SCS-C02 Security Logging and Monitoring Practice Test 15 — 15 Questions

Question 1

A security team wants to implement a centralized logging solution for multiple AWS accounts. The team needs to collect VPC Flow Logs, CloudTrail logs, and DNS query logs from all accounts. Which THREE services should the team use to aggregate these logs? (Choose THREE.)

Accepted Answer

Amazon Route 53 Resolver query logging. Options A, B, and D are correct. CloudTrail can be set up with an organization trail to aggregate management events. Route 53 Resolver query logging can publish to a central S3 bucket. VPC Flow Logs can be published to a central S3 bucket or CloudWatch Logs. Option C is wrong because AWS Config does not aggregate logs. Option E is wrong because CloudHSM is a hardware security module, not for log aggregation.

Answer

AWS CloudHSM

Answer

AWS Config

Question 2

A company wants to monitor AWS account activity and receive real-time notifications for specific API calls. Which TWO services should the company use together? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Events (Amazon EventBridge). Options B and E are correct. CloudTrail logs API calls, and CloudWatch Events (now Amazon EventBridge) can trigger notifications based on patterns. Option A is wrong because CloudWatch Logs is for log storage, not event-driven notifications. Option C is wrong because AWS Config is for resource tracking. Option D is wrong because SNS is a notification service but needs a source of events.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon Simple Notification Service (SNS)

Question 3

A security engineer needs to ensure that all API calls made to AWS are logged and retained for at least 7 years for compliance. Which AWS service should be enabled to meet this requirement?

Accepted Answer

AWS CloudTrail. Option C is correct because AWS CloudTrail logs API activity and can be configured to store logs in S3 with lifecycle policies for long-term retention. Option A is wrong because Amazon GuardDuty is a threat detection service, not for API logging. Option B is wrong because AWS Config records resource configuration changes, not API calls. Option D is wrong because Amazon Inspector is for vulnerability assessments.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon Inspector

Question 4

A company is experiencing unauthorized access attempts to an S3 bucket. Which AWS service can be used to detect and alert on such events in real time?

Accepted Answer

Amazon GuardDuty. Option B is correct because Amazon GuardDuty uses threat intelligence to detect suspicious activity, including unauthorized S3 access attempts. Option A is wrong because AWS CloudTrail is for logging, not real-time detection. Option C is wrong because Amazon Macie is for data classification. Option D is wrong because AWS Config is for compliance.

Answer

Amazon Macie

Answer

AWS Config

Answer

AWS CloudTrail

Question 5

A security team wants to centrally collect and analyze VPC Flow Logs from multiple AWS accounts for security monitoring. Which solution is MOST scalable and cost-effective?

Accepted Answer

Use AWS Organizations to centralize logging by delivering VPC Flow Logs to a centralized S3 bucket and query with Amazon Athena.. Option D is correct because using AWS Organizations with a centralized S3 bucket and Amazon Athena allows scalable querying of VPC Flow Logs across accounts without additional data transfer costs. Option A is wrong because sending logs to a centralized CloudWatch Logs account from multiple accounts requires cross-account subscriptions and incurs data transfer costs. Option B is wrong because Kinesis Data Firehose with Lambda adds complexity and cost. Option C is wrong because using an EC2 instance for log analysis is not scalable or cost-effective.

Answer

Aggregate logs in an EC2 instance running an ELK stack.

Answer

Use Amazon Kinesis Data Firehose to stream logs to an S3 bucket and process with AWS Lambda.

Answer

Configure VPC Flow Logs to send to a centralized CloudWatch Logs account using cross-account subscriptions.

Question 6

A company needs to monitor for root account usage and receive immediate notifications. Which combination of AWS services should be used?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Logs, and Amazon SNS. Option A is correct because CloudTrail can be configured to send events to CloudWatch Logs, and a CloudWatch metric filter can detect root account activity, triggering an SNS notification. Option B is wrong because GuardDuty does not specifically monitor root account usage. Option C is wrong because Config records resource changes, not API calls. Option D is wrong because S3 server access logs are for S3 access, not root usage.

Answer

AWS Config and AWS Lambda

Answer

Amazon GuardDuty and AWS Lambda

Answer

S3 server access logs and Amazon Inspector

Question 7

A security engineer is troubleshooting an issue where CloudTrail logs are not being delivered to the specified S3 bucket. The bucket policy allows CloudTrail to write objects. What is the MOST likely cause?

Accepted Answer

The S3 bucket has a bucket policy that denies access to the CloudTrail service principal.. Option B is correct because S3 bucket policies that explicitly deny access to AWS services can override allows. Option A is wrong because CloudTrail does not require SSE-C; it supports SSE-S3. Option C is wrong because versioning is not required for CloudTrail log delivery. Option D is wrong because CloudTrail can deliver logs across accounts with proper permissions.

Answer

The S3 bucket uses server-side encryption with customer-provided keys (SSE-C).

Answer

The S3 bucket does not have versioning enabled.

Answer

The S3 bucket is in a different AWS account.

Question 8

A company uses AWS CloudTrail to log all management events and data events for S3. The security team wants to detect any PutObject API calls that upload objects with server-side encryption disabled. Which solution is MOST efficient?

Accepted Answer

Enable CloudTrail data events for S3 and create a CloudWatch metric filter to alert on PutObject calls without the x-amz-server-side-encryption header.. Option C is correct because CloudTrail data events log S3 PutObject calls, and a CloudWatch Logs metric filter can parse the requestParameters for x-amz-server-side-encryption header to detect missing encryption. Option A is wrong because S3 server access logs are text-based and not as easy to filter. Option B is wrong because GuardDuty does not check encryption headers. Option D is wrong because Macie detects sensitive data, not encryption status.

Answer

Use Amazon GuardDuty to detect unencrypted uploads.

Answer

Use Amazon Macie to scan S3 objects for missing encryption.

Answer

Enable S3 server access logs and parse them with Amazon Athena.

Question 9

A company wants to receive an alert when an IAM user creates a new access key. Which AWS service should be used to trigger the alert?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events. Option C is correct because CloudTrail logs IAM CreateAccessKey events. A CloudWatch Events rule can match this event and trigger an SNS notification. Option A is wrong because Config evaluates resource compliance, not API events. Option B is wrong because CloudWatch Logs requires logs to be sent, but CloudTrail is the source. Option D is wrong because GuardDuty detects threats, not specific API calls.

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Answer

AWS Config

Question 10

A security engineer needs to monitor for unusual outbound network traffic from an EC2 instance. Which AWS service provides this capability?

Accepted Answer

VPC Flow Logs. Option B is correct because VPC Flow Logs capture network traffic metadata, including source and destination IPs, ports, and protocols. Option A is wrong because CloudWatch Logs agent collects logs, not network flows. Option C is wrong because AWS Config records configuration changes. Option D is wrong because Amazon Inspector is for vulnerability assessments.

Answer

Amazon CloudWatch Logs agent

Answer

Amazon Inspector

Answer

AWS Config

Question 11

A company is using AWS CloudTrail to log all management events and has enabled log file validation. What additional security benefit does log file validation provide?

Accepted Answer

It ensures the integrity of the log files by detecting tampering.. Option D is correct because log file validation creates a hash of each log file and stores it in a digest file, allowing verification that no logs were modified or deleted. Option A is wrong because validation does not encrypt logs. Option B is wrong because it does not prevent deletion; it detects tampering. Option C is wrong because it does not provide real-time monitoring.

Answer

It prevents anyone from deleting the log files.

Answer

It encrypts the log files at rest.

Answer

It provides real-time monitoring for API calls.

Question 12

A company needs to monitor for unauthorized changes to security group rules. Which TWO AWS services can be used together to achieve this?

Accepted Answer

AWS Config. Options B and D are correct. AWS Config can track changes to security group rules, and Amazon CloudWatch Events can trigger a notification when a config change is detected. Option A (GuardDuty) is for threat detection. Option C (CloudTrail) logs API calls but is not the best for rule-level changes. Option E (Inspector) is for vulnerability scanning.

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 13

A security engineer is designing a centralized logging solution for 10 AWS accounts. Which THREE AWS services should be used to aggregate, store, and analyze logs?

Accepted Answer

AWS Organizations. Options B, C, and D are correct. Amazon S3 provides durable storage, Amazon Athena allows querying logs, and AWS Organizations enables centralized management. Option A (Kinesis Data Streams) is for real-time streaming, not necessary. Option E (CloudWatch Logs) is for real-time monitoring but not ideal for long-term analysis.

Answer

Amazon Kinesis Data Streams

Answer

Amazon CloudWatch Logs

Question 14

Which TWO AWS services can be used to detect and alert on suspicious activity in near real-time?

Accepted Answer

Amazon CloudWatch Events. Options A and D are correct. Amazon GuardDuty provides near real-time threat detection, and Amazon CloudWatch Events can trigger alerts based on patterns. Option B (Config) is for compliance, not threat detection. Option C (CloudTrail) is for logging, not real-time alerting. Option E (Inspector) is for vulnerability scanning.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

AWS Config

Question 15

A security engineer configured the S3 bucket policy shown above for CloudTrail log delivery, but CloudTrail is not delivering logs. What is the MOST likely reason?

Accepted Answer

The policy does not include s3:GetBucketAcl permission.. Option C is correct because the bucket policy must also grant the s3:GetBucketAcl action for CloudTrail to verify the bucket ACL. Option A is wrong because encryption is not required. Option B is wrong because the region is not specified in the policy. Option D is wrong because the resource ARN is correct for CloudTrail logs.

Answer

The bucket is in the wrong region.

Answer

The resource ARN is incorrect.

Answer

The bucket does not have default encryption enabled.