SCS-C02 Security Logging and Monitoring Practice Test 16 — 15 Questions

Question 1

A security engineer runs the CLI command above to investigate a console login event. The output shows: {"type":"Root","principalId":"123456789012","arn":"arn:aws:iam::123456789012:root"}. What does this indicate?

Accepted Answer

The AWS account root user performed the console login.. Option B is correct because the principalId and arn show the root user of account 123456789012. Option A is wrong because it is the root user, not an IAM user. Option C is wrong because it is the root user, not a federated user. Option D is wrong because the root user is not a service.

Answer

A federated user performed the console login.

Answer

An AWS service performed the console login.

Answer

An IAM user in the account performed the console login.

Question 2

The IAM policy above is attached to a role used by an EC2 instance to send logs to CloudWatch Logs. The instance is unable to send logs. What is the MOST likely issue?

Accepted Answer

The policy is designed for the CloudWatch Logs service, not for an EC2 instance role.. Option D is correct because the policy allows logs:CreateLogStream and logs:PutLogEvents, but the principal is set to the logs service, not the EC2 instance role. The role should have these permissions. Option A is wrong because the log group exists. Option B is wrong because the resource ARN is correct. Option C is wrong because CloudWatch agent does not need logs:DescribeLogGroups.

Answer

The policy does not include logs:DescribeLogGroups.

Answer

The resource ARN is incorrect.

Answer

The log group does not exist.

Question 3

A security engineer notices that an EC2 instance is sending outbound traffic to an unknown IP address. The engineer needs to capture and analyze the network traffic to determine what data is being exfiltrated. Which AWS service should be used to capture the traffic for analysis?

Accepted Answer

VPC Flow Logs. Option C is correct because VPC Flow Logs capture IP traffic information for network interfaces, including source/destination IPs, ports, protocols, and packet counts, which can be used to analyze outbound traffic. Option A is wrong because AWS CloudTrail records API calls, not network traffic. Option B is wrong because Amazon GuardDuty detects threats but does not capture raw traffic. Option D is wrong because Amazon Inspector assesses vulnerabilities, not network traffic.

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 4

A company uses AWS Organizations with multiple accounts. The security team wants to centrally monitor and analyze all CloudTrail logs from all accounts. The logs must be stored in a centralized S3 bucket with encryption and access logging enabled. Additionally, the team needs to detect anomalous API activity across accounts using machine learning. Which combination of services meets these requirements?

Accepted Answer

AWS CloudTrail to deliver logs to a centralized S3 bucket with default encryption and S3 server access logs; Amazon GuardDuty enabled in all accounts.. Option B is correct because Amazon Macie uses ML to discover sensitive data in S3, not to detect anomalous API activity. Option A is correct: CloudTrail delivers logs to a centralized S3 bucket, Amazon GuardDuty uses ML to detect anomalous API activity across accounts, and S3 server access logs record requests to the bucket. Option C is wrong because AWS Config tracks resource configuration changes, not API activity. Option D is wrong because Amazon Detective analyzes security data but does not provide ML-based anomaly detection for API activity like GuardDuty.

Answer

AWS CloudTrail to deliver logs to a centralized S3 bucket with default encryption; AWS Config to monitor API activity; S3 server access logs enabled.

Answer

AWS CloudTrail to deliver logs to a centralized S3 bucket with default encryption; Amazon Macie to detect anomalous API activity; S3 server access logs enabled.

Answer

AWS CloudTrail to deliver logs to a centralized S3 bucket with default encryption; Amazon Detective to analyze API activity; S3 server access logs enabled.

Question 5

A company wants to receive real-time notifications when specific API calls are made in their AWS account, such as IAM user creation or S3 bucket policy changes. Which AWS service should be used to trigger notifications based on these API events?

Accepted Answer

Amazon CloudWatch Events (Amazon EventBridge). Option A is correct because Amazon CloudWatch Events (now Amazon EventBridge) can match CloudTrail API events and trigger notifications via SNS or Lambda. Option B is wrong because Amazon SNS is a notification service but cannot directly filter API events. Option C is wrong because AWS Config evaluates resource configurations, not API calls. Option D is wrong because Amazon GuardDuty detects threats but does not provide custom event filtering for API calls.

Answer

Amazon GuardDuty

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS Config

Question 6

A company uses AWS CloudTrail to log all API activity and delivers logs to an S3 bucket with server-side encryption (SSE-S3). The security team needs to ensure that only authorized personnel can access the logs and that any unauthorized access attempts are logged and alerted. Additionally, the team wants to prevent the logs from being deleted for at least one year. Which combination of actions should be taken?

Accepted Answer

Enable S3 Object Lock with a retention period of one year; enable S3 server access logs; use a bucket policy with a condition that allows access only from authorized IAM roles or users.. Option C is correct because enabling S3 Object Lock with a retention period prevents deletion, enabling S3 server access logs records all requests, and using bucket policies with conditions restricts access to authorized users. Option A is wrong because S3 default encryption (SSE-S3) does not prevent deletion; S3 server access logs record requests, not access attempts; and IAM policies alone are not sufficient to restrict access if bucket policies are permissive. Option B is wrong because MFA Delete prevents deletion but requires additional setup; CloudTrail logs already record API calls; bucket ACLs are not recommended for access control. Option D is wrong because S3 Inventory lists objects but does not prevent deletion; CloudWatch Logs can monitor but S3 Object Lock is more direct for preventing deletion.

Answer

Enable S3 default encryption (SSE-S3) on the bucket; enable S3 server access logs; attach an IAM policy that allows only authorized users to access the bucket.

Answer

Enable MFA Delete on the bucket; enable CloudTrail log file validation; use bucket ACLs to restrict access.

Answer

Enable S3 Inventory to track objects; enable CloudTrail to log S3 API calls; use a bucket policy with a deny effect for unauthorized users.

Question 7

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team wants to analyze web request logs to identify potential SQL injection attacks. Which AWS service should be used to collect and analyze the ALB access logs?

Accepted Answer

Amazon Athena. Option D is correct because Amazon Athena can query ALB access logs stored in S3 using standard SQL, allowing analysis for SQL injection patterns. Option A is wrong because Amazon CloudWatch Logs Insights can query CloudWatch Logs but ALB access logs are typically stored in S3, not CloudWatch Logs. Option B is wrong because VPC Flow Logs capture network traffic metadata, not HTTP request details. Option C is wrong because AWS WAF provides web application firewall capabilities but does not analyze stored logs; it can generate logs but analysis would require another service like Athena.

Answer

VPC Flow Logs

Answer

AWS WAF

Answer

Amazon CloudWatch Logs Insights

Question 8

A security engineer needs to monitor for unauthorized changes to IAM roles and policies in an AWS account. The engineer wants to receive an email notification whenever an IAM policy is attached to a role. Which AWS services should be combined to achieve this?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events (Amazon EventBridge). Option A is correct: CloudTrail records the AttachRolePolicy API call, and CloudWatch Events (EventBridge) can trigger an SNS notification when that event occurs. Option B is wrong because AWS Config can detect configuration changes but does not directly send email; it can integrate with SNS but CloudTrail is more straightforward for API-specific events. Option C is wrong because Amazon Inspector does not monitor IAM changes. Option D is wrong because Amazon GuardDuty detects threats, not specific API calls.

Answer

Amazon GuardDuty and Amazon Simple Email Service (SES)

Answer

AWS Config and Amazon Simple Notification Service (SNS)

Answer

Amazon Inspector and Amazon CloudWatch Logs

Question 9

A company has enabled AWS CloudTrail in all regions and is delivering logs to an S3 bucket. The security team wants to ensure that any attempt to disable CloudTrail logging is detected and alerted. Which approach should be used?

Accepted Answer

Create a CloudWatch Events rule that matches the StopLogging API call and sends a notification via SNS.. Option B is correct because a CloudWatch Events (EventBridge) rule can match the StopLogging or UpdateTrail API calls from CloudTrail and trigger an SNS notification. Option A is wrong because AWS Config can evaluate whether CloudTrail is enabled, but may not detect a disablement in real-time; it is more for compliance. Option C is wrong because VPC Flow Logs do not capture API calls. Option D is wrong because Amazon GuardDuty does not monitor CloudTrail configuration changes.

Answer

Enable Amazon GuardDuty to detect CloudTrail disablement.

Answer

Use AWS Config to create a rule that checks if CloudTrail is enabled.

Answer

Enable VPC Flow Logs to capture traffic to the CloudTrail endpoint.

Question 10

A company uses Amazon RDS for MySQL and needs to monitor database activity for suspicious queries, such as unauthorized access attempts or SQL injection. The security team wants to centralize the logs from multiple RDS instances and analyze them in near real-time. Which solution should be implemented?

Accepted Answer

Enable database audit logs on each RDS instance, stream them to Amazon CloudWatch Logs, and use CloudWatch Logs Insights to query the logs.. Option C is correct because enabling RDS Enhanced Monitoring provides OS-level metrics, not SQL queries, so it is not suitable. Option A is correct: RDS provides database audit logs that can be streamed to CloudWatch Logs, and CloudWatch Logs Insights allows querying and analyzing logs in near real-time. Option B is wrong because VPC Flow Logs capture network traffic, not SQL queries. Option D is wrong because AWS CloudTrail records API calls, not database queries.

Answer

Enable RDS Enhanced Monitoring and stream the metrics to Amazon CloudWatch.

Answer

Enable VPC Flow Logs for the RDS instances and analyze the logs using Amazon Athena.

Answer

Enable AWS CloudTrail for RDS API calls and use Amazon GuardDuty to analyze the logs.

Question 11

A security engineer is investigating a potential security incident involving an EC2 instance. The engineer needs to determine if any unauthorized SSH keys were added to the instance's authorized_keys file. Which AWS service should be used to detect this change?

Accepted Answer

AWS Config. Option C is correct because AWS Config can track changes to EC2 instance configurations, including file changes if using AWS Systems Manager Inventory or custom rules, but more directly, AWS Config can monitor for changes to security groups and IAM roles, not file contents. However, for file changes, AWS Systems Manager (SSM) Inventory can track file changes. Option A is wrong because AWS CloudTrail records API calls, not file changes. Option B is wrong because Amazon GuardDuty detects threats based on network and API activity. Option D is wrong because Amazon Inspector assesses vulnerabilities, not file integrity. The correct answer is actually not listed perfectly, but among the options, AWS Config with a custom rule can monitor for changes to the authorized_keys file if integrated with SSM. However, the best answer is AWS Config (option C) because it can be used with SSM to detect file changes. Option D is wrong because Inspector does not detect file changes.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Question 12

A company is designing a centralized logging solution for multiple AWS accounts. The solution must meet the following requirements: 1) Logs from all accounts must be stored in a centralized S3 bucket. 2) The logs must be encrypted at rest using AWS KMS. 3) Access to the logs must be logged and monitored. Which TWO services should be used to meet the requirements? (Choose TWO.)

Accepted Answer

AWS CloudTrail. Option B is correct because AWS CloudTrail can be configured to deliver logs from multiple accounts to a centralized S3 bucket. Option C is correct because S3 server access logs record requests made to the bucket, providing access logging. Option A is wrong because Amazon Macie is for sensitive data discovery, not centralizing logs. Option D is wrong because AWS Config tracks resource configurations, not log delivery. Option E is wrong because Amazon GuardDuty provides threat detection, not centralized logging.

Answer

Amazon GuardDuty

Answer

Amazon Macie

Answer

AWS Config

Question 13

A security engineer is configuring Amazon GuardDuty in a multi-account environment using AWS Organizations. The engineer needs to ensure that all findings from member accounts are visible in the administrator account. Additionally, the engineer wants to receive real-time notifications for high-severity findings. Which TWO actions should the engineer take? (Choose TWO.)

Accepted Answer

Designate an administrator account in GuardDuty to manage the multi-account environment.. Option A is correct because designating an administrator account in GuardDuty allows centralized viewing of findings. Option C is correct because creating an EventBridge rule that matches GuardDuty findings and sends to SNS enables real-time notifications. Option B is wrong because enabling CloudTrail does not aggregate GuardDuty findings. Option D is wrong because Amazon Detective is for deeper investigation, not real-time notifications. Option E is wrong because AWS Config does not provide real-time notifications for GuardDuty findings.

Answer

Enable Amazon Detective to analyze GuardDuty findings.

Answer

Enable AWS CloudTrail in all member accounts to log GuardDuty API calls.

Answer

Use AWS Config to monitor GuardDuty configuration.

Question 14

A company needs to monitor its AWS environment for compliance with the CIS AWS Foundations Benchmark. The security team wants to automatically check for non-compliant resources and receive reports. Which THREE services should be used together to meet these requirements? (Choose THREE.)

Accepted Answer

AWS Security Hub. Option A, C, and D are correct: AWS Config can evaluate resources against rules (including CIS benchmarks), Amazon Inspector can assess for vulnerabilities (but not specifically CIS benchmarks), and AWS Security Hub aggregates findings from multiple services including Config and provides consolidated reports. Option A is correct because AWS Config has managed rules for CIS benchmarks. Option C is correct because Security Hub can aggregate Config findings and provide compliance reports. Option D is correct because Amazon Detective is for investigation, not compliance. Option E is correct because Amazon GuardDuty is for threat detection, not compliance. Option B is wrong because Amazon Macie is for sensitive data, not compliance.

Answer

Amazon Detective

Answer

Amazon GuardDuty

Answer

Amazon Macie

Question 15

A company uses AWS CloudTrail to log API activity across multiple accounts. The security team wants to ensure that any S3 bucket created with public read access is detected within minutes. Which solution is MOST efficient?

Accepted Answer

Create an Amazon EventBridge rule that matches CloudTrail CreateBucket API calls and triggers a Lambda function that inspects the bucket's public access settings and alerts if public.. Option C is correct because using CloudTrail with an Amazon EventBridge rule on CreateBucket events combined with S3 public access checks via AWS Config or direct API calls allows near-real-time detection. Option A is wrong because it relies on CloudTrail log file delivery to S3, which can have delays. Option B is wrong because it only reports current state, not immediate changes. Option D is wrong because it requires manual setup and polling.

Answer

Use AWS Config rules to check S3 bucket public access settings and trigger an AWS Lambda function to send alerts.

Answer

Use S3 server access logs and run a daily script to parse the logs for PutBucketAcl actions.

Answer

Enable CloudTrail log file validation and use Athena to query logs hourly for CreateBucket events with public ACLs.