SCS-C02 Security Logging and Monitoring Practice Test 17 — 15 Questions

Question 1

A security engineer is investigating a potential compromise. They notice that an IAM user 'svc-backup' has been making unusual API calls from an IP address outside the company's VPC. The engineer wants to ensure all future API calls from this user are logged with full event details. However, the current CloudTrail trail is set to log only management events. What should the engineer do to capture the required details?

Accepted Answer

Update the existing trail to log data events for IAM.. Option B is correct because the trail needs to log data events for IAM to capture calls like GetUser, ListAccessKeys, etc. Option A is wrong because it logs management events (control plane), not data events. Option C is wrong because it only captures S3 data events. Option D is wrong because CloudTrail does not support VPC Flow Logs integration.

Answer

Enable VPC Flow Logs and correlate with CloudTrail logs.

Answer

Create a new trail that logs data events for S3 and configure it to deliver to a separate S3 bucket.

Answer

Enable CloudTrail Insights to detect unusual activity for the user.

Question 2

A company wants to centralize security logs from multiple AWS accounts into a single S3 bucket. The logging accounts (e.g., security, production) each have their own CloudTrail trails. Which configuration is required to allow cross-account log delivery?

Accepted Answer

Create an S3 bucket policy in the destination account that allows the CloudTrail service principal to write objects.. Option A is correct because CloudTrail can deliver logs to an S3 bucket in another account by using a bucket policy that grants CloudTrail's service principal write access. Option B is wrong because KMS keys are for encryption, not cross-account access. Option C is wrong because S3 ACLs are not recommended for cross-account; bucket policy is used. Option D is wrong because IAM roles are used for other services but CloudTrail uses bucket policies.

Answer

Create an IAM role in the destination account with write permissions and allow CloudTrail in source accounts to assume that role.

Answer

Use a customer-managed KMS key in the destination account and share it with the source accounts.

Answer

Configure S3 bucket ACLs to grant write access to the source account IDs.

Question 3

A security engineer is troubleshooting why Amazon GuardDuty is not generating findings for suspicious S3 API calls made by an IAM role. The engineer has verified that GuardDuty is enabled in the account and region. What is a likely reason for the missing findings?

Accepted Answer

CloudTrail management events are not being logged for the IAM role.. Option C is correct because GuardDuty requires CloudTrail management events to be logged; if the trail is not logging management events for the role's API calls, GuardDuty cannot analyze them. Option A is wrong because GuardDuty can analyze S3 data events if enabled. Option B is wrong because Delegated Admin is for multi-account management, not single account. Option D is wrong because VPC Flow Logs are not used for S3 API calls.

Answer

VPC Flow Logs are not enabled for the VPC where the role is used.

Answer

The account is not a Delegated Admin for GuardDuty.

Answer

S3 data events are not enabled in CloudTrail.

Question 4

A company uses AWS Organizations and wants to enable Amazon GuardDuty across all member accounts. The security team wants to centrally manage findings and automate responses. What is the MOST efficient way to achieve this?

Accepted Answer

Designate a Delegated Administrator account for GuardDuty in AWS Organizations and enable GuardDuty for all accounts from that account.. Option B is correct because GuardDuty supports multi-account management via a Delegated Administrator, which can enable GuardDuty in all accounts and aggregate findings. Option A is wrong because it requires manual steps. Option C is wrong because Security Hub aggregates findings but does not enable GuardDuty. Option D is wrong because CloudFormation StackSets can deploy but are less efficient for enabling a service across many accounts.

Answer

Use AWS CloudFormation StackSets to deploy a GuardDuty detector in each account.

Answer

Enable AWS Security Hub in the management account and configure it to ingest GuardDuty findings from member accounts.

Answer

Enable GuardDuty in each member account individually and configure cross-account access to a central S3 bucket.

Question 5

A company is using Amazon CloudWatch Logs to store application logs. The security team needs to ensure that logs are encrypted at rest using a customer-managed KMS key (CMK). What configuration is required?

Accepted Answer

Associate the CMK with the CloudWatch Logs log group by specifying the key ARN in the log group's encryption configuration.. Option B is correct because CloudWatch Logs uses the KMS key specified in the log group's encryption setting. Option A is wrong because CloudWatch Logs does not support KMS key via bucket policy. Option C is wrong because S3 encryption policies are for S3 buckets, not CloudWatch Logs. Option D is wrong because KMS key policies grant permissions, but the log group must be associated with the key.

Answer

Add a KMS key policy that allows CloudWatch Logs to use the key.

Answer

Enable default encryption on the S3 bucket used for log export with a CMK.

Answer

Configure the S3 bucket policy to require SSE-KMS for log delivery.

Question 6

A company has a CloudTrail trail that logs management events and delivers them to an S3 bucket. The security team notices that some expected API calls are missing from the logs. They suspect that the calls were made by a service that is not tracked by CloudTrail. Which AWS service is NOT tracked by CloudTrail?

Accepted Answer

Amazon CloudFront. Option D is correct because Amazon CloudFront does not log management events via CloudTrail; it uses its own access logs. Option A, B, and C are all tracked by CloudTrail.

Answer

AWS Lambda

Answer

Amazon S3

Answer

Amazon EC2

Question 7

A security engineer is configuring Amazon Inspector to assess EC2 instances for software vulnerabilities. The engineer has installed the SSM Agent on all instances and ensured that the instances have internet access. However, Amazon Inspector shows the instances as 'Unmanaged'. What is the MOST likely cause?

Accepted Answer

The SSM Agent is not running or is not registered with AWS Systems Manager.. Option B is correct because Amazon Inspector requires the SSM Agent to communicate with the SSM service; if the agent is not running or not registered, the instance cannot be managed. Option A is wrong because IAM permissions for the agent are not the issue; the agent communicates via SSM. Option C is wrong because security groups control network traffic but not agent registration. Option D is wrong because instance metadata service is not required for Inspector.

Answer

The IAM role attached to the EC2 instance does not have permissions to publish metrics to CloudWatch.

Answer

The security group attached to the instance blocks outbound traffic to the Amazon Inspector service.

Answer

The instance does not have the EC2 instance metadata service enabled.

Question 8

A company uses AWS CloudTrail to log management events. The security team wants to be alerted when an IAM user creates a new access key. Which solution would meet this requirement with the least operational overhead?

Accepted Answer

Create an Amazon EventBridge rule that matches the CreateAccessKey event and triggers an Amazon SNS notification.. Option A is correct because CloudTrail events can be sent to CloudWatch Logs, and a metric filter with an alarm can detect the CreateAccessKey event. Option B is wrong because it requires custom code and is more overhead. Option C is wrong because EventBridge rules can directly match CloudTrail events without CloudWatch Logs. Option D is wrong because Lambda is more overhead than a simple alarm.

Answer

Create a CloudWatch Logs metric filter on the CloudTrail log group for CreateAccessKey events and set an alarm.

Answer

Write a Python script that uses the CloudTrail LookupEvents API and run it on a scheduled basis using Amazon EventBridge Scheduler.

Answer

Develop a custom AWS Lambda function that queries CloudTrail logs in S3 every hour.

Question 9

A security engineer needs to ensure that all API calls in an AWS account are logged for auditing purposes. Which TWO services should the engineer enable? (Select TWO.)

Accepted Answer

AWS CloudTrail. Option A and Option D are correct. CloudTrail logs API activity, and AWS Config records resource configuration changes for auditing. Option B is wrong because VPC Flow Logs capture network traffic, not API calls. Option C is wrong because CloudWatch Logs stores log data but does not log API calls by itself. Option E is wrong because GuardDuty is a threat detection service, not a logging service.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Question 10

A company wants to detect and respond to potential security threats in near real-time. Which THREE AWS services should the company use together? (Select THREE.)

Accepted Answer

AWS Security Hub. Options A, B, and D are correct. Amazon GuardDuty identifies threats, AWS Security Hub aggregates findings, and Amazon Detective investigates them. Option C is wrong because AWS CloudTrail is a logging service, not a detection or response service. Option E is wrong because Amazon Inspector is for vulnerability assessment, not general threat detection.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 11

A security engineer is investigating a potential data breach. The engineer wants to analyze historical API calls made by a specific IAM user. Which TWO AWS services can be used together to achieve this? (Select TWO.)

Accepted Answer

AWS CloudTrail. Options A and D are correct. CloudTrail logs API calls and can deliver them to CloudWatch Logs for querying. Option B is wrong because VPC Flow Logs capture network traffic, not API calls. Option C is wrong because CloudWatch Logs Insights can query logs but needs CloudTrail as the source. Option E is wrong because S3 Server Access Logs are for S3 access only, not all API calls.

Answer

S3 Server Access Logs

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs Insights

Question 12

A security engineer has attached the above IAM policy to a role used by an application to write logs to an S3 bucket. However, the application is unable to write logs. What is the MOST likely reason?

Accepted Answer

The application does not set the x-amz-acl header to bucket-owner-full-control on PutObject requests.. Option A is correct because the policy requires the condition s3:x-amz-acl to be set to bucket-owner-full-control, but the application may not be setting that ACL. Option B is wrong because the resource ARN is correct for the specified path. Option C is wrong because the Effect is Allow. Option D is wrong because the policy does not mention encryption.

Answer

The Effect is set to Allow, which is too permissive.

Answer

The policy does not allow server-side encryption.

Answer

The resource ARN is incorrect; it should be arn:aws:s3:::my-log-bucket/*.

Question 13

A security engineer needs to ensure that all S3 object-level API calls (e.g., GetObject, PutObject) on the bucket 'my-bucket' are logged. The current CloudTrail configuration is as shown in the exhibit. What change should the engineer make?

Accepted Answer

Change the data resource value to 'arn:aws:s3:::my-bucket/' to cover all objects.. Option B is correct because the current data resource only specifies the prefix 'logs/', not the entire bucket. To log all object-level events for the bucket, the value should be 'arn:aws:s3:::my-bucket/'. Option A is wrong because the bucket itself is not the issue; the prefix is. Option C is wrong because the trail already includes management events. Option D is wrong because the trail already has a data resource for S3.

Answer

Remove the DataResources section and add an AdvancedEventSelector for S3.

Answer

Change the bucket ARN to 'arn:aws:s3:::my-bucket' without a trailing slash.

Answer

Enable management events by setting IncludeManagementEvents to true.

Question 14

A security engineer is configuring a multi-account CloudTrail setup. The above bucket policy is attached to the central logging bucket. Despite the policy, CloudTrail in the member account (123456789012) cannot deliver logs. What is the MOST likely issue?

Accepted Answer

The condition s3:x-amz-acl is not required; CloudTrail does not set that ACL.. Option B is correct because the resource path includes the account ID, but the condition requires the ACL to be set to bucket-owner-full-control, which CloudTrail does not set by default. Option A is wrong because the principal is correct. Option C is wrong because the bucket policy does not need to specify the source account explicitly; the path includes it. Option D is wrong because the action is correct.

Answer

The Principal should be the CloudTrail service principal of the member account.

Answer

The Action should be s3:PutObjectAcl instead of s3:PutObject.

Answer

The resource ARN must include the source account ID in the path.

Question 15

A security engineer notices that an Amazon S3 bucket has been accessed from an IP address outside the company's allowed range. The engineer needs to identify the IAM user who made the request. Which AWS service should be used to find this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls made to AWS services, including the identity of the caller. Option B is correct. Option A is wrong because VPC Flow Logs capture network traffic metadata but do not include IAM user details. Option C is wrong because CloudWatch Logs can store logs but do not directly capture API caller identity. Option D is wrong because S3 server access logs contain requester information but are not as comprehensive as CloudTrail for IAM user identification.

Answer

S3 server access logs

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs