SCS-C02 Security Logging and Monitoring Practice Test 18 — 15 Questions

Question 1

A company wants to ensure that all API calls in their AWS account are logged and immutable. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Enable S3 Object Lock on the CloudTrail S3 bucket. Enabling S3 Object Lock on the CloudTrail S3 bucket ensures that log files are immutable and cannot be overwritten or deleted by any user, including root. This is achieved through a write-once-read-many (WORM) model, which is essential for maintaining a tamper-proof audit trail of all API calls.

Answer

Enable MFA delete on the S3 bucket

Answer

Use AWS Config rules to monitor CloudTrail configuration

Answer

Encrypt the S3 bucket with AWS KMS

Question 2

Refer to the exhibit. A security engineer created this S3 bucket policy to allow CloudTrail to deliver logs. However, log delivery is failing. What is the most likely cause?

Accepted Answer

The bucket policy does not allow s3:GetBucketAcl. CloudTrail requires the S3 bucket policy to grant the `s3:GetBucketAcl` permission to the CloudTrail service principal (`cloudtrail.amazonaws.com`) so that it can verify the bucket's ACL before delivering logs. Without this permission, CloudTrail cannot confirm it has write access, causing log delivery to fail. The missing `s3:GetBucketAcl` action is the most likely cause because the policy must explicitly allow both `s3:PutObject` and `s3:GetBucketAcl` for the service to function.

Answer

The bucket is not in the same region as the trail

Answer

The bucket policy does not specify a condition

Answer

The bucket is encrypted with SSE-KMS

Question 3

A security engineer is designing a monitoring solution for an AWS Lambda function that processes sensitive data. The function occasionally fails due to timeouts. The engineer needs to be alerted immediately when the function fails and also wants to analyze the error logs. Which combination of services should the engineer use?

Accepted Answer

Amazon CloudWatch Logs and CloudWatch Alarms with Amazon SNS. Amazon CloudWatch Logs captures the Lambda function's execution logs, including timeout errors, and CloudWatch Alarms can monitor specific metrics like `Errors` or `Throttles` for the function. When the alarm state is triggered (e.g., `ALARM`), it publishes a notification to an Amazon SNS topic, which can send immediate alerts via email, SMS, or other endpoints. This combination provides both real-time alerting and log analysis for troubleshooting.

Answer

Amazon CloudWatch Logs and Amazon Kinesis Data Firehose

Answer

AWS CloudTrail and Amazon SNS

Answer

AWS Config and Amazon SNS

Question 4

A company has a multi-account AWS environment using AWS Organizations. The security team wants to centralize all CloudTrail logs from all accounts into a single S3 bucket in the management account. The bucket policy allows cross-account access. However, logs from member accounts are not being delivered. What is the most likely cause?

Accepted Answer

The S3 bucket policy does not grant `s3:PutObject` permission to the member accounts.. The S3 bucket policy must explicitly grant the `s3:PutObject` permission to the IAM roles or users from the member accounts that CloudTrail uses to deliver logs. Without this permission, CloudTrail in the member accounts cannot write log files to the central bucket, even if the bucket is configured for cross-account access. The bucket policy must also include a condition that the object ownership is set to the bucket owner (via `s3:x-amz-acl: bucket-owner-full-control`) to ensure the management account retains control.

Answer

CloudTrail cannot deliver logs to a bucket in a different account.

Answer

The S3 bucket is not configured with a CloudTrail prefix.

Answer

CloudTrail is not enabled in the member accounts.

Question 5

Which TWO actions should a security engineer take to ensure that Amazon GuardDuty can effectively monitor for suspicious activity in a VPC? (Choose two.)

Accepted Answer

Enable DNS query logging and publish to CloudWatch Logs.. Amazon GuardDuty relies on DNS query logs to detect suspicious domain name resolution patterns, such as DNS tunneling or communication with known malicious domains. By enabling DNS query logging and publishing to CloudWatch Logs, GuardDuty can ingest this data as a source for its threat detection algorithms. Without DNS logs, GuardDuty cannot analyze DNS-based attack vectors within the VPC.

Answer

Enable CloudTrail data events for S3.

Answer

Enable S3 server access logs.

Answer

Enable AWS Config configuration history.

Question 6

A company uses AWS CloudTrail to log all API calls. The security team needs to be alerted when an IAM user creates a new access key. Which approach is most efficient?

Accepted Answer

Create a CloudWatch Events rule that matches the CreateAccessKey event and targets an SNS topic.. CloudWatch Events (now part of Amazon EventBridge) can directly match the CreateAccessKey API call from AWS CloudTrail in real time and trigger an SNS notification. This approach is the most efficient as it requires no polling, no additional infrastructure, and provides immediate alerting with minimal latency.

Answer

Enable AWS Config managed rule to detect access key creation and trigger an SNS notification.

Answer

Use CloudWatch Logs Insights to run a query every minute on CloudTrail logs and send results to SNS.

Answer

Configure CloudTrail to send logs to an S3 bucket and enable S3 event notifications to an SNS topic.

Question 7

A security engineer needs to centralize logs from multiple AWS accounts into a single S3 bucket. Which solution is most secure?

Accepted Answer

Configure each account's CloudTrail to deliver to a centralized S3 bucket in a logging account, with a bucket policy allowing CloudTrail from source accounts.. It uses a centralized S3 bucket in a dedicated logging account with a bucket policy that explicitly grants CloudTrail from source accounts the s3:PutObject permission. This ensures logs are written directly to a single location without intermediate replication or cross-account delivery that could introduce latency or complexity. The bucket policy can restrict access to only CloudTrail service principals and specific source account ARNs, maintaining a secure, auditable log trail.

Answer

Deliver logs to separate buckets per account and use S3 replication to copy them to a central bucket.

Answer

Use a single S3 bucket in the management account and have each account write logs directly without additional permissions.

Answer

Stream logs to Amazon Kinesis Data Firehose in each account and consolidate into a single S3 bucket via cross-account delivery.

Question 8

A company is using Amazon GuardDuty to detect threats. The security team notices that GuardDuty findings are not triggering the intended automated response via a CloudWatch Events rule. What is the most likely reason?

Accepted Answer

The CloudWatch Events rule's event pattern does not match the GuardDuty finding event structure.. GuardDuty findings are sent to CloudWatch Events as events with a specific structure, including fields like 'detail-type' set to 'GuardDuty Finding' and 'source' set to 'aws.guardduty'. If the CloudWatch Events rule's event pattern does not match this exact structure—for example, if it filters on the wrong 'source' or 'detail-type'—the rule will not trigger the intended automated response. This is the most common reason for the described failure.

Answer

The GuardDuty detector is in a different region than the CloudWatch Events rule.

Answer

The Lambda function invoked by CloudWatch Events does not have an IAM role assigned.

Answer

VPC Flow Logs are not enabled.

Question 9

A security analyst needs to review all failed SSH login attempts to an EC2 instance. Which combination will provide this information?

Accepted Answer

Install the CloudWatch agent on the EC2 instance to collect /var/log/secure and stream to CloudWatch Logs.. The CloudWatch agent installed on the EC2 instance can collect OS-level logs such as /var/log/secure (on Linux), which contains detailed records of SSH authentication attempts, including failed logins. By streaming these logs to CloudWatch Logs, the analyst can query and review all failed SSH login attempts at the application layer. Options A, C, and D capture network-level metadata but do not provide information about authentication failures after a successful TCP connection.

Answer

Use AWS Config to record EC2 instance configuration and check for security group changes.

Answer

Enable AWS CloudTrail and search for EC2-related events.

Answer

Enable VPC Flow Logs for the subnet and query the logs in CloudWatch Logs Insights for rejected traffic on port 22.

Question 10

A company has enabled AWS CloudTrail in all accounts and regions, with log file validation enabled. The security team needs to verify that a specific log file has not been modified since it was delivered. Which action should be taken?

Accepted Answer

Use the AWS CLI `validate-logs` command with the digest file from the S3 bucket.. CloudTrail log file validation creates a hash of each log file and stores it in a digest file. To verify that a specific log file has not been altered since delivery, you must use the AWS CLI `validate-logs` command, which compares the hash in the digest file against the current hash of the log file. This command also validates the digital signature of the digest file itself, ensuring end-to-end integrity.

Answer

Query the log files using Amazon CloudWatch Logs Insights.

Answer

Enable S3 server-side encryption with AWS KMS (SSE-KMS) on the CloudTrail bucket.

Answer

Enable S3 Object Lock on the bucket to prevent modifications.

Question 11

A security engineer notices that an S3 bucket containing sensitive logs is publicly accessible. Which service should be used to automatically remediate this by applying a bucket policy?

Accepted Answer

AWS Config. AWS Config is the correct service because it can continuously monitor S3 bucket configurations and automatically remediate non-compliant resources using AWS Config Rules and AWS Systems Manager Automation documents. When a rule detects that an S3 bucket is publicly accessible, it can trigger an automatic remediation action, such as applying a bucket policy that denies all public access, without manual intervention.

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 12

An organization wants to detect and alert on any IAM user that creates a new access key without using multi-factor authentication (MFA). What is the MOST efficient way to achieve this?

Accepted Answer

Create a CloudWatch Events rule that triggers on CreateAccessKey events, and check if the user's MFA status is inactive.. CloudWatch Events (now Amazon EventBridge) can capture the CreateAccessKey API call in real time, and a Lambda target can check the IAM user's MFA status via the GetLoginProfile or ListMFADevices API. This provides immediate detection and alerting without polling or log analysis, making it the most efficient approach for this specific requirement.

Answer

Analyze S3 server access logs to detect access key creation.

Answer

Enable AWS Config managed rule for IAM user MFA, which monitors if users have MFA enabled.

Answer

Use IAM Access Analyzer to monitor for unused access keys.

Question 13

Refer to the exhibit. A security engineer ran this AWS CLI command to find when a specific CreateKeyPair API call was made. The command returns no results, even though the engineer knows the call was made. What is the MOST likely reason?

Accepted Answer

The --lookup-attributes parameter has incorrect syntax.. The `--lookup-attributes` parameter requires a JSON structure with an `AttributeKey` and `AttributeValue`. The provided syntax `--lookup-attributes EventName=CreateKeyPair` is invalid; the correct format is `--lookup-attributes AttributeKey=EventName,AttributeValue=CreateKeyPair`. This malformed parameter causes the AWS CLI to fail silently or return no results, even though the API call exists.

Answer

The time range is too narrow.

Answer

The command did not specify a region, so it defaults to us-east-1, but the call was made in a different region.

Answer

The event name should be 'CreateKeypair' (lowercase p).

Question 14

A company wants to centrally collect CloudTrail logs from multiple AWS accounts and enable real-time analysis. Which combination of services should be used?

Accepted Answer

CloudTrail, Amazon S3, S3 Event Notifications, and AWS Lambda.. It enables centralized collection of CloudTrail logs from multiple accounts by delivering logs to a central S3 bucket, then using S3 Event Notifications to trigger a Lambda function for real-time analysis. This pattern allows near-instant processing of log events as they arrive, meeting the requirement for real-time analysis without polling or batching delays.

Answer

CloudTrail, Amazon Kinesis Data Firehose, and Amazon Athena.

Answer

CloudTrail, Amazon CloudWatch Logs, and cross-account log subscription.

Answer

CloudTrail, Amazon S3, and Amazon Simple Queue Service (SQS).

Question 15

A company has a requirement to retain CloudTrail logs for 7 years to meet regulatory compliance. They want to minimize storage costs while ensuring logs are immutable and cannot be deleted by anyone, including the root user. What should they do?

Accepted Answer

Enable S3 Object Lock in Compliance mode on the destination bucket.. S3 Object Lock in Compliance mode prevents any user, including the root user, from deleting or overwriting objects for the specified retention period. This meets the immutability and retention requirements for CloudTrail logs, and by using S3 lifecycle policies to transition logs to lower-cost storage classes (e.g., S3 Glacier Deep Archive) after the initial retention period, storage costs can be minimized while maintaining compliance.

Answer

Configure the S3 bucket with MFA Delete enabled.

Answer

Use CloudTrail log file validation and enable AWS CloudTrail Insights.

Answer

Store the logs in Amazon S3 Glacier Deep Archive with a vault lock policy.