SCS-C02 Security Logging and Monitoring Practice Test 19 — 15 Questions

Question 1

A company uses Amazon GuardDuty to monitor for threats. The security team receives a high-severity finding: 'UnauthorizedAccess:EC2/SSHBruteForce'. The finding indicates a single EC2 instance with a public IP is receiving SSH connection attempts from multiple external IPs. The instance is part of an Auto Scaling group and is fronted by an Application Load Balancer (ALB). The security team wants to block the attacking IPs without disrupting legitimate traffic. What is the MOST effective approach?

Accepted Answer

Configure AWS WAF on the ALB to block the attacking IPs using an IP set rule.. GuardDuty can automatically update AWS WAF web ACLs via CloudWatch Events and Lambda. Since the ALB is the entry point, blocking at the WAF level prevents attacks before they reach the instance.

Answer

Stop the EC2 instance and launch a new one in a different subnet.

Answer

Modify the security group of the EC2 instance to deny inbound SSH from the attacking IPs.

Answer

Create a network ACL rule on the subnet to deny inbound traffic from the attacking IPs.

Question 2

A company wants to detect and alert on changes to IAM roles and policies in their AWS account. Which combination of AWS services should they use?

Accepted Answer

AWS CloudTrail and Amazon EventBridge (CloudWatch Events). CloudTrail logs all IAM API calls, and CloudWatch Events (now Amazon EventBridge) can filter for specific events (e.g., PutRolePolicy) and trigger an SNS notification or Lambda function.

Answer

Amazon GuardDuty and AWS Shield

Answer

Amazon CloudWatch Logs and AWS Lambda

Answer

AWS Config and Amazon Inspector

Question 3

A DevOps engineer notices that an EC2 instance's CloudWatch agent is not sending custom metrics to CloudWatch. The agent is installed and the configuration file is valid. The instance has an IAM role attached. What is the most likely reason for the failure?

Accepted Answer

The IAM role attached to the instance does not have the cloudwatch:PutMetricData permission.. The CloudWatch agent needs permissions to put metrics. If the IAM role lacks the 'cloudwatch:PutMetricData' action, the agent will fail silently.

Answer

The instance does not have internet access to reach CloudWatch endpoints.

Answer

The CloudWatch agent is not running as root.

Answer

The CloudWatch agent configuration file has a syntax error.

Question 4

A security team uses Amazon Macie to discover sensitive data in S3. They have configured Macie to run automated sensitive data discovery jobs. After reviewing the findings, they notice that some S3 objects containing personally identifiable information (PII) are not being flagged. What is the most likely cause?

Accepted Answer

The PII is in a format that Macie's managed data identifiers do not recognize, and no custom data identifier is configured.. Macie uses managed data identifiers for common PII types. If the PII is in a format not covered (e.g., custom formats), it may not be detected. Macie also supports custom data identifiers that must be configured.

Answer

The Macie service-linked role does not have permissions to read the objects.

Answer

The S3 bucket is in a different AWS Region than the Macie job.

Answer

The S3 objects are encrypted with SSE-S3.

Question 5

A company wants to centralize logs from multiple AWS accounts into a single S3 bucket for analysis. The accounts are part of an AWS Organizations organization. Which set of steps will accomplish this?

Accepted Answer

Create an organization trail in the management account with logging enabled for all accounts.. AWS CloudTrail supports organization trails that log all accounts in the organization. A single trail can be created in the management account that delivers logs to a centralized S3 bucket.

Answer

Use AWS Config to aggregate logs from all accounts into a central S3 bucket.

Answer

Create a CloudTrail trail in each account and configure each to write to the same S3 bucket.

Answer

Set up Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket.

Question 6

A security engineer is investigating a potential data exfiltration incident. They see that an EC2 instance with an IAM role is making API calls to S3 to download objects. The IAM role has an S3 bucket policy that allows access from that role. However, CloudTrail logs show that the calls are being made from an IP address outside the company's network. What is the most likely explanation?

Accepted Answer

The IAM role credentials were stolen and are being used from an external machine.. The correct answer is A because the CloudTrail logs show the API calls originating from an IP address outside the company's network, which indicates that the IAM role credentials (temporary security credentials from the instance metadata) have been compromised and are being used from an external machine. The S3 bucket policy allows access from the IAM role, but the source IP in the logs is external, confirming the credentials are being used outside the EC2 instance.

Answer

The EC2 instance has a public IP and the calls are originating from the instance itself.

Answer

CloudTrail is logging the IP address of the AWS service endpoint, not the client.

Answer

The S3 bucket policy allows public access.

Question 7

A company uses AWS CloudTrail to log all API activity. They want to ensure that log files are tamper-proof and can be validated for forensic purposes. Which of the following should they enable?

Accepted Answer

CloudTrail log file integrity validation. CloudTrail log file integrity validation uses digital signatures (SHA-256) to verify that log files have not been modified after delivery. It also provides a digest file for validation.

Answer

AWS KMS server-side encryption on the S3 bucket

Answer

S3 bucket versioning

Answer

S3 Object Lock with governance mode

Question 8

A security analyst wants to receive a notification whenever a new security group is created in their AWS account. Which AWS service should they use to trigger an SNS notification based on the CloudTrail event?

Accepted Answer

Amazon EventBridge (CloudWatch Events). Amazon EventBridge (formerly CloudWatch Events) can match events from CloudTrail (e.g., CreateSecurityGroup) and route them to targets like SNS.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

AWS Lambda

Question 9

A security team is designing a logging solution for a multi-account AWS environment using AWS Organizations. They need to collect CloudTrail logs, VPC Flow Logs, and DNS logs from all accounts. Which TWO services can be used to centralize this logging?

Accepted Answer

AWS CloudTrail (Organization Trail). CloudTrail Organization Trail centralizes CloudTrail logs. Amazon S3 is the standard destination for VPC Flow Logs and DNS logs (via Route 53 Resolver query logs). AWS Config is configuration management, not log collection. CloudWatch Logs can be used but is not the primary centralization service for cross-account logs; S3 is more cost-effective for long-term storage.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon GuardDuty

Question 10

A security engineer is configuring Amazon GuardDuty in a multi-account environment. The engineer wants to enable GuardDuty in the management account and automatically enable it for all member accounts. Which THREE steps are required?

Accepted Answer

Configure GuardDuty to automatically enable for all accounts in the organization via the Organizations integration.. GuardDuty must be enabled in the management account first. Then, using Organizations, GuardDuty can be automatically enabled for all existing and new accounts. Member accounts must also accept the invitation to join the GuardDuty administrator account.

Answer

Have each member account manually enable GuardDuty.

Answer

Create an S3 bucket for GuardDuty findings in each member account.

Question 11

A company wants to monitor unauthorized API calls in their AWS account. Which TWO AWS services can provide real-time alerting on such events?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including unauthorized ones (e.g., AccessDenied errors). By configuring CloudTrail to deliver logs to Amazon CloudWatch Logs and setting up a metric filter with an alarm, you can receive real-time alerts when unauthorized API calls occur. This directly meets the requirement for monitoring and alerting on such events.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Question 12

A financial services company has a multi-account AWS environment with over 200 accounts managed through AWS Organizations. The security team is responsible for monitoring all accounts for security incidents. They have enabled AWS CloudTrail in all accounts with trails that deliver logs to a centralized S3 bucket in the security account. Additionally, they have enabled Amazon GuardDuty in all accounts with the security account as the administrator. The team uses Amazon EventBridge to trigger automated responses to GuardDuty findings. Recently, they noticed that some GuardDuty findings from member accounts are not appearing in the security account. The security team verified that the findings are generated in the member accounts (they can see them in the member account GuardDuty console) but are not being sent to the administrator account. The CloudTrail logs are being delivered correctly. What is the MOST likely cause of this issue?

Accepted Answer

The member accounts have not accepted the invitation from the GuardDuty administrator account.. In GuardDuty multi-account setup, each member account must accept the invitation from the administrator account to enable sharing of findings. If a member account has not accepted the invitation, findings will not be sent to the administrator. This is a common misconfiguration.

Answer

The S3 bucket policy in the centralized logging bucket is blocking GuardDuty findings from being written.

Answer

The EventBridge rules in the security account are not configured to receive events from member accounts.

Answer

The GuardDuty service-linked role in the member accounts does not have permissions to publish findings to the administrator account.

Question 13

A security engineer notices that an IAM user in the company's AWS account is making API calls from an IP address outside the allowed corporate network. The engineer needs to be alerted immediately when such activity occurs. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Create an Amazon CloudWatch Events rule that matches the IAM user's API calls from the unauthorized IP and sends an SNS notification.. Option C is correct because CloudWatch Events (now Amazon EventBridge) can capture API calls from CloudTrail and trigger an SNS notification based on a rule matching the source IP address. Option A is wrong because Trusted Advisor does not monitor IAM user API calls in real time. Option B is wrong because VPC Flow Logs capture network traffic but not API-level details. Option D is wrong because S3 server access logs are for S3 operations only.

Answer

Enable AWS Trusted Advisor and configure email notifications for security checks.

Answer

Enable VPC Flow Logs and analyze them with Amazon Athena to detect suspicious IPs.

Answer

Configure S3 server access logs on the IAM users' bucket and use Amazon Macie to detect anomalies.

Question 14

A company wants to centralize CloudTrail logs from multiple AWS accounts into a single S3 bucket for security analysis. The logs must be encrypted at rest and access must be logged. What is the MOST secure way to grant cross-account access to the central S3 bucket?

Accepted Answer

Create an S3 bucket policy that grants CloudTrail service principal permission to write objects, with a condition checking the source account ID.. Option A is correct because using a bucket policy with a condition for CloudTrail service principal and source account ensures only CloudTrail from allowed accounts can write. Option B is wrong because KMS encryption does not control write access. Option C is wrong because IAM roles are not used by CloudTrail for cross-account delivery. Option D is wrong because a bucket policy without account restriction would allow any CloudTrail to write.

Answer

Create an S3 bucket policy that grants s3:PutObject to everyone, and rely on CloudTrail to restrict access.

Answer

Create an IAM role in the central account that each member account can assume to write logs.

Answer

Use an S3 bucket with default encryption enabled and share the KMS key with the other accounts.

Question 15

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that all accounts have CloudTrail enabled and that logs are delivered to a central S3 bucket. A new member account is created and the security engineer wants to enforce this configuration automatically. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a CloudTrail template to all accounts in the organization.. Option D is correct because AWS CloudFormation StackSets can deploy a CloudTrail template across all accounts in an organization automatically. Option A is wrong because AWS Config rules are reactive and cannot enable CloudTrail. Option B is wrong because SCPs can deny disabling CloudTrail but cannot enable it. Option C is wrong because AWS Lambda would require manual setup and maintenance.

Answer

Use AWS Config rules to detect accounts without CloudTrail and trigger a remediation via Systems Manager Automation.

Answer

Use an SCP to deny cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.

Answer

Create an AWS Lambda function that runs periodically to check and enable CloudTrail in each account.