SCS-C02 Security Logging and Monitoring Practice Test 14 — 15 Questions

Question 1

A security engineer is designing a logging strategy for a multi-account environment. The engineer needs to ensure that all API activity across accounts is logged and that logs are immutable and centrally accessible. Which THREE actions should the engineer take?

Accepted Answer

Create an AWS CloudTrail organization trail that logs to a central S3 bucket.. To log all API activity across accounts, use an organization trail with CloudTrail. To make logs immutable, enable S3 Object Lock in Compliance mode. To centralize access, store logs in a central S3 bucket. Options A, B, and D are correct. Option C is wrong because CloudWatch Logs is not for immutable storage. Option E is wrong because VPC Flow Logs capture network traffic, not API calls.

Answer

Stream logs to CloudWatch Logs for real-time monitoring.

Answer

Enable VPC Flow Logs in all accounts and send to the central bucket.

Question 2

A company wants to monitor for unauthorized changes to security group rules in their VPC. Which TWO AWS services can be used together to detect and alert on such changes?

Accepted Answer

AWS CloudTrail. AWS Config can track changes to security group rules, and CloudTrail can log the API calls that made those changes. Both can be used to trigger alerts. Options A and C are correct. Option B is wrong because GuardDuty is for threat detection, not configuration changes. Option D is wrong because VPC Flow Logs capture traffic, not rule changes. Option E is wrong because Macie is for data classification.

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Answer

Amazon Macie

Question 3

Refer to the exhibit. A security engineer finds this CloudTrail log entry. What is the most significant security concern indicated by this event?

Accepted Answer

The security group rule allows SSH access from any IP address (0.0.0.0/0).. The event shows a security group rule allowing SSH (port 22) from 0.0.0.0/0, which is a serious security risk. Additionally, the user did not use MFA despite having AdminRole privileges. Option A is correct because the open SSH access is the primary concern. Option B is wrong because while MFA not used is a concern, the open port is more critical. Option C is wrong because there is no indication of a compromised account. Option D is wrong because the event itself is not unusual but the configuration is.

Answer

The event is a normal administrative action and poses no security concern.

Answer

The user did not have MFA enabled when assuming the AdminRole.

Answer

The source IP address (203.0.113.5) is from an unusual location.

Question 4

Refer to the exhibit. A security engineer has attached this IAM policy to a user. What is the effect of this policy?

Accepted Answer

Allows uploads with KMS encryption or without encryption.. The policy allows s3:PutObject only if encryption is set to aws:kms OR if no encryption header is provided (Null condition). Option D is correct because the two statements together allow both encrypted and unencrypted uploads. Option A is wrong because the first statement allows only KMS encryption, but the second allows unencrypted. Option B is wrong because the policy does not explicitly deny unencrypted uploads. Option C is wrong because the second statement allows missing encryption header.

Answer

Allows uploads only when encryption is not specified.

Answer

Denies uploads when encryption is not provided.

Answer

Allows uploads only when using KMS encryption.

Question 5

Refer to the exhibit. A security engineer runs this CloudWatch Logs Insights query on a log group. What is the purpose of this query?

Accepted Answer

Retrieve the 20 most recent log events that contain 'ERROR' or 'WARN'.. The query filters log events containing 'ERROR' or 'WARN', sorts them by timestamp descending, and returns the 20 most recent. Option A is correct. Option B is wrong because it returns both ERROR and WARN. Option C is wrong because it does not count them. Option D is wrong because it does not group by log level.

Answer

Retrieve the 20 most recent log events that contain only 'ERROR'.

Answer

Display all log events grouped by log level.

Answer

Count the number of ERROR and WARN events in the last hour.

Question 6

A security engineer is configuring AWS CloudTrail to log management events for all AWS regions. The engineer needs to ensure that log files are encrypted at rest and that access to the log files is logged. Which solution meets these requirements?

Accepted Answer

Enable CloudTrail with SSE-KMS encryption and enable S3 server access logging on the destination bucket.. Option C is correct because CloudTrail can be configured to use SSE-KMS for encryption, and S3 server access logs can log access to the log files. Option A is wrong because SSE-S3 does not provide access logging. Option B is wrong because SSE-C is not supported by CloudTrail. Option D is wrong because CloudWatch Logs does not encrypt log files at rest by default.

Answer

Enable CloudTrail with SSE-C encryption and enable AWS CloudTrail Insights to log access.

Answer

Enable CloudTrail with SSE-S3 encryption and enable S3 server access logging on the destination bucket.

Answer

Enable CloudTrail with default encryption and enable AWS Config to log access.

Question 7

A DevOps engineer needs to monitor failed SSH login attempts to Amazon EC2 instances. Which AWS service should the engineer use to collect and analyze the login events?

Accepted Answer

Amazon CloudWatch Logs. Option A is correct because CloudWatch Logs can collect log files from EC2 instances via the CloudWatch agent and can be used to search for failed SSH attempts. Option B is wrong because AWS Config tracks resource configuration changes, not OS-level logs. Option C is wrong because CloudTrail logs API calls, not OS login events. Option D is wrong because VPC Flow Logs capture network traffic, not OS authentication events.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Question 8

A security team has enabled AWS CloudTrail in all regions and is delivering logs to an S3 bucket. The team has also enabled S3 server access logging for the CloudTrail bucket. The team needs to detect any unauthorized access to the CloudTrail logs. Which combination of services should the team use to achieve near-real-time detection?

Accepted Answer

Amazon GuardDuty and Amazon CloudWatch Events. Option D is correct because Amazon GuardDuty can monitor S3 access logs for suspicious activity, and CloudWatch Events can trigger a notification. Option A is wrong because AWS Config does not analyze S3 access logs in real time. Option B is wrong because Athena is for querying, not real-time detection. Option C is wrong because CloudTrail Insights focuses on API activity, not S3 data events.

Answer

AWS CloudTrail Insights and Amazon CloudWatch

Answer

Amazon Athena and Amazon QuickSight

Answer

AWS Config and Amazon SNS

Question 9

A company wants to centralize logging from multiple AWS accounts into a single logging account. The logs include AWS CloudTrail, AWS Config, and VPC Flow Logs. Which solution should the company implement to meet these requirements with minimal operational overhead?

Accepted Answer

Use AWS Organizations to create a CloudTrail trail that applies to all accounts and delivers logs to a central S3 bucket.. Option A is correct because AWS Organizations allows centralized management of accounts and can be used with CloudTrail to create a trail that logs all accounts. Option B is wrong because S3 cross-region replication replicates objects, not logs from multiple accounts automatically. Option C is wrong because Kinesis Data Firehose would require additional setup per account. Option D is wrong because Lambda would require custom code and per-account setup.

Answer

Use Amazon Kinesis Data Firehose in each account to send logs to a central Amazon S3 bucket.

Answer

Configure each account to deliver logs to its own S3 bucket and use S3 cross-region replication to copy logs to the central bucket.

Answer

Use AWS Lambda functions in each account to copy log files to a central S3 bucket.

Question 10

A company uses Amazon Route 53 for DNS and wants to log all DNS queries made from its VPC. The logs must be stored in Amazon S3 for compliance purposes. Which solution meets these requirements?

Accepted Answer

Enable Route 53 Resolver query logging and publish to an S3 bucket.. Option B is correct because Route 53 Resolver query logs can log DNS queries made by resources within a VPC and can be exported to S3. Option A is wrong because VPC Flow Logs capture IP traffic, not DNS queries. Option C is wrong because CloudWatch Logs can capture logs but not directly from Route 53 Resolver without additional configuration. Option D is wrong because AWS CloudTrail does not log DNS query content.

Answer

Install a CloudWatch Logs agent on each EC2 instance and configure it to send DNS logs to CloudWatch Logs.

Answer

Enable AWS CloudTrail for DNS API calls and deliver to an S3 bucket.

Answer

Enable VPC Flow Logs and publish to an S3 bucket.

Question 11

A security engineer needs to monitor AWS account activity for suspicious API calls and receive alerts. Which AWS service should the engineer use to meet this requirement?

Accepted Answer

AWS CloudTrail with CloudWatch Alarms. Option C is correct because CloudTrail logs API activity and can be integrated with CloudWatch Alarms for alerts. Option A is wrong because GuardDuty focuses on threat detection from various data sources, not specifically API monitoring. Option B is wrong because VPC Flow Logs capture network traffic. Option D is wrong because AWS Config tracks configuration changes.

Answer

VPC Flow Logs

Answer

AWS Config with AWS Config Rules

Answer

Amazon GuardDuty

Question 12

A company has a requirement to retain AWS CloudTrail logs for 7 years for compliance. The logs are stored in an S3 bucket. The company wants to reduce storage costs by automatically moving older logs to a cheaper storage class. Which solution should the company implement?

Accepted Answer

Configure an S3 Lifecycle policy to transition objects from S3 Standard to S3 Glacier after a specified number of days.. Option A is correct because S3 Lifecycle policies can transition objects to Glacier after a specified period. Option B is wrong because S3 Intelligent-Tiering is for unknown access patterns, but the goal is to reduce costs for logs that are rarely accessed. Option C is wrong because S3 Standard-IA is for infrequently accessed data but not the cheapest for archival. Option D is wrong because S3 Batch Operations is for bulk actions, not automatic transitions.

Answer

Use S3 Intelligent-Tiering to automatically move logs to the most cost-effective access tier.

Answer

Move logs to S3 Standard-IA after 30 days.

Answer

Use S3 Batch Operations to manually copy logs to S3 Glacier.

Question 13

A company is using Amazon CloudWatch Logs to collect logs from its EC2 instances. The security team wants to ensure that logs are encrypted at rest and that access to the logs is controlled. Which solution should the team implement?

Accepted Answer

Enable encryption using AWS KMS customer managed keys (CMK) and apply IAM policies to control access.. Option D is correct because CloudWatch Logs supports encryption using AWS KMS customer-managed keys, and IAM policies can control access. Option A is wrong because SSE-S3 is for S3, not CloudWatch Logs. Option B is wrong because CloudWatch Logs does not use SSE-C. Option C is wrong because default encryption uses AWS-managed keys, which may not meet compliance requirements.

Answer

Use SSE-C with a customer-provided key to encrypt log data.

Answer

Use SSE-S3 to encrypt the log data in CloudWatch Logs.

Answer

Enable default encryption on the log group and use S3 bucket policies.

Question 14

A security engineer needs to identify which IAM users have been inactive for the past 90 days. Which AWS service should the engineer use?

Accepted Answer

AWS IAM Credential Report. Option B is correct because IAM provides credential reports that show last activity dates. Option A is wrong because CloudTrail logs API calls but requires analysis to determine inactivity. Option C is wrong because AWS Config tracks resource configuration. Option D is wrong because CloudWatch Logs stores log data, not user activity summaries.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

AWS CloudTrail

Question 15

A company is implementing a security monitoring solution for its AWS environment. Which TWO services can be used to detect and alert on suspicious API activity? (Choose TWO.)

Accepted Answer

Amazon GuardDuty. Options B and D are correct. CloudTrail logs API activity and can trigger CloudWatch Alarms. GuardDuty uses machine learning to detect suspicious API calls. Option A is wrong because VPC Flow Logs capture network traffic. Option C is wrong because AWS Config evaluates resource configurations. Option E is wrong because Inspector scans for vulnerabilities, not API activity.

Answer

Amazon Inspector

Answer

AWS Config

Answer

VPC Flow Logs