SCS-C02 Security Logging and Monitoring Practice Test 15 — 15 Questions

Question 1

Which TWO actions should a security engineer take to ensure that CloudTrail logs are protected from unauthorized deletion? (Choose two.)

Accepted Answer

Attach an S3 bucket policy that denies s3:DeleteObject to all principals except the CloudTrail service principal.. Attaching an S3 bucket policy that denies s3:DeleteObject to all principals except the CloudTrail service principal prevents any user or role (including root) from deleting log files, while still allowing CloudTrail to write logs. This ensures that even if an attacker gains administrative access, they cannot delete the logs, preserving their integrity for forensic analysis.

Answer

Enable S3 versioning on the log bucket.

Answer

Enable S3 default encryption with SSE-S3.

Answer

Configure CloudTrail to send logs to CloudWatch Logs.

Question 2

Which THREE AWS services can be used to detect and alert on suspicious network traffic patterns? (Choose three.)

Accepted Answer

AWS Network Firewall. AWS Network Firewall is correct because it is a managed firewall service that can inspect network traffic at the VPC level using stateful and stateless rules. It can detect suspicious patterns such as port scans, malicious IP addresses, or protocol anomalies and generate alerts via Amazon CloudWatch metrics and logs, enabling real-time notification of suspicious network traffic.

Answer

AWS Systems Manager

Answer

AWS CloudTrail

Question 3

A financial services company has a production AWS account with hundreds of EC2 instances running a mix of Linux and Windows workloads. The security team is responsible for detecting and responding to security incidents. They have enabled CloudTrail, VPC Flow Logs, and GuardDuty. Recently, GuardDuty generated a finding indicating that an EC2 instance is communicating with a known malicious IP address. The security engineer needs to investigate the incident. The engineer examines the GuardDuty finding and sees the affected resource is an EC2 instance ID. The engineer wants to identify which user or role launched the instance and what security groups were associated with it at launch time. Which approach should the engineer take to gather this information?

Accepted Answer

Search CloudTrail logs for the RunInstances event that created the instance, using the instance ID to filter.. CloudTrail logs the RunInstances API call, which includes the user identity (who launched the instance), the instance ID, and the security group IDs associated at launch. Option A is incorrect because the EC2 console Security tab shows current security groups and does not provide historical launch details or the user who launched. Option B is incorrect because AWS Systems Manager Inventory collects operational data but does not capture the launch user or initial security group associations. Option D is incorrect because AWS Config records configuration changes over time but does not identify the user who performed the launch action.

Answer

Log in to the EC2 console and view the instance details under the 'Security' tab.

Answer

Use AWS Systems Manager Inventory to collect metadata about the instance.

Answer

Use AWS Config to view the configuration history of the EC2 instance and check the security group changes.

Question 4

A company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group, and an RDS MySQL database. The security team wants to monitor for SQL injection attempts. They have enabled AWS WAF on the ALB and are logging all requests. The security engineer needs to analyze the WAF logs to identify if any SQL injection attacks have been attempted. The logs are stored in an S3 bucket. The engineer needs to query the logs for patterns like 'SELECT * FROM' or 'DROP TABLE' in the URI. Which service should the engineer use to perform this analysis?

Accepted Answer

Amazon Athena. (Amazon Athena) is correct because it can query WAF logs stored in S3 using standard SQL, making it ideal for analyzing patterns like 'SELECT * FROM' or 'DROP TABLE' in the URI. Option A (Kinesis Data Analytics) is for real-time streaming analytics, not static S3 logs. Option B (QuickSight) is a business intelligence visualization tool, not a query engine for raw logs. Option C (CloudWatch Logs Insights) is for querying logs in CloudWatch Logs, not S3.

Answer

Amazon Kinesis Data Analytics

Answer

Amazon QuickSight

Answer

CloudWatch Logs Insights

Question 5

A security engineer notices that CloudTrail logs for a production account are not being delivered to the S3 bucket. The bucket policy allows CloudTrail to write objects. What is the MOST likely cause?

Accepted Answer

The bucket policy does not grant s3:GetBucketAcl to CloudTrail.. CloudTrail requires the `s3:GetBucketAcl` permission on the destination S3 bucket to verify that the bucket policy grants CloudTrail the necessary write access. Without this permission, CloudTrail cannot confirm its ability to deliver logs, even if the bucket policy explicitly allows `s3:PutObject`. This is a prerequisite check performed by CloudTrail before any log delivery occurs.

Answer

The S3 bucket does not have versioning enabled.

Answer

The S3 bucket uses SSE-KMS encryption.

Answer

The S3 bucket contains existing objects before CloudTrail delivery started.

Question 6

A company wants to monitor AWS API calls for suspicious activity and automatically remediate by revoking IAM roles in real time. Which combination of services should be used?

Accepted Answer

Amazon CloudWatch Events and AWS Lambda. The combination of Amazon CloudWatch Events and AWS Lambda enables real-time monitoring and automated remediation of AWS API calls. CloudWatch Events can capture API calls from AWS CloudTrail (or other sources) and trigger a Lambda function to revoke IAM roles based on suspicious activity patterns, providing the required real-time response.

Answer

AWS CloudTrail and Amazon Inspector

Answer

AWS CloudTrail and AWS Config

Answer

Amazon GuardDuty and AWS Config

Question 7

A security team needs to audit all changes to IAM policies in their AWS account. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made in the AWS account, including IAM policy changes such as CreatePolicy, PutRolePolicy, and AttachUserPolicy. These events are captured as CloudTrail log entries, which can be audited to track who made the change, when it was made, and from which source IP. CloudTrail is the primary service for auditing and logging all management events across AWS services.

Answer

AWS Config

Answer

Amazon CloudWatch

Answer

IAM Access Analyzer

Question 8

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all CloudTrail trails are enabled in all accounts and log to a central S3 bucket. What is the MOST efficient way to enforce this?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a CloudTrail template to all accounts.. AWS CloudFormation StackSets allows you to deploy a CloudTrail template across multiple accounts and Regions from a single management account, ensuring all accounts have a trail configured to log to the central S3 bucket. This approach is the most efficient as it automates deployment, enforces consistent configuration, and scales across the entire organization without requiring per-account manual intervention or custom scripting.

Answer

Use AWS Lambda to check each account and enable CloudTrail if missing.

Answer

Use AWS Config aggregator to verify compliance and send alerts.

Answer

Create a service control policy (SCP) that requires CloudTrail.

Question 9

A company needs to monitor for unauthorized S3 bucket deletions. Which CloudWatch Logs metric filter should be used on CloudTrail logs?

Accepted Answer

eventName = DeleteBucket. The CloudTrail event `DeleteBucket` is logged when an S3 bucket is deleted. By creating a CloudWatch Logs metric filter that matches `eventName = DeleteBucket` on the CloudTrail log group, you can trigger an alarm or automated response to detect unauthorized bucket deletions. This directly addresses the monitoring requirement.

Answer

eventName = GetBucketAcl

Answer

eventName = PutBucketPolicy

Answer

eventName = ListBuckets

Question 10

Which TWO of the following are valid sources for Amazon CloudWatch Logs? (Select TWO.)

Accepted Answer

On-premises servers via the CloudWatch agent. On-premises servers can send logs to Amazon CloudWatch Logs by installing and configuring the CloudWatch agent. The agent collects system and application logs from the server and forwards them to CloudWatch Logs for centralized monitoring, alerting, and storage. This is a valid and common hybrid monitoring pattern.

Answer

Amazon RDS for MySQL logs

Answer

VPC Flow Logs delivered to S3

Answer

Amazon S3 access logs

Question 11

A company has a multi-account AWS Organization with 50 accounts. The security team wants to monitor for unauthorized IAM role assumption across all accounts. They have enabled AWS CloudTrail in all accounts and are delivering logs to a central S3 bucket in the security account. They also have Amazon GuardDuty enabled in all accounts. The security team wants a centralized dashboard to visualize cross-account role assumption events. They have limited budget and want to use existing services. What should they do?

Accepted Answer

Use Amazon Athena to query CloudTrail logs in S3 and visualize with Amazon QuickSight.. Amazon Athena can query CloudTrail logs stored in S3 using standard SQL, and Amazon QuickSight can create visualizations from Athena query results. This leverages existing services without additional cost for Amazon QuickSight (pay-per-session pricing) and minimal cost for Athena (based on data scanned). Option B is incorrect because AWS Config aggregator provides a view of resource configuration across accounts, not API call analysis. Option C is incorrect because CloudWatch Logs Insights cannot directly query logs stored in S3; it requires logs to be in CloudWatch Logs. Option D is incorrect because Amazon Elasticsearch Service incurs additional costs and complexity, which the company wants to avoid.

Answer

Use AWS Config aggregator to view cross-account IAM role creation.

Answer

Use Amazon CloudWatch Logs Insights to query logs from the central S3 bucket.

Answer

Use Amazon Elasticsearch Service to index CloudTrail logs from S3 and visualize with Kibana.

Question 12

A security engineer is investigating a potential data exfiltration incident. They suspect that an EC2 instance was compromised and used to transfer large amounts of data from an S3 bucket to an external IP address. The engineer has enabled VPC Flow Logs for the subnet where the EC2 instance resides, but the logs are not capturing traffic to the external IP. What is the most likely reason?

Accepted Answer

The traffic is routed through a NAT gateway, and flow logs are not enabled on the NAT gateway's subnet.. VPC Flow Logs capture traffic at the subnet or ENI level. If traffic from an EC2 instance to an external IP is routed through a NAT gateway, the flow logs on the EC2 instance's subnet will only show traffic to the NAT gateway, not the external IP. To capture the external traffic, flow logs must be enabled on the subnet where the NAT gateway resides. Option A is incorrect because Security Groups do not affect flow log capture; they filter traffic but flow logs log both accepted and rejected traffic. Option B is incorrect because VPC Flow Logs capture all traffic, not just rejected. Option C is incorrect because flow logs capture traffic to any IP, not just other VPC resources.

Answer

The EC2 instance's security group is blocking the traffic.

Answer

VPC Flow Logs only capture rejected traffic.

Answer

VPC Flow Logs only capture traffic to and from other VPC resources.

Question 13

A company uses Amazon CloudWatch Logs to collect application logs from EC2 instances. The security team wants to create an alarm that triggers when a specific error pattern appears in the logs. They have set up a metric filter and an alarm. However, the alarm is not triggering even though the error pattern exists in the logs. What is the most likely cause?

Accepted Answer

The metric filter is only applied to log events that occur after the filter is created.. Metric filters only apply to log events that are ingested after the filter is created. They do not evaluate historical log data, so if the error pattern existed before the filter was created, it will not be counted toward the metric. Option A is incorrect because the log group retention period determines how long logs are stored, not whether the metric filter evaluates them. Option B is incorrect because custom namespaces are allowed for CloudWatch metrics. Option C is incorrect because the metric filter cannot be created without an existing log group; it must be created after the log group exists.

Answer

The log group retention period is set to 1 day.

Answer

The metric filter uses a custom namespace that is not allowed.

Answer

The metric filter was created before the log group.

Question 14

A security engineer needs to monitor for AWS account root user login events and automatically send a notification to the security team. The engineer has enabled CloudTrail and is sending logs to CloudWatch Logs. What is the least effort way to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches the event and triggers an SNS topic.. CloudWatch Events (now Amazon EventBridge) can directly filter CloudTrail events for root user login (userIdentity.type = 'Root') and trigger an SNS topic for notification with minimal configuration. Option A is wrong because Amazon GuardDuty requires enabling a separate service and its findings for root activity are not as direct or immediate as a custom rule. Option B is wrong because a metric filter and alarm require additional steps to create a metric and set up an alarm. Option D is wrong because AWS Config managed rules are designed for resource configuration compliance, not for monitoring API call events like root user logins.

Answer

Enable Amazon GuardDuty and use its finding for root user activity.

Answer

Create a metric filter on the CloudWatch Logs group and a CloudWatch alarm.

Answer

Use AWS Config managed rule to detect root user activity.

Question 15

A company stores sensitive data in an S3 bucket with SSE-KMS encryption. The security team wants to log all access attempts to the bucket, including successful and denied requests. They have enabled S3 server access logs and are delivering them to a different bucket. However, they notice that some access attempts are not logged. What is the most likely reason?

Accepted Answer

S3 server access logs do not log requests that are denied before reaching S3.. S3 server access logs only capture requests that reach the S3 service. Requests that are denied before reaching S3—such as those blocked by bucket policies, ACLs, or AWS Organizations service control policies (SCPs)—are not logged. Options A, B, and C are incorrect: the delivery bucket can be in a different account (A), S3 access logs log both successful and denied requests that reach S3 (B), and SSE-KMS encryption does not prevent logging (C).

Answer

The delivery bucket is in a different AWS account.

Answer

The access logs only log successful requests.

Answer

The bucket uses SSE-KMS encryption, which prevents logging.