SCS-C02 Security Logging and Monitoring Practice Test 17 — 15 Questions

Question 1

A company wants to centrally collect and analyze logs from multiple AWS accounts. Which AWS service should be used to aggregate logs from various sources for monitoring and alerting?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the correct service because it provides a centralized platform for collecting, monitoring, and analyzing log data from multiple AWS accounts and on-premises sources. It supports cross-account log aggregation via subscription filters and cross-account destinations, enabling real-time monitoring and alerting through CloudWatch Logs Insights and metric filters. This makes it the appropriate choice for the stated requirement of central log aggregation for monitoring and alerting.

Answer

Amazon S3

Answer

AWS Config

Answer

AWS CloudTrail

Question 2

A security team needs to monitor for failed login attempts to an EC2 instance running Linux. The team wants to send a real-time alert when more than 10 failed SSH attempts occur within 5 minutes. Which solution is the most efficient?

Accepted Answer

Install the CloudWatch Logs agent on the EC2 instance to stream /var/log/secure to CloudWatch Logs. Create a metric filter for 'Failed password' and set a CloudWatch alarm.. The CloudWatch Logs agent can stream /var/log/secure (which logs SSH authentication events) to CloudWatch Logs. A metric filter on the 'Failed password' pattern counts failed SSH attempts, and a CloudWatch alarm with a threshold of 10 within a 5-minute period triggers a real-time alert. This is the most efficient solution as it directly monitors the specific log source for SSH failures without additional overhead.

Answer

Enable VPC Flow Logs and filter for SSH traffic to detect failed attempts.

Answer

Configure the EC2 instance to write failed attempts to a file in S3 and use S3 events to trigger a Lambda function for alerting.

Answer

Enable Amazon GuardDuty and create a custom threat list for failed SSH attempts.

Question 3

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that all accounts have CloudTrail enabled and that logs are delivered to a centralized S3 bucket in the management account. Which solution meets these requirements?

Accepted Answer

Use AWS CloudTrail with Organizations to create an organization trail that logs all accounts to the central bucket.. AWS CloudTrail supports integration with AWS Organizations, allowing you to create an organization trail that automatically logs events for all accounts in the organization. This trail delivers log files to a single centralized S3 bucket in the management account without requiring per-account configuration, ensuring compliance with the security team's requirement.

Answer

Write a script that runs in each account using AWS Lambda to enable CloudTrail and point to the central bucket.

Answer

Use AWS Config rules in each account to check CloudTrail status and remediate via Lambda.

Answer

Create an IAM role that each account assumes to enable CloudTrail and log to the central bucket.

Question 4

A security analyst needs to receive an alert when an IAM user attempts to perform an action they are not authorized to perform. Which AWS service can be used to monitor and alert on such authorization failures?

Accepted Answer

AWS CloudTrail with CloudWatch metric filter and alarm. AWS CloudTrail logs all API calls made by IAM users, including authorization failures (e.g., AccessDenied errors). By creating a CloudWatch metric filter on CloudTrail logs for specific error codes like 'AccessDenied' or 'UnauthorizedOperation', you can trigger a CloudWatch alarm to send notifications via SNS. This is the standard AWS approach for monitoring and alerting on unauthorized actions.

Answer

AWS Organizations SCPs

Answer

AWS IAM Access Analyzer

Answer

AWS Config

Question 5

A company has a requirement to retain CloudTrail logs for 7 years for compliance. The logs are stored in an S3 bucket. The security team needs to ensure that logs are not deleted before the retention period ends, even by users with full S3 permissions. Which action should be taken?

Accepted Answer

Enable S3 Object Lock in Compliance mode on the bucket with a retention period of 7 years.. S3 Object Lock in Compliance mode prevents any user, including the root user, from overwriting or deleting objects until the retention period expires. This meets the requirement to retain CloudTrail logs for 7 years, even against users with full S3 permissions, because Compliance mode cannot be bypassed or removed by any user.

Answer

Enable MFA Delete on the bucket and require MFA for all delete operations.

Answer

Enable S3 Versioning and set a lifecycle policy to expire noncurrent versions after 7 years.

Answer

Create a bucket policy that denies s3:DeleteObject for all users.

Question 6

A security team wants to detect and alert on potential security threats such as compromised instances or malicious activity within their AWS environment. Which TWO AWS services should be used together to provide comprehensive threat detection?

Accepted Answer

AWS Security Hub. Amazon GuardDuty (E) is correct because it is the AWS managed threat detection service that continuously monitors VPC Flow Logs, DNS logs, and CloudTrail management/event logs using machine learning and threat intelligence feeds to identify compromised instances, reconnaissance, and malicious activity. AWS Security Hub (A) is correct because it aggregates and prioritizes findings from GuardDuty and other services into a single dashboard, enabling centralized alerting and automated response workflows for comprehensive threat visibility. Together, GuardDuty provides the detection engine while Security Hub provides aggregation and alerting. AWS CloudTrail (B) only records API activity for auditing and does not itself detect or alert on threats. Amazon Inspector (C) is a vulnerability management service that scans EC2 instances and container images for software vulnerabilities and unintended network exposure, not runtime threat detection. AWS Config (D) evaluates resource configuration compliance against rules and does not perform threat detection or alerting on malicious behavior.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Config

Question 7

A security engineer is designing a logging strategy for a multi-account environment. The engineer needs to ensure that all API activity across accounts is logged and that logs are immutable and centrally accessible. Which THREE actions should the engineer take?

Accepted Answer

Create an AWS CloudTrail organization trail that logs to a central S3 bucket.. AWS CloudTrail organization trails automatically aggregate API activity from all member accounts in an AWS Organizations setup, delivering log files to a single, centrally managed S3 bucket. This eliminates the need to configure individual trails per account, ensuring comprehensive and centralized logging of all API calls across the multi-account environment.

Answer

Stream logs to CloudWatch Logs for real-time monitoring.

Answer

Enable VPC Flow Logs in all accounts and send to the central bucket.

Question 8

A company wants to monitor for unauthorized changes to security group rules in their VPC. Which TWO AWS services can be used together to detect and alert on such changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it records API calls made to the EC2 service, including AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress, and CreateSecurityGroup. By monitoring CloudTrail events for these specific API actions, you can detect unauthorized changes to security group rules. AWS Config is correct because it provides a managed rule called 'restricted-common-ports' or custom rules that can evaluate security group configurations against desired policies, and it can trigger alerts via Amazon SNS when a security group rule is changed.

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Answer

Amazon Macie

Question 9

Refer to the exhibit. A security engineer finds this CloudTrail log entry. What is the most significant security concern indicated by this event?

Accepted Answer

The security group rule allows SSH access from any IP address (0.0.0.0/0).. The CloudTrail log entry shows an `AuthorizeSecurityGroupIngress` API call that adds a rule allowing SSH (port 22) from 0.0.0.0/0. This is a critical security concern because it exposes the EC2 instance to SSH access from any IP address on the internet, creating a high risk of brute-force attacks, unauthorized access, and potential compromise. Security best practices mandate restricting SSH access to specific trusted IP ranges, not the entire internet.

Answer

The event is a normal administrative action and poses no security concern.

Answer

The user did not have MFA enabled when assuming the AdminRole.

Answer

The source IP address (203.0.113.5) is from an unusual location.

Question 10

Refer to the exhibit. A security engineer has attached this IAM policy to a user. What is the effect of this policy?

Accepted Answer

Allows uploads with KMS encryption or without encryption.. The IAM policy uses a `Deny` effect with a `NotPrincipal` condition that denies uploads unless the request includes the `s3:x-amz-server-side-encryption` header with value `aws:kms`. However, the `Condition` block uses `StringNotEquals`, which means any request that does NOT have the encryption header set to `aws:kms` is denied. This effectively allows uploads with KMS encryption (header matches) or without encryption (no header present, because `StringNotEquals` does not match a missing header — the condition evaluates to false, so the Deny does not apply). Therefore, uploads without encryption are allowed by default (since there is no explicit Allow), and uploads with KMS encryption are also allowed.

Answer

Allows uploads only when encryption is not specified.

Answer

Denies uploads when encryption is not provided.

Answer

Allows uploads only when using KMS encryption.

Question 11

Refer to the exhibit. A security engineer runs this CloudWatch Logs Insights query on a log group. What is the purpose of this query?

Accepted Answer

Retrieve the 20 most recent log events that contain 'ERROR' or 'WARN'.. The CloudWatch Logs Insights query uses `filter @message like /(?i)(ERROR|WARN)/` to match log events containing either 'ERROR' or 'WARN' (case-insensitive), then `sort @timestamp desc` orders them by most recent first, and `limit 20` restricts the output to the top 20 results. This retrieves the 20 most recent log events that contain either term, making option B correct.

Answer

Retrieve the 20 most recent log events that contain only 'ERROR'.

Answer

Display all log events grouped by log level.

Answer

Count the number of ERROR and WARN events in the last hour.

Question 12

A DevOps engineer needs to monitor failed SSH login attempts to Amazon EC2 instances. Which AWS service should the engineer use to collect and analyze the login events?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the correct service because it can ingest, monitor, and analyze log data from EC2 instances, including SSH authentication logs (e.g., /var/log/secure or /var/log/auth.log). By installing the CloudWatch Logs agent on the EC2 instance, the engineer can stream these log events to CloudWatch Logs, where they can be searched, visualized, and used to trigger alarms on failed SSH attempts. AWS Config tracks resource configuration changes, not OS-level login events; CloudTrail records AWS API calls, not guest OS logs; and VPC Flow Logs capture network traffic metadata, not application or authentication logs.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Question 13

A security team has enabled AWS CloudTrail in all regions and is delivering logs to an S3 bucket. The team has also enabled S3 server access logging for the CloudTrail bucket. The team needs to detect any unauthorized access to the CloudTrail logs. Which combination of services should the team use to achieve near-real-time detection?

Accepted Answer

Amazon GuardDuty and Amazon CloudWatch Events. Amazon GuardDuty continuously monitors S3 data plane events, including CloudTrail log delivery and S3 server access logs, to detect suspicious API calls or unauthorized access patterns. Amazon CloudWatch Events (now part of Amazon EventBridge) can trigger near-real-time alerts when GuardDuty generates findings, enabling immediate response. This combination provides the required near-real-time detection without relying on batch analysis or configuration rules.

Answer

AWS CloudTrail Insights and Amazon CloudWatch

Answer

Amazon Athena and Amazon QuickSight

Answer

AWS Config and Amazon SNS

Question 14

A company uses Amazon Route 53 for DNS and wants to log all DNS queries made from its VPC. The logs must be stored in Amazon S3 for compliance purposes. Which solution meets these requirements?

Accepted Answer

Enable Route 53 Resolver query logging and publish to an S3 bucket.. Route 53 Resolver query logging is the native AWS feature designed to capture DNS queries that originate from resources within a VPC. By enabling this feature and specifying an S3 bucket as the destination, you can log all DNS queries made by EC2 instances, Lambda functions, and other VPC resources without needing any additional agents or configuration. This directly meets the requirement for storing DNS query logs in S3 for compliance.

Answer

Install a CloudWatch Logs agent on each EC2 instance and configure it to send DNS logs to CloudWatch Logs.

Answer

Enable AWS CloudTrail for DNS API calls and deliver to an S3 bucket.

Answer

Enable VPC Flow Logs and publish to an S3 bucket.

Question 15

A security engineer needs to monitor AWS account activity for suspicious API calls and receive alerts. Which AWS service should the engineer use to meet this requirement?

Accepted Answer

AWS CloudTrail with CloudWatch Alarms. AWS CloudTrail records all API calls made to the AWS environment, providing a detailed audit trail of account activity. By sending these logs to Amazon CloudWatch, you can create metric filters that match suspicious API call patterns and trigger CloudWatch Alarms to send notifications via SNS. This combination directly meets the requirement to monitor and alert on specific API calls.

Answer

VPC Flow Logs

Answer

AWS Config with AWS Config Rules

Answer

Amazon GuardDuty