SCS-C02 Security Logging and Monitoring Practice Test 13 — 15 Questions

Question 1

A company has enabled Amazon GuardDuty in multiple AWS accounts. The security team wants to centralize GuardDuty findings into a single account for analysis. Which THREE steps are required to achieve this? (Choose THREE.)

Accepted Answer

Invite member accounts to join the GuardDuty master account.. Option C is correct because in Amazon GuardDuty, to centralize findings from multiple accounts, you must designate a master account and then invite member accounts to join. The invitation process establishes a trusted relationship where the master account can aggregate and analyze findings from all member accounts. Without this step, the master account cannot receive findings from other accounts.

Answer

Configure CloudWatch Logs cross-account subscription to aggregate findings.

Answer

Create an EventBridge rule to forward findings to the master account.

Question 2

A security engineer is configuring VPC Flow Logs to capture network traffic metadata. Which TWO attributes can be captured in VPC Flow Logs? (Choose TWO.)

Accepted Answer

Source IP address. VPC Flow Logs capture metadata about network traffic, including the source IP address (option B) and destination port (option D). The source IP address identifies the origin of the traffic, while the destination port indicates the application or service being targeted. These are standard fields in the flow log record format, as defined by AWS for capturing IP traffic metadata.

Answer

Packet payload

Answer

IAM user ID

Answer

DNS query name

Question 3

Refer to the exhibit. A security engineer created this S3 bucket policy to allow CloudTrail to deliver logs from account 123456789012 to the bucket my-trail-bucket. However, CloudTrail logs are not being delivered. What is the most likely reason?

Accepted Answer

The policy is missing s3:GetBucketAcl permission.. Option D is correct. The bucket policy must also grant the s3:GetBucketAcl permission to allow CloudTrail to verify the bucket's ACL. Without it, CloudTrail will fail. Option A is wrong because the ARN is correct. Option B is wrong because the Action is correct. Option C is wrong because the Principal is correct.

Answer

The Principal should be the CloudTrail service principal for the specific region.

Answer

The Action should be s3:PutObjectAcl instead of s3:PutObject.

Answer

The resource ARN does not include the bucket name.

Question 4

Refer to the exhibit. A security engineer is analyzing a VPC Flow Log entry from an EC2 instance with private IP 10.0.1.5. The log shows an outbound connection to IP 203.0.113.5 on port 443 from source port 22. The connection was accepted. What is the most likely scenario?

Accepted Answer

The instance is responding to an inbound SSH connection from the remote IP.. Option C is correct. VPC Flow Logs record connections from the perspective of the network interface. The source IP and port are the instance's private IP and ephemeral port. Here, the source port is 22 (SSH), which is unusual for an outbound connection. This suggests the entry might be a reply to an inbound SSH connection (since flow logs capture both directions). The instance is likely replying to an SSH session initiated from the remote IP. Option A is wrong because port 22 is SSH, not HTTPS. Option B is wrong because the instance is the source in the log, not the destination. Option D is wrong because the remote IP is not private.

Answer

The instance is connecting to a remote server on the internal network.

Answer

The instance is receiving an SSH connection from the remote IP.

Answer

The instance is making an HTTPS request to a web server.

Question 5

Refer to the exhibit. A security engineer is reviewing a CloudTrail event. What security concern does this event raise?

Accepted Answer

The user is opening SSH access to the world.. Option B is correct. The event shows an IAM user adding an inbound rule to security group sg-12345 that allows SSH (port 22) from any IP (0.0.0.0/0). This is a security best practice violation because it exposes the instance to the internet. Option A is wrong because the user is an IAM user, not root. Option C is wrong because the event is logged, which is good. Option D is wrong because the API is AuthorizeSecurityGroupIngress, not Revoke.

Answer

The user is revoking a security group rule.

Answer

The event is not being logged by CloudTrail.

Answer

The user is using the AWS root account.

Question 6

A security team needs to detect unauthorized API calls made from a compromised IAM user. Which AWS service should be used to monitor and alert on specific API activities?

Accepted Answer

AWS CloudTrail. CloudTrail logs all API calls and can be used with CloudWatch Alarms to trigger alerts on specific actions. Option B is correct because CloudTrail is designed for API activity monitoring. Option A is wrong because Config tracks resource configuration changes, not API calls. Option C is wrong because GuardDuty is for threat detection, not specific API monitoring. Option D is wrong because VPC Flow Logs capture network traffic, not API calls.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

VPC Flow Logs

Question 7

A company has enabled CloudTrail in all regions and is logging to a single S3 bucket. The security team needs to ensure that any attempted deletion of CloudTrail logs generates an immediate alert. Which solution meets this requirement?

Accepted Answer

Configure an S3 event notification on the bucket for s3:ObjectRemoved:* events, invoke a Lambda function to publish to an SNS topic.. S3 Events can trigger a Lambda function to send a notification via SNS when an object delete action occurs. Option C is correct because it integrates S3 events with Lambda and SNS for real-time alerting. Option A is wrong because CloudWatch Logs does not directly monitor S3 object deletions. Option B is wrong because CloudTrail Insights detects unusual API activity, not specific delete events in S3. Option D is wrong because Config rules evaluate resource configurations, not real-time events.

Answer

Use AWS Config to create a rule that checks for deleted objects and sends an SNS notification.

Answer

Enable CloudTrail Insights to detect unusual deletion activity and send alerts.

Answer

Create a CloudWatch Logs metric filter on the CloudTrail log group for DeleteObject events and trigger an alarm.

Question 8

A security engineer is investigating a potential data exfiltration incident. The engineer has enabled VPC Flow Logs for the VPC and CloudTrail for the account. Which combination of actions would provide the most comprehensive visibility into network traffic and API calls?

Accepted Answer

Enable VPC Flow Logs to capture network traffic and use CloudTrail to capture API calls. Correlate both logs for a complete view.. VPC Flow Logs capture network traffic metadata, and CloudTrail captures API calls. Analyzing both together provides a complete picture. Option B is correct because it combines both services. Option A is wrong because CloudTrail alone does not capture network traffic. Option C is wrong because VPC Flow Logs do not capture API calls. Option D is wrong because Config does not log API calls or network traffic.

Answer

Use AWS Config to track resource changes and CloudTrail to detect network anomalies.

Answer

Analyze CloudTrail logs to identify API calls and correlate with VPC Flow Logs for network traffic.

Answer

Use VPC Flow Logs to identify API calls and network traffic.

Question 9

A company wants to centrally collect and analyze logs from multiple AWS accounts. Which AWS service should be used to aggregate logs from various sources for monitoring and alerting?

Accepted Answer

Amazon CloudWatch Logs. CloudWatch Logs can aggregate logs from multiple accounts using cross-account log groups or with the help of Kinesis. Option B is correct because CloudWatch Logs is the primary log aggregation service. Option A is wrong because CloudTrail is for API logging, not general log aggregation. Option C is wrong because S3 is storage, not a monitoring service. Option D is wrong because Config is for configuration tracking.

Answer

Amazon S3

Answer

AWS Config

Answer

AWS CloudTrail

Question 10

A security team needs to monitor for failed login attempts to an EC2 instance running Linux. The team wants to send a real-time alert when more than 10 failed SSH attempts occur within 5 minutes. Which solution is the most efficient?

Accepted Answer

Install the CloudWatch Logs agent on the EC2 instance to stream /var/log/secure to CloudWatch Logs. Create a metric filter for 'Failed password' and set a CloudWatch alarm.. The CloudWatch Logs agent can send /var/log/secure to CloudWatch Logs, where a metric filter can count failed attempts and trigger an alarm. Option A is correct. Option B is wrong because modifying /etc/hosts.deny is not monitoring. Option C is wrong because VPC Flow Logs do not capture application-level login attempts. Option D is wrong because GuardDuty detects threats but is not as targeted for this specific metric.

Answer

Enable VPC Flow Logs and filter for SSH traffic to detect failed attempts.

Answer

Configure the EC2 instance to write failed attempts to a file in S3 and use S3 events to trigger a Lambda function for alerting.

Answer

Enable Amazon GuardDuty and create a custom threat list for failed SSH attempts.

Question 11

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that all accounts have CloudTrail enabled and that logs are delivered to a centralized S3 bucket in the management account. Which solution meets these requirements?

Accepted Answer

Use AWS CloudTrail with Organizations to create an organization trail that logs all accounts to the central bucket.. Using CloudTrail with AWS Organizations, you can create a trail that applies to all accounts in the organization, logging to a single S3 bucket. Option D is correct. Option A is wrong because manual per-account setup is not scalable. Option B is wrong because Config does not enable CloudTrail. Option C is wrong because Lambda functions would be complex and not native.

Answer

Write a script that runs in each account using AWS Lambda to enable CloudTrail and point to the central bucket.

Answer

Use AWS Config rules in each account to check CloudTrail status and remediate via Lambda.

Answer

Create an IAM role that each account assumes to enable CloudTrail and log to the central bucket.

Question 12

A security analyst needs to receive an alert when an IAM user attempts to perform an action they are not authorized to perform. Which AWS service can be used to monitor and alert on such authorization failures?

Accepted Answer

AWS CloudTrail with CloudWatch metric filter and alarm. CloudTrail logs all API calls, including AccessDenied errors. A CloudWatch metric filter on CloudTrail logs can trigger an alarm. Option C is correct. Option A is wrong because IAM Access Analyzer is for external access analysis. Option B is wrong because Service Control Policies are for organizations. Option D is wrong because Config does not monitor API calls.

Answer

AWS Organizations SCPs

Answer

AWS IAM Access Analyzer

Answer

AWS Config

Question 13

A company has a requirement to retain CloudTrail logs for 7 years for compliance. The logs are stored in an S3 bucket. The security team needs to ensure that logs are not deleted before the retention period ends, even by users with full S3 permissions. Which action should be taken?

Accepted Answer

Enable S3 Object Lock in Compliance mode on the bucket with a retention period of 7 years.. S3 Object Lock with a retention mode of Compliance prevents any user, including the root user, from deleting objects until the retention period expires. Option A is correct. Option B is wrong because MFA Delete can be bypassed by root. Option C is wrong because bucket policies do not prevent deletion by bucket owners with full permissions. Option D is wrong because versioning alone does not prevent deletion.

Answer

Enable MFA Delete on the bucket and require MFA for all delete operations.

Answer

Enable S3 Versioning and set a lifecycle policy to expire noncurrent versions after 7 years.

Answer

Create a bucket policy that denies s3:DeleteObject for all users.

Question 14

A security engineer is configuring a centralized logging solution for multiple AWS accounts. The engineer needs to ensure that log files are encrypted at rest and that access to the logs is audited. Which combination of services and features should be used?

Accepted Answer

Use S3 SSE-KMS and enable CloudTrail for S3 data events.. S3 SSE-KMS provides encryption at rest with key management, and CloudTrail logs all access to the S3 bucket. Option C is correct. Option A is wrong because SSE-S3 does not provide key management or access audit. Option B is wrong because SSE-C requires customer-managed keys but does not provide audit. Option D is wrong because KMS alone without CloudTrail does not audit access.

Answer

Use S3 SSE-S3 and enable S3 access logs.

Answer

Use AWS KMS to encrypt the logs before uploading to S3.

Answer

Use S3 SSE-C and enable CloudTrail for S3 data events.

Question 15

A security team wants to detect and alert on potential security threats such as compromised instances or malicious activity within their AWS environment. Which TWO AWS services should be used together to provide comprehensive threat detection?

Accepted Answer

AWS Security Hub. Amazon GuardDuty provides intelligent threat detection, and AWS Security Hub aggregates findings from multiple services including GuardDuty. Option A and Option C are correct. Option B is wrong because CloudTrail is for logging, not threat detection. Option D is wrong because Inspector is for vulnerability assessments. Option E is wrong because Config is for configuration compliance.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Config