SCS-C02 Security Logging and Monitoring Practice Test 18 — 15 Questions

Question 1

A company uses AWS Organizations with multiple accounts. The security team wants to centralize the collection of VPC Flow Logs and AWS CloudTrail logs from all accounts into a single Amazon S3 bucket in the management account. The S3 bucket policy must allow cross-account log delivery. Which condition in the bucket policy should be used to restrict log delivery to only the organization's accounts?

Accepted Answer

aws:SourceOrgId. Using the aws:SourceOrgId condition key ensures that only principals from the specified AWS Organization can write to the bucket. Option B is correct. Option A is wrong because aws:SourceAccount would require specifying each account individually, which is not scalable. Option C is wrong because aws:PrincipalOrgID is not a valid condition key. Option D is wrong because aws:SourceArn could be too restrictive if the ARN format is not consistent across services.

Answer

aws:SourceArn

Answer

aws:SourceAccount

Answer

aws:PrincipalOrgID

Question 2

A security engineer is configuring Amazon GuardDuty in a multi-account environment using AWS Organizations. The engineer wants to ensure that all member accounts send findings to the delegated administrator account. However, some member accounts are not sending findings. What is the most likely cause?

Accepted Answer

GuardDuty is not enabled in the member accounts, or they have not accepted the invitation.. GuardDuty must be enabled in each member account, and they must explicitly accept the invitation from the administrator account. Option C is correct. Option A is wrong because GuardDuty does not require VPC Flow Logs to be enabled. Option B is wrong because the service-linked role is automatically created when GuardDuty is enabled. Option D is wrong because CloudTrail is not required for GuardDuty to send findings.

Answer

The GuardDuty service-linked role is missing in the member accounts.

Answer

AWS CloudTrail is not enabled in the member accounts.

Answer

VPC Flow Logs are not enabled in the member accounts.

Question 3

A company wants to receive real-time notifications when specific API calls are made in their AWS account, such as creating a new IAM user. Which AWS service should be used to trigger a notification based on CloudTrail events?

Accepted Answer

Amazon EventBridge. Amazon EventBridge can match patterns on CloudTrail events and invoke targets like SNS for notifications. Option B is correct. Option A is wrong because VPC Flow Logs do not contain API call data. Option C is wrong because AWS Config is for resource configuration tracking, not real-time API notifications. Option D is wrong because Amazon Inspector is for vulnerability assessments.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon VPC Flow Logs

Question 4

A security engineer is investigating a potential security incident involving an EC2 instance. The engineer needs to capture network traffic to and from the instance for analysis. Which method should be used to capture this traffic without installing any software on the instance?

Accepted Answer

Use VPC Traffic Mirroring.. VPC Traffic Mirroring allows capturing network traffic from an EC2 instance without installing agents. Option D is correct. Option A is wrong because the agent must be installed on the instance. Option B is wrong because VPC Flow Logs only capture metadata, not the full packet payload. Option C is wrong because AWS Network Firewall does not capture traffic; it filters it.

Answer

Enable VPC Flow Logs for the subnet.

Answer

Configure AWS Network Firewall in the VPC.

Answer

Install the Amazon CloudWatch agent on the instance.

Question 5

A company uses AWS CloudTrail to log all API activity. The security team wants to ensure that logs are immutable after they are delivered to Amazon S3. Which combination of actions should be taken to meet this requirement? (Choose the best single answer that includes all necessary steps.)

Accepted Answer

Enable S3 Object Lock in governance mode on the bucket.. Enabling S3 Object Lock in governance mode provides immutability for logs against deletion or overwrite. Option A is correct. Option B is wrong because MFA Delete alone does not prevent overwrites. Option C is wrong because bucket policies do not prevent deletion by authorized users. Option D is wrong because enabling versioning alone does not prevent deletion of all versions.

Answer

Enable MFA Delete on the bucket.

Answer

Enable versioning on the bucket.

Answer

Create a bucket policy that denies s3:DeleteObject actions.

Question 6

A security engineer needs to monitor for unauthorized changes to security group rules in an AWS account. Which AWS service can evaluate security group rules against a desired configuration and alert on changes?

Accepted Answer

AWS Config. AWS Config can monitor security group rules and trigger notifications when they change from the desired configuration. Option C is correct. Option A is wrong because CloudTrail logs API calls but does not evaluate configuration against a desired state. Option B is wrong because GuardDuty is for threat detection, not configuration monitoring. Option D is wrong because Security Hub aggregates findings but does not directly monitor security groups.

Answer

AWS Security Hub

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 7

A company uses AWS CloudTrail and wants to ensure that all log files are encrypted at rest using a customer-managed AWS KMS key. The CloudTrail trail is configured to use a KMS key, but some log files appear to be encrypted with the default Amazon S3 managed key (SSE-S3). What is the most likely cause?

Accepted Answer

The KMS key policy does not grant CloudTrail permission to use the key.. CloudTrail uses the KMS key for encrypting log files, but if the KMS key is not accessible due to permission issues, CloudTrail falls back to SSE-S3. Option B is correct. Option A is wrong because CloudTrail supports KMS keys regardless of region. Option C is wrong because the trail configuration does not need to specify SSE-S3; KMS is specified. Option D is wrong because CloudTrail does not use S3 bucket default encryption; it uses the trail's KMS key.

Answer

The CloudTrail trail is configured to use SSE-S3 instead of SSE-KMS.

Answer

The KMS key is in a different AWS region than the S3 bucket.

Answer

The S3 bucket has default encryption set to SSE-S3.

Question 8

An organization wants to detect and alert on the use of root user credentials in their AWS accounts. They have multiple accounts managed via AWS Organizations. What is the most efficient way to centralize this monitoring?

Accepted Answer

Enable Amazon GuardDuty in the management account and use the delegated administrator feature.. Amazon GuardDuty has a built-in finding type for root user activity (RootCredentialUsage). Enabling GuardDuty in the management account and delegating an administrator allows centralized monitoring across all accounts. Option D is correct. Option A is wrong because CloudTrail trails must be created in each account individually, which is less efficient. Option B is wrong because AWS Config rules are per account and require custom logic. Option C is wrong because IAM Access Analyzer does not specifically detect root user activity.

Answer

Create an AWS CloudTrail trail in each account and aggregate logs to a central S3 bucket.

Answer

Use IAM Access Analyzer to find resources shared with external entities.

Answer

Use AWS Config rules to detect root user usage in each account.

Question 9

A security engineer is configuring logging for an application running on Amazon EC2 instances. The engineer needs to capture both operating system-level logs and application logs. Which TWO services can be used together to achieve this? (Choose two.)

Accepted Answer

Amazon CloudWatch Logs. The CloudWatch agent can collect OS and application logs and send them to CloudWatch Logs. Options A and C are correct. Option B is wrong because VPC Flow Logs capture network traffic metadata. Option D is wrong because AWS CloudTrail captures API calls. Option E is wrong because Amazon Inspector is for vulnerability assessment.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

Amazon Inspector

Question 10

A security team wants to detect and alert on suspicious network traffic patterns within their VPC. They need to capture traffic to and from an EC2 instance for analysis. Which THREE services should be used together to achieve this? (Choose three.)

Accepted Answer

Network Load Balancer. VPC Traffic Mirroring captures network traffic, which can be sent to a Network Load Balancer for distribution to security appliances, and then analyzed by Amazon Detective. Options A, B, and D are correct. Option C is wrong because AWS Network Firewall is for filtering, not capture. Option E is wrong because AWS WAF is for web traffic filtering.

Answer

AWS Network Firewall

Answer

AWS WAF

Question 11

A company needs to monitor for unauthorized changes to its Amazon S3 bucket policies. Which TWO services can be used together to achieve this? (Choose two.)

Accepted Answer

AWS Config. AWS Config can track changes to S3 bucket policies and trigger a notification via Amazon SNS. Options A and D are correct. Option B is wrong because CloudTrail logs API calls but does not evaluate configuration changes against a baseline. Option C is wrong because VPC Flow Logs are for network traffic. Option E is wrong because Route 53 is for DNS.

Answer

Amazon Route 53

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Question 12

Refer to the exhibit. A security engineer has created an S3 bucket policy to allow AWS CloudTrail and VPC Flow Logs to deliver logs to the bucket. However, CloudTrail logs are not being delivered, but VPC Flow Logs are delivered successfully. What is the most likely cause?

Accepted Answer

The bucket policy does not grant CloudTrail permission to perform 's3:GetBucketAcl' and 's3:PutBucketAcl'.. The service principal for CloudTrail is `cloudtrail.amazonaws.com`, which is correct, so the issue is likely that the CloudTrail trail's S3 bucket is not configured correctly, or the bucket policy does not include the necessary permissions for CloudTrail to verify the bucket. However, given that VPC Flow Logs work, the issue might be that the CloudTrail trail is not using the correct bucket name or prefix. But the question focuses on the policy; the policy seems correct for both. The most common issue is that CloudTrail requires the bucket to have a specific ACL or the policy to allow `s3:GetBucketAcl` and `s3:PutBucketAcl`. Option D is correct. Option A is wrong because the service principal is correct. Option B is wrong because the condition is fine. Option C is wrong because the principal is correct. Option D addresses a common missing permission.

Answer

The principal is set to a service instead of an AWS account.

Answer

The condition 's3:x-amz-acl' is misspelled.

Answer

The service principal in the policy is incorrect for CloudTrail.

Question 13

Refer to the exhibit. A security engineer is configuring the Amazon CloudWatch agent to collect logs from an Amazon ECS task. The configuration shown is used. However, the logs are not appearing in CloudWatch Logs. What is the most likely cause?

Accepted Answer

The configuration file is missing the 'logs' section at the top level.. The configuration uses `log_group_name` but in the CloudWatch agent configuration for ECS, the correct key is `log_group_name` (lowercase) but more commonly the issue is that the agent requires `logs.region` and `logs.endpoint` to be set, or the IAM role is missing permissions. However, the exhibit uses `log_group_name` which is correct for the standalone agent, but for the ECS agent, the configuration is passed as environment variables or in the task definition. The most typical mistake is that the `log_group_name` is not properly nested under `logs`. Option C is correct. Option A is wrong because the ECS agent can use CloudWatch agent. Option B is wrong because the format is standard. Option D is wrong because the pattern is optional.

Answer

The multi_line_start_pattern is missing a closing delimiter.

Answer

The datetime_format is incorrect for the logs.

Answer

The CloudWatch agent is not installed in the ECS task.

Question 14

Refer to the exhibit. A security engineer uses the AWS CLI command shown to investigate a console login event. What type of user performed the login?

Accepted Answer

IAM user. The `userIdentity` in the CloudTrail event shows `type: IAMUser`, indicating an IAM user logged in. Option B is correct. Option A is wrong because the type is IAMUser, not Root. Option C is wrong because the type is not AssumedRole. Option D is wrong because it is not an AWS service.

Answer

AWS service

Answer

Assumed role

Answer

Root user

Question 15

A security engineer is troubleshooting why CloudTrail is not delivering logs to an S3 bucket. The bucket policy allows CloudTrail to write objects, and the trail is configured with the correct bucket name. However, no log files appear. What is the most likely cause?

Accepted Answer

The S3 bucket uses AWS KMS server-side encryption (SSE-KMS) and the KMS key policy does not grant CloudTrail permission to use the key.. CloudTrail requires specific permissions to write to S3, including s3:PutObject and s3:GetBucketAcl. If the KMS key policy does not allow CloudTrail to use it, log delivery fails silently.

Answer

The S3 bucket has an S3 Object Lock configuration that prevents writes.

Answer

The S3 bucket is in a different AWS Region from the trail.

Answer

CloudTrail is not enabled in the AWS Region where the S3 bucket resides.