SCS-C02 Security Logging and Monitoring Practice Test 16 — 15 Questions

Question 1

A security team wants to detect and alert when an EC2 instance is terminated. They have enabled CloudTrail and are sending logs to CloudWatch Logs. Which combination of services should they use to achieve this with minimal latency?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon CloudWatch Events (EventBridge) and Amazon SNS. Amazon CloudWatch Events (EventBridge) can monitor EC2 instance state changes in real-time and trigger an SNS notification with minimal latency. Option A is wrong because metric filters and alarms from CloudWatch Logs introduce latency due to log ingestion and processing. Option B is wrong because AWS Config evaluates changes periodically (not real-time). Option D is wrong because GuardDuty focuses on security threats, not instance state changes.

Answer

CloudWatch Logs metric filter and CloudWatch alarm

Answer

AWS Config and AWS Lambda

Answer

Amazon GuardDuty and Amazon SNS

Question 2

A company is migrating its on-premises log aggregation system to AWS. They have multiple applications running on EC2 instances that generate logs in JSON format. The security team needs a centralized logging solution that can ingest logs from all instances, store them durably, and allow real-time searching and alerting. The team also needs to retain logs for at least one year for compliance. The current plan is to use Amazon CloudWatch Logs for ingestion and search, but the team is concerned about the cost of long-term storage and the need for ad-hoc querying. Which solution meets the requirements with the LEAST operational overhead?

Accepted Answer

Use the CloudWatch agent to send logs to CloudWatch Logs for real-time monitoring, then export logs to Amazon S3 daily, and use S3 lifecycle policies to expire logs after one year.. Using the CloudWatch agent to send logs to CloudWatch Logs provides real-time monitoring and alerting. Daily export to S3 ensures durable, low-cost long-term storage with lifecycle policies to expire logs after one year. This approach minimizes operational overhead by leveraging managed services without additional cluster management. Option A (CloudWatch Logs only) is costly for one-year retention. Option B (direct to S3 with Athena) lacks real-time search. Option D (OpenSearch Service) requires cluster management, increasing overhead.

Answer

Send all logs to CloudWatch Logs and set a retention policy of one year.

Answer

Send logs directly to an S3 bucket and use Amazon Athena to query logs in real time.

Answer

Send logs to Amazon OpenSearch Service (formerly Elasticsearch) with a one-year retention policy.

Question 3

A company has a multi-account AWS environment using AWS Organizations. The security team wants to centralize all CloudTrail logs from all accounts into a single S3 bucket in the management account. They have enabled CloudTrail in the management account with an organization trail that delivers logs to an S3 bucket. However, logs from member accounts are not appearing. The S3 bucket policy includes permissions for CloudTrail to write logs, but it does not explicitly grant access to member accounts. What should the team do to ensure that member account CloudTrail logs are delivered to the central S3 bucket?

Accepted Answer

Verify that the organization trail is configured correctly with the 'Include all accounts in my organization' option enabled, and that the S3 bucket policy allows CloudTrail to write from all accounts.. An organization trail automatically delivers logs from all accounts without needing separate trails in each account. If logs are not appearing, the issue is likely that the organization trail is not properly configured or member accounts are not enabled. Option A is incorrect because member trails cannot write to a bucket in another account without proper cross-account permissions, and this approach is not recommended. Option B is incorrect because disabling and re-enabling might not fix the underlying issue. Option D is incorrect because the bucket policy must allow CloudTrail from all accounts, but the primary cause is often the organization trail setup.

Answer

Ask each member account to create a new trail that delivers logs to the same S3 bucket.

Answer

Disable the organization trail and recreate it, ensuring that all member accounts are selected.

Answer

Modify the S3 bucket policy to grant write access to the CloudTrail service principal for each member account's AWS account ID.

Question 4

A company uses Amazon GuardDuty to monitor for malicious activity in its AWS environment. The security team receives a high number of findings, many of which are false positives. They want to reduce noise by suppressing findings for known benign activities, such as internal vulnerability scans performed by the security team. GuardDuty has a feature to create suppression rules based on finding criteria. However, the team also wants to ensure that if a new type of threat is detected, it is immediately escalated. What is the MOST effective way to manage GuardDuty findings?

Accepted Answer

Create suppression rules that automatically archive findings matching the known benign activity criteria, and periodically review the suppressed findings.. Creating suppression rules that automatically archive findings matching known benign activity criteria reduces noise from false positives while still allowing the team to periodically review suppressed findings to ensure no genuine threats are missed. Option A (setting GuardDuty to only generate findings for medium and high severity) is less effective because low severity findings may still contain important information. Option B (suppressing all findings from an internal IP range) is too broad and could miss threats that originate from that range, such as compromised internal instances. Option C (disabling specific finding types) would miss new variations of known threats that might be reported under those types, whereas suppression rules can be more granular and reviewed. Therefore, D is the most effective approach.

Answer

Set GuardDuty to only generate findings for medium and high severity, ignoring low severity findings.

Answer

Create a suppression rule that blocks all findings from the internal IP range used by the security team.

Answer

Disable the specific GuardDuty finding types that generate false positives.

Question 5

Refer to the exhibit. A security engineer investigates a potential unauthorized deletion of an AWS CloudTrail trail. The engineer runs the command and receives the output shown. Which additional step should the engineer take to determine if the trail deletion was unauthorized?

Accepted Answer

Enable AWS Config rules to monitor CloudTrail configuration changes and cross-reference the event time with an approved change window.. The engineer needs to determine if the deletion was unauthorized. Checking the source IP or permissions may not be sufficient. The best approach is to verify if the deletion occurred within an approved change window, which can be tracked via AWS Config or change management processes.

Answer

Check the source IP address 203.0.113.50 against a list of approved corporate IP ranges.

Answer

Review the IAM user 'admin' permissions to see if they have the cloudtrail:DeleteTrail permission.

Answer

Use CloudTrail Insights to detect unusual API activity for the DeleteTrail event.

Question 6

Refer to the exhibit. A security engineer applies this S3 bucket policy to enforce server-side encryption. However, users report that they can still upload objects without encryption. What is the most likely reason the policy is not working as intended?

Accepted Answer

The policy uses 's3:x-amz-server-side-encryption-customer-algorithm' instead of the correct condition key 's3:x-amz-server-side-encryption'.. The policy likely uses the condition key 's3:x-amz-server-side-encryption-customer-algorithm' instead of the correct key 's3:x-amz-server-side-encryption'. The former enforces SSE-C, while the latter is required for general server-side encryption (SSE-S3 or SSE-KMS). Because the policy uses the SSE-C-specific key, it does not apply to requests that lack that header, allowing users to upload unencrypted objects. Option A is incorrect because bucket policies apply to all principals, including the bucket owner, regardless of the access method. Option B is incorrect because using 'Deny' with a condition is the standard method to enforce encryption. Option C is incorrect because the PutObjectAcl action is not related to encryption enforcement.

Answer

The bucket policy does not apply to objects uploaded by the bucket owner when using the AWS Management Console.

Answer

The bucket policy uses 'Deny' instead of 'Allow', which is incorrect for enforcing encryption.

Answer

The policy does not include 's3:PutObjectAcl' action, so users can bypass encryption via ACLs.

Question 7

Refer to the exhibit. A security engineer reviews IAM permissions for the 'admin' user. The user is a member of the 'Administrators' group, which has the 'AdministratorAccess' managed policy attached. Additionally, the user has an inline policy named 'AllowSSH'. The engineer wants to ensure that the user can only start SSM sessions on instances with the tag 'SSH: enabled'. However, the user can still start sessions on any instance. What is the most likely reason?

Accepted Answer

The inline policy uses 'Allow' instead of 'Deny' for instances without the tag, so it does not restrict access.. The group policy 'AdministratorAccess' grants full access, including ssm:StartSession on all resources. The inline policy's Allow with condition is not restrictive; it only adds an additional Allow path. To restrict, a Deny statement must be used to explicitly block instances without the tag.

Answer

The inline policy does not include 'ec2:DescribeInstances' for the SSM session, so it cannot start sessions.

Answer

The condition 'aws:ResourceTag/SSH' should be 'aws:RequestTag/SSH' to check the request tag.

Answer

The inline policy 'AllowSSH' is not effective because it is overridden by the group policy 'AdministratorAccess'.

Question 8

Refer to the exhibit. After invoking the Lambda function, why are there no log streams in the log group?

Accepted Answer

The Lambda function's execution role lacks permissions to write to CloudWatch Logs.. The Lambda function was invoked but no logs were generated. This can happen if the Lambda function does not have the required permissions to create log streams in CloudWatch Logs. The function's execution role must include the 'logs:CreateLogStream' and 'logs:PutLogEvents' actions.

Answer

The CloudWatch Logs log group retention policy is set to 0 days.

Answer

The Lambda function is not configured with a CloudWatch Logs log group.

Answer

The Lambda function timed out before writing logs.

Question 9

Refer to the exhibit. An IAM policy is attached to a Lambda execution role. Which action will be denied if the Lambda function attempts to write logs to a log group in a different AWS account?

Accepted Answer

logs:PutLogEvents. The policy allows 'logs:PutLogEvents' only for a specific log group ARN in account 123456789012. Writing to a log group in another account would require a different ARN, so the action will be denied by default.

Answer

All actions will be allowed.

Answer

logs:CreateLogStream

Answer

s3:PutObject

Question 10

Refer to the exhibit. A security engineer is investigating a CloudTrail event. Which statement is true about the trail that was created?

Accepted Answer

The trail will log global service events.. The CloudTrail event shows that the trail was created with 'isMultiRegionTrail' set to true, meaning it logs events from all regions. The source IP is 203.0.113.5, which is not necessarily the console IP; the console can be used from any IP. The user agent indicates it was done via the console, not CLI. The trail logs global service events because 'includeGlobalServiceEvents' is true.

Answer

The source IP address is from an AWS service.

Answer

The trail was created using the AWS CLI.

Answer

The trail is a single-region trail.

Question 11

Refer to the exhibit. An AWS Config rule checks that S3 buckets deny HTTP requests. The bucket 'my-bucket' is reported as non-compliant. Which change would make the bucket compliant?

Accepted Answer

Add the bucket ARN to the Resource element in the policy.. The bucket policy denies actions when 'aws:SecureTransport' is false (HTTP). However, the policy only applies to the bucket's objects (arn:aws:s3:::my-bucket/*), not to the bucket itself. To deny HTTP requests to the bucket as well, the resource should include the bucket ARN (arn:aws:s3:::my-bucket). The rule likely checks that both bucket and objects are denied.

Answer

Add a bucket policy that allows only HTTPS requests.

Answer

Change the Effect to Allow.

Answer

Remove the Condition element from the policy.

Question 12

A security engineer wants to capture all DNS queries made by EC2 instances to detect potential data exfiltration. Which AWS service should be used to log the DNS requests?

Accepted Answer

Use Route 53 Resolver DNS Firewall with query logging. Route 53 Resolver DNS Firewall with query logging is the correct choice because it is specifically designed to log all DNS queries made by EC2 instances that use the Route 53 Resolver. This service captures the domain names being queried, the source IP, and the response, enabling detection of DNS-based data exfiltration (e.g., DNS tunneling). It integrates directly with the VPC's DNS resolver, ensuring all outbound DNS traffic from EC2 instances is logged without additional agents.

Answer

Use Amazon GuardDuty

Answer

Enable VPC Flow Logs

Answer

Enable AWS CloudTrail

Question 13

Which TWO AWS services provide native integration with Amazon CloudWatch Logs for real-time monitoring of application logs? (Choose TWO.)

Accepted Answer

Amazon EC2. Amazon EC2 is correct because it can be configured to send application logs to CloudWatch Logs via the CloudWatch Logs agent or unified CloudWatch agent, enabling real-time monitoring, search, and alerting on log data. AWS Lambda is correct because it natively integrates with CloudWatch Logs: every Lambda function execution automatically streams its logs to a CloudWatch Logs group, providing real-time visibility into function output and errors.

Answer

Amazon S3

Answer

Amazon Route 53

Answer

AWS CloudTrail

Question 14

A company runs a multi-account AWS environment using AWS Organizations. The security team needs to implement centralized logging for all AWS CloudTrail events across all accounts. They create a new trail in the management account with the following configuration: trail name 'central-trail', apply to all accounts in the organization, enable data events for all S3 buckets, and store logs in a centralized S3 bucket. After one week, they notice that some accounts are not delivering CloudTrail logs to the central bucket. The security engineer verifies that the trail is still configured to apply to all accounts and that the S3 bucket policy allows cross-account access. What is the MOST likely reason for the missing logs?

Accepted Answer

Some accounts were added to the organization after the trail was created, and the trail was not updated to include them. When a trail is created in the management account with 'apply to all accounts in the organization', it automatically includes all current member accounts. However, if new accounts are added to the AWS Organization after the trail is created, the trail does not automatically extend to those new accounts. The trail must be updated (e.g., via the CloudTrail console or API) to include the newly added accounts, or the organization trail feature must be re-enabled. This is why logs from accounts added after trail creation are missing.

Answer

The member accounts have not enabled CloudTrail Insights

Answer

The S3 bucket policy does not grant the correct permissions to the member accounts

Answer

The trail is not configured as a multi-region trail

Question 15

A company is using AWS Organizations with multiple accounts. The security team needs to centrally monitor all root user API activity across all accounts and receive alerts within minutes. What is the MOST efficient solution?

Accepted Answer

Create an organization trail in CloudTrail that logs all accounts. Use CloudWatch Logs metric filters and alarms to detect root login events.. An organization trail in AWS CloudTrail logs API activity for all accounts in AWS Organizations from a single point, eliminating the need to manage per-account trails. By sending these logs to CloudWatch Logs, you can create metric filters to detect root user login events (e.g., the 'RootLogin' event) and configure CloudWatch Alarms to trigger SNS notifications within minutes, meeting the requirement for centralized monitoring and rapid alerts.

Answer

Enable CloudTrail in each account and aggregate logs to a centralized S3 bucket. Use Athena queries to detect root activity and send alerts via SNS.

Answer

Use AWS Lambda functions in each account to poll CloudTrail logs and send root activity to a central SQS queue.

Answer

Enable AWS Config rules in each account to detect root user activity and send notifications to a central SNS topic.