SCS-C02 Security Logging and Monitoring Practice Test 13 — 15 Questions

Question 1

A security engineer is investigating a potential data breach. The engineer wants to analyze historical API calls made by a specific IAM user. Which TWO AWS services can be used together to achieve this? (Select TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records API activity across AWS accounts, including who made the call, the source IP address, and the time of the call. By enabling CloudTrail for the specific IAM user, the security engineer can retrieve a history of all API calls made by that user. CloudWatch Logs can then be used to store and query those CloudTrail logs for analysis, such as filtering by user ARN or event name.

Answer

S3 Server Access Logs

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs Insights

Question 2

A security engineer has attached the above IAM policy to a role used by an application to write logs to an S3 bucket. However, the application is unable to write logs. What is the MOST likely reason?

Accepted Answer

The application does not set the x-amz-acl header to bucket-owner-full-control on PutObject requests.. When an IAM policy grants PutObject access to an S3 bucket, the application must also include the `x-amz-acl: bucket-owner-full-control` header in its PutObject requests to ensure the bucket owner retains full control over the uploaded objects. Without this header, the object is owned by the writer (the role), and the bucket owner cannot manage it, causing the write to fail due to access control mismatches, especially in cross-account scenarios or when the bucket policy enforces specific ACLs.

Answer

The Effect is set to Allow, which is too permissive.

Answer

The policy does not allow server-side encryption.

Answer

The resource ARN is incorrect; it should be arn:aws:s3:::my-log-bucket/*.

Question 3

A security engineer needs to ensure that all S3 object-level API calls (e.g., GetObject, PutObject) on the bucket 'my-bucket' are logged. The current CloudTrail configuration is as shown in the exhibit. What change should the engineer make?

Accepted Answer

Change the data resource value to 'arn:aws:s3:::my-bucket/' to cover all objects.. To log all S3 object-level API calls (GetObject, PutObject, etc.) on the bucket 'my-bucket', the DataResources value must specify the bucket's ARN with a trailing slash (arn:aws:s3:::my-bucket/) to indicate all objects within the bucket. Without the trailing slash, CloudTrail interprets the ARN as referring to the bucket itself, not its objects, and thus object-level events are not captured. The trailing slash ensures the selector applies to all object keys under that bucket.

Answer

Remove the DataResources section and add an AdvancedEventSelector for S3.

Answer

Change the bucket ARN to 'arn:aws:s3:::my-bucket' without a trailing slash.

Answer

Enable management events by setting IncludeManagementEvents to true.

Question 4

A security engineer is configuring a multi-account CloudTrail setup. The above bucket policy is attached to the central logging bucket. Despite the policy, CloudTrail in the member account (123456789012) cannot deliver logs. What is the MOST likely issue?

Accepted Answer

The condition s3:x-amz-acl is not required; CloudTrail does not set that ACL.. CloudTrail does not set the s3:x-amz-acl condition key when delivering log files to S3. The bucket policy incorrectly includes this condition, which causes the S3 authorization to fail because the condition key is not present in the CloudTrail PutObject request. Removing the condition or adjusting the policy to not require it resolves the delivery failure.

Answer

The Principal should be the CloudTrail service principal of the member account.

Answer

The Action should be s3:PutObjectAcl instead of s3:PutObject.

Answer

The resource ARN must include the source account ID in the path.

Question 5

A security engineer is configuring Amazon GuardDuty in a multi-account environment using AWS Organizations. The engineer wants to ensure that all member accounts send findings to the delegated administrator account. However, some member accounts are not sending findings. What is the most likely cause?

Accepted Answer

GuardDuty is not enabled in the member accounts, or they have not accepted the invitation.. GuardDuty requires that each member account has the service explicitly enabled and has accepted the invitation from the delegated administrator account. Without these steps, the member accounts cannot send findings to the administrator, even if AWS Organizations is configured correctly. The delegated administrator can only manage findings from accounts that have completed the onboarding process.

Answer

The GuardDuty service-linked role is missing in the member accounts.

Answer

AWS CloudTrail is not enabled in the member accounts.

Answer

VPC Flow Logs are not enabled in the member accounts.

Question 6

A company wants to receive real-time notifications when specific API calls are made in their AWS account, such as creating a new IAM user. Which AWS service should be used to trigger a notification based on CloudTrail events?

Accepted Answer

Amazon EventBridge. Amazon EventBridge is the correct service because it can ingest CloudTrail events in near real-time and use event rules to match specific API calls, such as CreateUser, and then route those events to targets like SNS topics to send notifications. EventBridge provides a serverless event bus that directly integrates with CloudTrail, enabling you to react to API activity without custom polling or additional infrastructure.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon VPC Flow Logs

Question 7

A security engineer is investigating a potential data breach. The engineer wants to analyze historical API calls made by a specific IAM user. Which TWO AWS services can be used together to achieve this? (Select TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use VPC Traffic Mirroring.. VPC Traffic Mirroring captures and inspects network traffic at the Elastic Network Interface (ENI) level without requiring any software installation on the EC2 instance. It copies traffic from a source ENI to a target, such as a Network Load Balancer or another ENI, for analysis by security appliances. This meets the requirement of capturing traffic without installing software on the instance.

Answer

Enable VPC Flow Logs for the subnet.

Answer

Configure AWS Network Firewall in the VPC.

Answer

Install the Amazon CloudWatch agent on the instance.

Question 8

A company uses AWS CloudTrail to log all API activity. The security team wants to ensure that logs are immutable after they are delivered to Amazon S3. Which combination of actions should be taken to meet this requirement? (Choose the best single answer that includes all necessary steps.)

Accepted Answer

Enable S3 Object Lock in governance mode on the bucket.. S3 Object Lock in governance mode prevents objects from being deleted or overwritten by any user, including the root user, for a specified retention period. This ensures immutability of CloudTrail logs after delivery, meeting the security team's requirement. Governance mode allows authorized users to shorten retention periods or remove locks if needed, but by default it enforces write-once-read-many (WORM) protection.

Answer

Enable MFA Delete on the bucket.

Answer

Enable versioning on the bucket.

Answer

Create a bucket policy that denies s3:DeleteObject actions.

Question 9

A company uses AWS CloudTrail and wants to ensure that all log files are encrypted at rest using a customer-managed AWS KMS key. The CloudTrail trail is configured to use a KMS key, but some log files appear to be encrypted with the default Amazon S3 managed key (SSE-S3). What is the most likely cause?

Accepted Answer

The KMS key policy does not grant CloudTrail permission to use the key.. The most likely cause is that the KMS key policy does not grant CloudTrail the necessary permissions to use the key for encryption. When a CloudTrail trail is configured with a customer-managed KMS key, the key policy must include a statement that allows the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the kms:GenerateDataKey and kms:Decrypt actions. Without these permissions, CloudTrail falls back to encrypting log files with the default Amazon S3 managed key (SSE-S3), resulting in some logs appearing encrypted with SSE-S3 instead of SSE-KMS.

Answer

The CloudTrail trail is configured to use SSE-S3 instead of SSE-KMS.

Answer

The KMS key is in a different AWS region than the S3 bucket.

Answer

The S3 bucket has default encryption set to SSE-S3.

Question 10

An organization wants to detect and alert on the use of root user credentials in their AWS accounts. They have multiple accounts managed via AWS Organizations. What is the most efficient way to centralize this monitoring?

Accepted Answer

Enable Amazon GuardDuty in the management account and use the delegated administrator feature.. Amazon GuardDuty, when enabled in the management account with a delegated administrator, can centrally monitor and detect suspicious activity—including root user credential usage—across all member accounts in AWS Organizations. This approach eliminates the need to configure per-account monitoring and provides a single pane of glass for security alerts, making it the most efficient centralized solution.

Answer

Create an AWS CloudTrail trail in each account and aggregate logs to a central S3 bucket.

Answer

Use IAM Access Analyzer to find resources shared with external entities.

Answer

Use AWS Config rules to detect root user usage in each account.

Question 11

A security engineer is configuring logging for an application running on Amazon EC2 instances. The engineer needs to capture both operating system-level logs and application logs. Which TWO services can be used together to achieve this? (Choose two.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the correct service because it provides a centralized location to store, monitor, and access log files from your EC2 instances. The Amazon CloudWatch agent is the correct companion service because it is specifically designed to collect both operating system-level logs (e.g., syslog, Windows Event Log) and application logs from EC2 instances and send them to CloudWatch Logs. Together, they fulfill the requirement of capturing both OS and application logs.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

Amazon Inspector

Question 12

A security team wants to detect and alert on suspicious network traffic patterns within their VPC. They need to capture traffic to and from an EC2 instance for analysis. Which THREE services should be used together to achieve this? (Choose three.)

Accepted Answer

AWS Network Firewall. VPC Traffic Mirroring captures packets to and from the EC2 instance. Amazon Detective analyzes network traffic patterns from VPC Flow Logs and other data sources to detect suspicious activity. AWS Network Firewall provides stateful inspection and can alert on suspicious traffic patterns. Together, these three services enable capture, analysis, and alerting. Network Load Balancer is not needed; it is a traffic distribution service, not a security or capture service.

Answer

Network Load Balancer

Answer

AWS WAF

Question 13

Refer to the exhibit. A security engineer has created an S3 bucket policy to allow AWS CloudTrail and VPC Flow Logs to deliver logs to the bucket. However, CloudTrail logs are not being delivered, but VPC Flow Logs are delivered successfully. What is the most likely cause?

Accepted Answer

The bucket policy does not grant CloudTrail permission to perform 's3:GetBucketAcl' and 's3:PutBucketAcl'.. CloudTrail requires explicit permissions to read the bucket ACL (s3:GetBucketAcl) and set the bucket ACL (s3:PutBucketAcl) to verify and apply the appropriate access control list for log delivery. Without these permissions, CloudTrail cannot confirm it has the necessary write access, causing log delivery to fail. VPC Flow Logs, on the other hand, do not require these ACL operations because they use a different delivery mechanism that relies solely on bucket policies.

Answer

The principal is set to a service instead of an AWS account.

Answer

The condition 's3:x-amz-acl' is misspelled.

Answer

The service principal in the policy is incorrect for CloudTrail.

Question 14

Refer to the exhibit. A security engineer is configuring the Amazon CloudWatch agent to collect logs from an Amazon ECS task. The configuration shown is used. However, the logs are not appearing in CloudWatch Logs. What is the most likely cause?

Accepted Answer

The configuration file is missing the 'logs' section at the top level.. The CloudWatch agent configuration requires a top-level 'logs' section to define log collection settings. Without this section, the agent ignores the log configuration entirely, even if the rest of the file is valid. The exhibit shows a configuration that likely has the log group, stream, and file settings nested under an incorrect or missing top-level key, preventing the agent from processing them.

Answer

The multi_line_start_pattern is missing a closing delimiter.

Answer

The datetime_format is incorrect for the logs.

Answer

The CloudWatch agent is not installed in the ECS task.

Question 15

Refer to the exhibit. A security engineer uses the AWS CLI command shown to investigate a console login event. What type of user performed the login?

Accepted Answer

IAM user. The `userIdentity` field in the CloudTrail log shows `arn:aws:iam::123456789012:user/Bob`, which is the ARN of an IAM user. The `type` field is `IAMUser`, confirming the login was performed by an IAM user. This is distinct from other identity types like assumed roles or root users.

Answer

AWS service

Answer

Assumed role

Answer

Root user