SCS-C02 Security Logging and Monitoring Practice Test 14 — 15 Questions

Question 1

A DevOps engineer notices that an EC2 instance's CloudWatch agent is not sending custom metrics to CloudWatch. The agent is installed and the configuration file is valid. The instance has an IAM role attached. What is the most likely reason for the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The IAM role attached to the instance does not have the cloudwatch:PutMetricData permission.. The CloudWatch agent requires IAM permissions to publish custom metrics. Even if the agent is installed, running, and has a valid configuration, it will fail to send metrics if the attached IAM role lacks the `cloudwatch:PutMetricData` action. This is a common misconfiguration where the instance has an IAM role, but the role's policy does not explicitly grant the necessary CloudWatch write permissions.

Answer

The instance does not have internet access to reach CloudWatch endpoints.

Answer

The CloudWatch agent is not running as root.

Answer

The CloudWatch agent configuration file has a syntax error.

Question 2

A security engineer is investigating a potential data exfiltration incident. They see that an EC2 instance with an IAM role is making API calls to S3 to download objects. The IAM role has an S3 bucket policy that allows access from that role. However, CloudTrail logs show that the calls are being made from an IP address outside the company's network. What is the most likely explanation?

Accepted Answer

The IAM role credentials were stolen and are being used from an external machine.. The CloudTrail logs show the API calls originating from an IP address outside the company's network, which indicates that the IAM role credentials (temporary security credentials from the instance metadata) have been compromised and are being used from an external machine. The S3 bucket policy allows access from the IAM role, but the source IP in the logs is external, confirming the credentials are being used outside the EC2 instance.

Answer

The EC2 instance has a public IP and the calls are originating from the instance itself.

Answer

CloudTrail is logging the IP address of the AWS service endpoint, not the client.

Answer

The S3 bucket policy allows public access.

Question 3

A security analyst wants to receive a notification whenever a new security group is created in their AWS account. Which AWS service should they use to trigger an SNS notification based on the CloudTrail event?

Accepted Answer

Amazon EventBridge (CloudWatch Events). Amazon EventBridge (formerly CloudWatch Events) can monitor CloudTrail API calls in real time and trigger an SNS notification when a specific event, such as CreateSecurityGroup, occurs. By creating a rule that matches the event source and detail type, EventBridge evaluates incoming events and routes matching ones to an SNS topic, enabling the desired notification.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

AWS Lambda

Question 4

A security team is designing a logging solution for a multi-account AWS environment using AWS Organizations. They need to collect CloudTrail logs, VPC Flow Logs, and DNS logs from all accounts. Which TWO services can be used to centralize this logging?

Accepted Answer

Amazon CloudWatch Logs. Both Amazon CloudWatch Logs and Amazon S3 can be used to centralize all three types of logs in a multi-account environment. CloudWatch Logs supports cross-account subscriptions to aggregate logs from multiple accounts, and S3 can serve as a central bucket where each account delivers its logs. CloudTrail Organization Trail only centralizes CloudTrail management events and does not handle VPC Flow Logs or DNS logs.

Answer

AWS CloudTrail (Organization Trail)

Answer

AWS Config

Answer

Amazon GuardDuty

Question 5

A security engineer is configuring Amazon GuardDuty in a multi-account environment. The engineer wants to enable GuardDuty in the management account and automatically enable it for all member accounts. Which THREE steps are required?

Accepted Answer

Configure GuardDuty to automatically enable for all accounts in the organization via the Organizations integration.. To enable GuardDuty in a multi-account environment with automatic enablement via Organizations integration, the required steps are: First, enable GuardDuty in the management account (Option E). Then, configure the Organizations integration to automatically enable GuardDuty for all accounts in the organization (Option C). After that, GuardDuty is automatically enabled in member accounts without requiring any manual acceptance of invitations (Option D is not required). Options A and B are incorrect because member accounts do not need to manually enable GuardDuty or create S3 buckets.

Answer

Have each member account manually enable GuardDuty.

Answer

Create an S3 bucket for GuardDuty findings in each member account.

Answer

Accept the invitation from the administrator account in each member account.

Question 6

A company wants to monitor unauthorized API calls in their AWS account. Which TWO AWS services can provide real-time alerting on such events?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including unauthorized ones (e.g., AccessDenied errors). By configuring CloudTrail to deliver logs to Amazon CloudWatch Logs and setting up a metric filter with an alarm, you can receive real-time alerts when unauthorized API calls occur. This directly meets the requirement for monitoring and alerting on such events.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Question 7

A financial services company has a multi-account AWS environment with over 200 accounts managed through AWS Organizations. The security team is responsible for monitoring all accounts for security incidents. They have enabled AWS CloudTrail in all accounts with trails that deliver logs to a centralized S3 bucket in the security account. Additionally, they have enabled Amazon GuardDuty in all accounts with the security account as the administrator. The team uses Amazon EventBridge to trigger automated responses to GuardDuty findings. Recently, they noticed that some GuardDuty findings from member accounts are not appearing in the security account. The security team verified that the findings are generated in the member accounts (they can see them in the member account GuardDuty console) but are not being sent to the administrator account. The CloudTrail logs are being delivered correctly. What is the MOST likely cause of this issue?

Accepted Answer

The member accounts have not accepted the invitation from the GuardDuty administrator account.. In GuardDuty multi-account setup, each member account must accept the invitation from the administrator account to enable sharing of findings. If a member account has not accepted the invitation, findings will not be sent to the administrator. This is a common misconfiguration.

Answer

The S3 bucket policy in the centralized logging bucket is blocking GuardDuty findings from being written.

Answer

The EventBridge rules in the security account are not configured to receive events from member accounts.

Answer

The GuardDuty service-linked role in the member accounts does not have permissions to publish findings to the administrator account.

Question 8

A security engineer notices that an IAM user in the company's AWS account is making API calls from an IP address outside the allowed corporate network. The engineer needs to be alerted immediately when such activity occurs. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Create an Amazon CloudWatch Events rule that matches the IAM user's API calls from the unauthorized IP and sends an SNS notification.. Amazon CloudWatch Events (now part of Amazon EventBridge) can be configured with a rule that matches the specific IAM user's API calls from an unauthorized IP address using the sourceIPAddress condition key in the event pattern. When the rule triggers, it sends an SNS notification directly, providing real-time alerting with minimal setup and no additional infrastructure or log analysis overhead.

Answer

Enable AWS Trusted Advisor and configure email notifications for security checks.

Answer

Enable VPC Flow Logs and analyze them with Amazon Athena to detect suspicious IPs.

Answer

Configure S3 server access logs on the IAM users' bucket and use Amazon Macie to detect anomalies.

Question 9

A company wants to centralize CloudTrail logs from multiple AWS accounts into a single S3 bucket for security analysis. The logs must be encrypted at rest and access must be logged. What is the MOST secure way to grant cross-account access to the central S3 bucket?

Accepted Answer

Create an S3 bucket policy that grants CloudTrail service principal permission to write objects, with a condition checking the source account ID.. It uses an S3 bucket policy that grants the CloudTrail service principal (cloudtrail.amazonaws.com) permission to write objects, with a condition that checks the source account ID. This ensures that only CloudTrail from authorized accounts can deliver logs, and the service principal approach avoids the need for IAM roles or sharing credentials. The bucket policy also allows encryption at rest via S3 default encryption or a KMS key, and access logging can be enabled separately on the bucket.

Answer

Create an S3 bucket policy that grants s3:PutObject to everyone, and rely on CloudTrail to restrict access.

Answer

Create an IAM role in the central account that each member account can assume to write logs.

Answer

Use an S3 bucket with default encryption enabled and share the KMS key with the other accounts.

Question 10

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that all accounts have CloudTrail enabled and that logs are delivered to a central S3 bucket. A new member account is created and the security engineer wants to enforce this configuration automatically. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a CloudTrail template to all accounts in the organization.. AWS CloudFormation StackSets allows you to deploy a CloudTrail template across all accounts in an AWS Organization from a single administrative account. This approach ensures that every new member account automatically receives the CloudTrail configuration as part of the StackSet's automatic deployment to accounts added to the organization, providing a fully automated, infrastructure-as-code solution with minimal operational overhead.

Answer

Use AWS Config rules to detect accounts without CloudTrail and trigger a remediation via Systems Manager Automation.

Answer

Use an SCP to deny cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.

Answer

Create an AWS Lambda function that runs periodically to check and enable CloudTrail in each account.

Question 11

A company uses Amazon GuardDuty to detect threats. The security team wants to receive real-time notifications for all GuardDuty findings with a severity of HIGH or CRITICAL. What is the MOST efficient way to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches GuardDuty findings with severity HIGH or CRITICAL and targets an SNS topic.. Amazon GuardDuty integrates natively with Amazon CloudWatch Events (now part of Amazon EventBridge) to emit findings as events. By creating a CloudWatch Events rule that filters for findings with a severity value of 7.0 or higher (HIGH or CRITICAL), you can directly target an Amazon SNS topic to send real-time notifications. This approach is the most efficient as it avoids intermediate storage or polling, providing near-instantaneous alerting with minimal latency and operational overhead.

Answer

Use the GuardDuty console to set up email alerts for high-severity findings.

Answer

Configure GuardDuty to export findings to an S3 bucket and use S3 event notifications to trigger an SNS topic.

Answer

Stream GuardDuty findings to CloudWatch Logs and create a metric filter to trigger an alarm.

Question 12

A company uses Amazon RDS for MySQL and wants to monitor database activity for suspicious queries. The security team needs to capture all SQL statements executed against the database, including SELECT queries. Which AWS service should they use?

Accepted Answer

Amazon RDS Enhanced Monitoring with database audit logs enabled and streamed to CloudWatch Logs.. Amazon RDS for MySQL supports native database audit logs that can capture all SQL statements, including SELECT queries, by enabling the `audit_log` plugin. These logs can be published to Amazon CloudWatch Logs for monitoring and alerting. Enhanced Monitoring provides OS-level metrics but does not capture SQL query content; the audit logs are the key mechanism for recording executed SQL statements.

Answer

AWS CloudTrail with data events enabled for RDS.

Answer

AWS Config with a custom rule to log database queries.

Answer

VPC Flow Logs to capture database traffic.

Question 13

A security engineer is reviewing CloudTrail logs and notices an event with the key 'eventType' set to 'AwsServiceEvent'. What does this indicate?

Accepted Answer

The event was initiated by an AWS service.. In AWS CloudTrail, the 'eventType' field indicates the source of the event. When set to 'AwsServiceEvent', it means the event was generated by an AWS service on behalf of the customer, such as automatic backups, scaling actions, or health checks. This is distinct from events initiated by a user or federated identity, which would have 'eventType' set to 'AwsApiCall' or 'AwsConsoleSignIn'.

Answer

The event was initiated by an IAM user via the AWS Management Console.

Answer

The event was a sign-in event from the AWS Management Console.

Answer

The event type is an error in the log.

Question 14

A company uses Amazon S3 to store sensitive data. The security team wants to detect when objects are made publicly accessible. Which combination of services provides the MOST comprehensive detection with minimal false positives?

Accepted Answer

Enable S3 Block Public Access at the account level and use AWS Config rules to detect public ACLs and bucket policies.. S3 Block Public Access at the account level provides a preventive control that denies all public access, while AWS Config rules (e.g., s3-bucket-public-read-prohibited, s3-bucket-policy-not-more-permissive) continuously evaluate and detect any public ACLs or bucket policies that would allow public access. This combination ensures comprehensive detection with minimal false positives because Config rules are deterministic and based on explicit policy evaluation, not on heuristic or behavioral analysis.

Answer

Use Amazon Macie to scan S3 buckets for publicly accessible objects.

Answer

Enable CloudTrail data events for S3 and create a CloudWatch Events rule for PutBucketAcl calls.

Answer

Enable Amazon GuardDuty and review the S3 findings for public access.

Question 15

Which TWO AWS services can be used to centrally collect and analyze logs from multiple AWS accounts? (Choose two.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs can centrally collect logs from multiple AWS accounts by using cross-account subscription filters or by aggregating logs into a central account via CloudWatch Logs destination. This enables centralized monitoring and analysis of log data from various sources, meeting the requirement for a multi-account log collection and analysis solution.

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Firehose

Answer

Amazon Athena