customer-managed key to encrypt existing logs.

Answer

Change the KMS key to an AWS managed key to automatically encrypt existing logs.

Question 13

A security engineer is configuring Amazon GuardDuty for the first time. The engineer wants to receive alerts when GuardDuty generates a finding of severity HIGH or higher. What is the simplest way to achieve this?

Accepted Answer

Create an Amazon EventBridge rule that matches GuardDuty findings and triggers an SNS topic.. Option B is correct because GuardDuty can send findings directly to CloudWatch Events (EventBridge), which can then invoke a Lambda function or send to an SNS topic. Option A is wrong because GuardDuty does not have native email alerts. Option C is wrong because GuardDuty does not use CloudWatch Logs directly. Option D is wrong because GuardDuty findings are not stored in S3 by default.

Answer

Configure CloudWatch Logs to monitor GuardDuty logs and create a metric filter for high-severity findings.

Answer

Set up an S3 event notification on the GuardDuty findings bucket.

Answer

Configure GuardDuty to send email notifications for all findings.

Question 14

A company uses AWS CloudTrail to log all API calls. The security team wants to ensure that any attempt to disable CloudTrail logging is detected and alerted within minutes. Which solution should they implement?

Accepted Answer

Create a CloudWatch metric filter on CloudTrail logs for StopLogging or DeleteTrail events and set an alarm.. Option C is correct because CloudTrail itself logs the StopLogging or DeleteTrail API calls. Those logs can be streamed to CloudWatch Logs, where a metric filter can detect the event and trigger an alarm that sends an SNS notification. Option A is wrong because Config rules evaluate resource configurations, not API calls. Option B is wrong because GuardDuty does not monitor CloudTrail API calls. Option D is wrong because S3 events are for object-level operations, not CloudTrail API calls.

Answer

Use Amazon GuardDuty to monitor for disablement events.

Answer

Create an AWS Config rule to detect when CloudTrail is disabled.

Answer

Configure S3 event notifications on the CloudTrail bucket.

Question 15

A security engineer is troubleshooting an issue where CloudTrail is not delivering logs to an S3 bucket. The bucket policy appears correct. Which TWO additional steps should the engineer take to diagnose the issue? (Choose TWO.)

Accepted Answer

Verify that the S3 bucket exists and is in the correct region.. Options A and D are correct. Verifying that the bucket exists and checking the CloudTrail error messages in the CloudTrail console are standard troubleshooting steps. Option B is wrong because CloudWatch Logs is not required for S3 delivery. Option C is wrong because S3 server access logs are separate. Option E is wrong because CloudTrail does not use IAM roles for S3 delivery.

Answer

Check CloudWatch Logs for CloudTrail errors.

Answer

Create an IAM role for CloudTrail with S3 write permissions.

Answer

Enable S3 server access logging on the bucket.