SCS-C02 Security Logging and Monitoring Practice Test 18 — 15 Questions

Question 1

A company has a requirement to retain AWS CloudTrail logs for 7 years for compliance. The logs are stored in an S3 bucket. The company wants to reduce storage costs by automatically moving older logs to a cheaper storage class. Which solution should the company implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an S3 Lifecycle policy to transition objects from S3 Standard to S3 Glacier after a specified number of days.. An S3 Lifecycle policy can automatically transition CloudTrail logs from S3 Standard to S3 Glacier after a specified number of days, meeting the 7-year retention requirement while reducing storage costs. S3 Glacier is designed for long-term archival at low cost, and lifecycle rules can be configured to transition objects directly or through intermediate classes like S3 Standard-IA. S3 Intelligent-Tiering (Option A) also automatically optimizes costs and supports archival tiers, but it works based on access patterns, not fixed age-based rules, and incurs per-object monitoring fees. For compliance-driven, age-based retention, a Lifecycle policy is the more direct and cost-effective solution.

Answer

Use S3 Intelligent-Tiering to automatically move logs to the most cost-effective access tier.

Answer

Move logs to S3 Standard-IA after 30 days.

Answer

Use S3 Batch Operations to manually copy logs to S3 Glacier.

Question 2

A company is using Amazon CloudWatch Logs to collect logs from its EC2 instances. The security team wants to ensure that logs are encrypted at rest and that access to the logs is controlled. Which solution should the team implement?

Accepted Answer

Enable encryption using AWS KMS customer managed keys (CMK) and apply IAM policies to control access.. CloudWatch Logs supports encryption at rest using AWS KMS customer managed keys (CMK), which allows the security team to control access to the encrypted log data via IAM policies and key policies. This ensures both encryption and fine-grained access control, meeting the requirements.

Answer

Use SSE-C with a customer-provided key to encrypt log data.

Answer

Use SSE-S3 to encrypt the log data in CloudWatch Logs.

Answer

Enable default encryption on the log group and use S3 bucket policies.

Question 3

A security engineer needs to identify which IAM users have been inactive for the past 90 days. Which AWS service should the engineer use?

Accepted Answer

AWS IAM Credential Report. AWS IAM Credential Report is the correct service because it provides a CSV report that lists all IAM users in an account and includes the `password_last_used` and `access_key_last_used_date` fields. By examining these fields, a security engineer can determine which users have not authenticated or used their access keys for more than 90 days, directly meeting the requirement to identify inactive IAM users.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

AWS CloudTrail

Question 4

A security team wants to implement a centralized logging solution for multiple AWS accounts. The team needs to collect VPC Flow Logs, CloudTrail logs, and DNS query logs from all accounts. Which THREE services should the team use to aggregate these logs? (Choose THREE.)

Accepted Answer

Amazon Route 53 Resolver query logging. Amazon Route 53 Resolver query logging (C) is correct because it captures DNS queries made by resources within a VPC, including queries to the Resolver, and can publish those logs to CloudWatch Logs, S3, or Kinesis Data Firehose for centralization. AWS CloudTrail (D) is correct because it records API activity and account events across accounts, and with an organization trail you can aggregate CloudTrail logs from all accounts into a single S3 bucket. VPC Flow Logs (E) is correct because it captures IP traffic metadata for network interfaces in a VPC and can deliver logs to CloudWatch Logs or S3, enabling centralized collection across accounts. AWS CloudHSM (A) is not a logging service; it provides dedicated hardware security modules for cryptographic key operations. AWS Config (B) tracks resource configuration changes and compliance, not VPC Flow Logs, CloudTrail events, or DNS query logs, so it does not fulfill the aggregation requirement.

Answer

AWS CloudHSM

Answer

AWS Config

Question 5

A security engineer needs to ensure that all API calls made to AWS are logged and retained for at least 7 years for compliance. Which AWS service should be enabled to meet this requirement?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS, including the identity of the caller, the time of the call, the source IP address, and the request parameters. CloudTrail logs can be stored in an S3 bucket with lifecycle policies to retain logs for exactly 7 years, meeting the compliance requirement for long-term retention.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon Inspector

Question 6

A company is experiencing unauthorized access attempts to an S3 bucket. Which AWS service can be used to detect and alert on such events in real time?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads. It uses machine learning, anomaly detection, and integrated threat intelligence to analyze AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs. When it detects unauthorized access attempts to an S3 bucket, such as suspicious API calls or anomalous data access patterns, it generates real-time security findings that can be sent to Amazon CloudWatch Events for alerting and automated response.

Answer

Amazon Macie

Answer

AWS Config

Answer

AWS CloudTrail

Question 7

A security team wants to centrally collect and analyze VPC Flow Logs from multiple AWS accounts for security monitoring. Which solution is MOST scalable and cost-effective?

Accepted Answer

Use AWS Organizations to centralize logging by delivering VPC Flow Logs to a centralized S3 bucket and query with Amazon Athena.. Using AWS Organizations to centrally deliver VPC Flow Logs to a centralized S3 bucket, then querying with Amazon Athena, is both scalable and cost-effective. S3 provides durable, low-cost storage for large volumes of log data, and Athena allows serverless, pay-per-query analysis without provisioning infrastructure. This approach avoids the operational overhead of managing EC2 instances or streaming pipelines, and scales seamlessly as log volume grows.

Answer

Aggregate logs in an EC2 instance running an ELK stack.

Answer

Use Amazon Kinesis Data Firehose to stream logs to an S3 bucket and process with AWS Lambda.

Answer

Configure VPC Flow Logs to send to a centralized CloudWatch Logs account using cross-account subscriptions.

Question 8

A company needs to monitor for root account usage and receive immediate notifications. Which combination of AWS services should be used?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Logs, and Amazon SNS. AWS CloudTrail captures all root account API calls, CloudWatch Logs can monitor those events for root activity using a metric filter, and Amazon SNS delivers immediate notifications when the filter triggers. This combination provides the logging, monitoring, and alerting pipeline required for real-time root account usage detection.

Answer

AWS Config and AWS Lambda

Answer

Amazon GuardDuty and AWS Lambda

Answer

S3 server access logs and Amazon Inspector

Question 9

A security engineer is troubleshooting an issue where CloudTrail logs are not being delivered to the specified S3 bucket. The bucket policy allows CloudTrail to write objects. What is the MOST likely cause?

Accepted Answer

The S3 bucket has a bucket policy that denies access to the CloudTrail service principal.. The most likely cause is that the S3 bucket policy explicitly denies access to the CloudTrail service principal. Even if a bucket policy allows CloudTrail to write logs, an explicit deny statement overrides any allow, preventing log delivery. This is a common misconfiguration where a deny rule is inadvertently applied to the CloudTrail principal.

Answer

The S3 bucket uses server-side encryption with customer-provided keys (SSE-C).

Answer

The S3 bucket does not have versioning enabled.

Answer

The S3 bucket is in a different AWS account.

Question 10

A company uses AWS CloudTrail to log all management events and data events for S3. The security team wants to detect any PutObject API calls that upload objects with server-side encryption disabled. Which solution is MOST efficient?

Accepted Answer

Enable CloudTrail data events for S3 and create a CloudWatch metric filter to alert on PutObject calls without the x-amz-server-side-encryption header.. CloudTrail data events for S3 capture PutObject API calls, including request parameters. A CloudWatch metric filter can be configured to match PutObject events that lack the 'x-amz-server-side-encryption' header, indicating the object was uploaded without server-side encryption. This approach is efficient as it uses existing logging infrastructure without additional scanning or parsing overhead.

Answer

Use Amazon GuardDuty to detect unencrypted uploads.

Answer

Use Amazon Macie to scan S3 objects for missing encryption.

Answer

Enable S3 server access logs and parse them with Amazon Athena.

Question 11

A company wants to receive an alert when an IAM user creates a new access key. Which AWS service should be used to trigger the alert?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events. AWS CloudTrail captures API calls made by or on behalf of an IAM user, including CreateAccessKey events. These events can be sent to Amazon CloudWatch Events (now part of Amazon EventBridge) using a rule that matches the specific API call, which then triggers an alert (e.g., via SNS or Lambda). This combination enables real-time monitoring and notification for security-sensitive actions like access key creation.

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Answer

AWS Config

Question 12

A security engineer needs to monitor for unusual outbound network traffic from an EC2 instance. Which AWS service provides this capability?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic going to and from network interfaces in a VPC, including source/destination IPs, ports, protocols, and packet counts. This allows a security engineer to analyze outbound traffic patterns from an EC2 instance and detect anomalies such as data exfiltration or communication with known malicious IPs. The logs can be published to Amazon CloudWatch Logs or Amazon S3 for further analysis with tools like Amazon Athena or third-party SIEMs.

Answer

Amazon CloudWatch Logs agent

Answer

Amazon Inspector

Answer

AWS Config

Question 13

A company is using AWS CloudTrail to log all management events and has enabled log file validation. What additional security benefit does log file validation provide?

Accepted Answer

It ensures the integrity of the log files by detecting tampering.. Log file validation uses a digital signature (SHA-256 hash) created for each log file, which is stored in a separate digest file. When validation is enabled, CloudTrail automatically creates a hash for each log file and signs it with a private key, allowing you to verify that the log files have not been modified, deleted, or tampered with after they were delivered. This ensures the integrity of the log files by detecting any unauthorized changes.

Answer

It prevents anyone from deleting the log files.

Answer

It encrypts the log files at rest.

Answer

It provides real-time monitoring for API calls.

Question 14

A company needs to monitor for unauthorized changes to security group rules. Which TWO AWS services can be used together to achieve this?

Accepted Answer

AWS Config. Options B and E are correct. AWS Config can track changes to security group rules, and Amazon CloudWatch Events can trigger a notification when a Config rule detects a change. Option A (GuardDuty) is for threat detection. Option C (Inspector) is for vulnerability scanning. Option D (CloudTrail) logs API calls but is not the best for direct rule-level monitoring.

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 15

Which TWO AWS services can be used to detect and alert on suspicious activity in near real-time?

Accepted Answer

Amazon CloudWatch Events. Amazon CloudWatch Events (now part of Amazon EventBridge) can detect suspicious activity by monitoring AWS API calls, resource state changes, and custom application events in near real-time. It can trigger automated responses, such as invoking a Lambda function or sending an SNS notification, when specific patterns (e.g., unauthorized API calls or unusual resource modifications) are detected. This makes it suitable for near real-time alerting on suspicious activity.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

AWS Config