SCS-C02 Security Logging and Monitoring Practice Test 19 — 15 Questions

Question 1

A company is designing a centralized logging solution for multiple AWS accounts. The logs must be encrypted at rest and in transit, and access must be audited. Which TWO actions should be taken? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the S3 bucket policy to restrict PutObject to the CloudTrail service principal with a condition on aws:SourceArn.. To centrally aggregate logs from multiple AWS accounts while ensuring encryption at rest and in transit, and auditing access, two key actions are required. First, configure the central S3 bucket with a bucket policy that restricts PutObject to the CloudTrail service principal with a condition on aws:SourceArn (Option C). This ensures only the intended CloudTrail trails from designated accounts can write logs, providing security and auditability. Second, use AWS KMS customer managed keys (CMK) to encrypt the central S3 bucket (Option D). This gives you control over the encryption keys and enables auditing of key usage via CloudTrail. Option A is incorrect because cross-account CloudWatch Logs subscription requires additional configuration and does not inherently provide encryption at rest with KMS control. Option B is wrong because enabling S3 server access logs does not encrypt the logs nor restrict write access; it logs access to the bucket itself. Option E is incorrect because VPC endpoints ensure traffic stays within the AWS network but do not provide encryption at rest or the granular write restrictions needed.

Answer

Configure cross-account CloudWatch Logs subscription to aggregate logs centrally.

Answer

Enable S3 server access logs on the central bucket for auditing.

Answer

Use VPC endpoints to ensure logs are transmitted over the AWS network.

Question 2

A company needs to ensure that all API calls made to AWS are logged and that the logs are immutable. Which TWO steps should be taken? (Choose TWO.)

Accepted Answer

Enable AWS CloudTrail in all regions.. Enabling AWS CloudTrail in all regions ensures that all management events across every region are logged, which is essential for comprehensive security monitoring and compliance. However, note that data events (e.g., S3 object-level operations) require explicit configuration in the trail. Option C is correct because storing CloudTrail logs in an S3 bucket with Object Lock enabled in Compliance mode prevents any user, including the root user, from deleting or overwriting log files, ensuring immutability. Together, these steps satisfy the requirement that all API calls are logged and the logs are immutable.

Answer

Enable CloudTrail log file validation.

Answer

Send CloudTrail logs to CloudWatch Logs with a retention policy.

Answer

Enable S3 versioning on the destination bucket.

Question 3

Refer to the exhibit. A security engineer configured the above bucket policy for CloudTrail log delivery. However, logs are not being delivered. What is the most likely cause?

Accepted Answer

The condition requires 'bucket-owner-full-control' ACL, but CloudTrail does not set this ACL when delivering to the same account.. When CloudTrail delivers logs to an S3 bucket in the same AWS account, it does not set the 'bucket-owner-full-control' canned ACL on the objects. The bucket policy condition requiring 's3:x-amz-acl': 'bucket-owner-full-control' will fail, as CloudTrail uses the default ACL (bucket-owner-full-control is only set for cross-account deliveries). This mismatch prevents log delivery.

Answer

The Action should be 's3:PutObjectAcl' instead of 's3:PutObject'.

Answer

The Principal is incorrect; it should be the CloudTrail service principal for the region.

Answer

The Resource ARN is missing the account ID in the path.

Question 4

A security engineer needs to capture all API calls made to AWS services for forensic analysis. Which AWS service should be used to store these logs durably and cost-effectively for long-term retention?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it captures all API calls made to AWS services, including the identity of the caller, time of the call, source IP address, and request parameters. It stores these logs durably in Amazon S3, which provides cost-effective long-term retention for forensic analysis. CloudTrail is specifically designed for auditing and monitoring API activity across an AWS environment.

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Answer

AWS Config

Question 5

A company uses AWS Organizations with multiple accounts. They want to centralize logging of all API calls across all accounts and store them in a single S3 bucket. Which configuration should be used?

Accepted Answer

Create an organization trail in the management account. AWS Organizations allows you to create an organization trail in the management account that automatically logs API calls for all member accounts. This centralizes CloudTrail logs into a single S3 bucket without needing to configure individual trails per account, ensuring complete coverage and simplified management.

Answer

Use AWS Config to record API calls across all accounts

Answer

Create a separate CloudTrail trail in each account and aggregate logs using Amazon Athena

Answer

Enable VPC Flow Logs in each account and send to a central S3 bucket

Question 6

A security team needs to detect unauthorized attempts to access an S3 bucket that contains sensitive data. Which AWS service can automatically analyze S3 access logs and generate findings for suspicious activity?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads. It can analyze VPC Flow Logs, AWS CloudTrail event logs, and DNS logs, and when S3 access logging is enabled, GuardDuty can ingest those logs to detect suspicious S3 access patterns, such as anomalous data exfiltration or access from unusual geographies. GuardDuty then generates security findings that can be automated for remediation.

Answer

Amazon Macie

Answer

AWS Trusted Advisor

Answer

Amazon Detective

Question 7

A security engineer is implementing centralized logging across multiple AWS accounts. Which TWO actions should the engineer take to ensure logs are securely stored and immutable? (Choose TWO.)

Accepted Answer

Use AWS KMS with a customer managed key for encryption. Using AWS KMS with a customer managed key (CMK) for encryption ensures that the security engineer has full control over the encryption keys, including key rotation, access policies, and the ability to disable or revoke the key. This prevents unauthorized decryption of logs, even by AWS, and is a critical component of securing log data at rest. Option C is correct because enabling S3 Object Lock on the destination bucket enforces a write-once-read-many (WORM) model, preventing logs from being deleted or overwritten for a specified retention period, which ensures immutability and compliance with regulatory requirements.

Answer

Enable S3 Transfer Acceleration on the bucket

Answer

Enable CloudTrail log file validation

Answer

Enable MFA Delete on the bucket

Question 8

A company is required to retain CloudTrail logs for 7 years for compliance. Which solution meets this requirement with the LEAST operational overhead?

Accepted Answer

Configure an S3 Lifecycle policy to transition logs to S3 Glacier Deep Archive after 90 days and expire after 7 years.. It uses an S3 Lifecycle policy to automatically transition CloudTrail logs to S3 Glacier Deep Archive after 90 days (reducing storage costs) and then expire (delete) the objects after 7 years, meeting the retention requirement with zero ongoing operational effort. This is the least operational overhead solution as it is fully automated within S3, requiring no custom code, manual intervention, or additional services.

Answer

Store logs in CloudWatch Logs with a retention period of 7 years.

Answer

Configure CloudTrail to automatically delete logs older than 7 years.

Answer

Use an AWS Lambda function to delete logs older than 7 years.

Answer

Export logs to AWS Snowball for offline archival.

Question 9

A security engineer notices that an S3 bucket containing sensitive data has been accessed from an IP address outside the allowed range. CloudTrail logs show the access was made using temporary credentials from an assumed role. What additional logging is needed to trace the access back to the original IAM user who assumed the role?

Accepted Answer

Enable AWS Config to record S3 bucket policies.. The information needed to trace the access back to the original IAM user who assumed the role is already available in CloudTrail management events, which are enabled by default. The AssumeRole API call is logged as a management event and includes the ARN of the IAM user or role that performed the assumption. Therefore, no additional logging is required to identify the original user. Options A, B, C, D, and E do not provide this specific information: A and D log the S3 access but show only the assumed role; B and C are unrelated; E records configuration changes but not the specific AssumeRole call.

Answer

Enable CloudTrail to log data events for the S3 bucket.

Answer

Enable VPC Flow Logs for the VPC where the request originated.

Answer

Configure CloudWatch Logs to capture the EC2 instance's system logs.

Answer

Enable S3 server access logging for the bucket.

Question 10

A company uses Amazon GuardDuty for threat detection. The security team wants to automatically isolate an EC2 instance that is communicating with a known malicious IP address. Which combination of services should be used?

Accepted Answer

GuardDuty -> EventBridge -> Lambda -> modify security group. Amazon GuardDuty generates findings that can be sent to Amazon EventBridge as events. EventBridge can then trigger an AWS Lambda function that modifies the security group associated with the EC2 instance to deny traffic to/from the malicious IP address. This architecture provides a serverless, event-driven response mechanism without polling or additional services.

Answer

GuardDuty -> AWS Config -> Lambda -> modify security group

Answer

GuardDuty -> CloudWatch Alarm -> Lambda -> modify security group

Answer

GuardDuty -> AWS Shield -> modify security group

Answer

GuardDuty -> AWS Systems Manager -> modify security group

Question 11

A company uses Amazon GuardDuty in a single AWS account to detect threats. The security team receives an alert that a specific EC2 instance is communicating with a known command and control (C2) server. The security engineer needs to immediately isolate the instance while preserving the root cause evidence. The engineer has access to the AWS Management Console. Which action should the engineer take FIRST?

Accepted Answer

Take a snapshot of the EBS volume and then isolate the instance by modifying the security group.. The correct first action is to take a snapshot of the EBS volume to preserve root cause evidence, then modify the security group to block all outbound traffic, isolating the instance. Option A is incorrect because terminating the instance destroys volatile evidence and may not capture the current state. Option C is incorrect because modifying the security group without first taking a snapshot could lose critical evidence before isolation. Option D is incorrect because installing the CloudWatch agent takes time and does not immediately stop communication or isolate the instance.

Answer

Terminate the instance immediately to stop the communication.

Answer

Modify the security group to block all outbound traffic.

Answer

Install the CloudWatch Logs agent on the instance to capture logs.

Question 12

A security engineer needs to monitor for unauthorized changes to security group rules in an AWS account. The engineer wants to receive real-time notifications when a security group rule is added, modified, or removed. Which AWS service should the engineer use to capture these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including EC2 APIs such as AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, AuthorizeSecurityGroupEgress, RevokeSecurityGroupEgress, CreateSecurityGroup, and DeleteSecurityGroup. By enabling CloudTrail trail with management events and optionally data events for EC2, the security engineer can capture these API calls in near real-time and stream them to Amazon CloudWatch Logs or Amazon EventBridge to trigger notifications for unauthorized changes to security group rules.

Answer

Amazon GuardDuty

Answer

VPC Flow Logs

Answer

AWS Config

Question 13

A company uses AWS Organizations with multiple accounts. The security team needs to centrally monitor all API calls made in the member accounts. The team wants to ensure that all CloudTrail logs are delivered to a centralized S3 bucket in the management account. Which configuration should the security team implement?

Accepted Answer

Create an organization trail in the management account with the S3 bucket in the management account.. AWS Organizations supports creating an organization trail in the management account that automatically applies to all member accounts. This ensures that all API calls from every account in the organization are logged and delivered to a centralized S3 bucket in the management account without needing to configure individual trails or manage cross-account permissions manually.

Answer

Configure CloudWatch cross-account subscription to send logs from member accounts to the management account.

Answer

Enable CloudTrail in each member account and configure each trail to deliver logs to the same S3 bucket.

Answer

Use Amazon S3 replication to copy logs from member account buckets to the management account bucket.

Question 14

A company has a requirement to detect and alert on anomalous IAM user behavior, such as a user logging in from an unusual geographic location. The company uses AWS Organizations and has multiple accounts. Which services should the company use to meet this requirement? (Choose two.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty (C) is correct because it uses machine learning to detect anomalous IAM user behavior, such as logins from unusual geographic locations, across multiple accounts when integrated with AWS Organizations. AWS CloudTrail (E) is correct because it records all IAM user sign-in events and API calls, providing the raw data that GuardDuty analyzes. CloudTrail is essential for capturing the logs that enable GuardDuty to detect anomalies. IAM Access Analyzer (D) is incorrect because it focuses on resource policies and unintended external access, not user behavior anomalies like unusual login locations.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

IAM Access Analyzer

Question 15

A security engineer needs to ensure that all changes to IAM policies in an AWS account are logged and that the logs are immutable and cannot be deleted by any user, including the root user. Which actions should the engineer take? (Choose two.)

Accepted Answer

Enable AWS CloudTrail to log IAM events.. AWS CloudTrail is the service specifically designed to log all API activity, including IAM policy changes. By enabling CloudTrail with management event logging, all IAM CreatePolicy, PutPolicy, DeletePolicy, and similar actions are recorded in a log file delivered to an S3 bucket. This provides an authoritative audit trail of who made the change, when, and from which source IP. Option E is correct because S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting objects for the specified retention period. This ensures the log files are immutable and cannot be tampered with or deleted, fulfilling the requirement that logs cannot be deleted by any user.

Answer

Enable default encryption with AWS KMS on the bucket.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable multi-factor authentication (MFA) delete on the S3 bucket.