SCS-C02 Security Logging and Monitoring Practice Test 2 — 15 Questions

Question 1

A security engineer wants to receive real-time notifications when an AWS API call is made to delete an S3 bucket. Which service should be used to capture and forward these events to an Amazon SNS topic?

Accepted Answer

AWS CloudTrail with CloudWatch Events. AWS CloudTrail captures all API calls made to S3, including DeleteBucket. By sending these CloudTrail events to Amazon CloudWatch Events (now part of Amazon EventBridge), you can create a rule that matches the specific API call and forwards it to an SNS topic for real-time notification. This combination provides the exact event-driven pipeline needed for immediate alerting on S3 bucket deletions.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Answer

AWS Config

Question 2

A company is using AWS Organizations with multiple accounts. The security team needs to centrally monitor all root user API activity across all accounts and receive alerts within minutes. What is the MOST efficient solution?

Accepted Answer

Create an organization trail in CloudTrail that logs all accounts. Use CloudWatch Logs metric filters and alarms to detect root login events.. Option A is correct because an organization trail in AWS CloudTrail logs API activity for all accounts in AWS Organizations from a single point, eliminating the need to manage per-account trails. By sending these logs to CloudWatch Logs, you can create metric filters to detect root user login events (e.g., the 'RootLogin' event) and configure CloudWatch Alarms to trigger SNS notifications within minutes, meeting the requirement for centralized monitoring and rapid alerts.

Answer

Enable CloudTrail in each account and aggregate logs to a centralized S3 bucket. Use Athena queries to detect root activity and send alerts via SNS.

Answer

Use AWS Lambda functions in each account to poll CloudTrail logs and send root activity to a central SQS queue.

Answer

Enable AWS Config rules in each account to detect root user activity and send notifications to a central SNS topic.

Question 3

A company uses AWS CloudTrail to log all API calls. The security team notices that some expected log entries are missing for actions performed by an IAM role assumed by an EC2 instance. The instance has the required permissions. What is the MOST likely cause of the missing log entries?

Accepted Answer

The IAM role used by the EC2 instance has a permissions boundary that excludes cloudtrail:PutLogEvents.. Option D is correct because CloudTrail logs are delivered to an S3 bucket, and the IAM role must have permissions to write logs via `cloudtrail:PutLogEvents`. If a permissions boundary on the role explicitly denies this action, the role cannot deliver log entries to CloudTrail, even if the role has other required permissions. This explains why expected log entries are missing despite the instance having the necessary permissions to perform the API calls.

Answer

The EC2 instance is in a VPC that has a VPC endpoint for CloudTrail, but the endpoint policy denies logging.

Answer

CloudTrail is not logging read-only API calls by default; the trail must be configured to log read events.

Answer

CloudTrail trail is not configured to log data events for EC2.

Question 4

A security engineer is designing a monitoring solution for a multi-account AWS environment using AWS Organizations. The solution must provide a centralized view of all API activities and send alerts for suspicious events. Which TWO services together can achieve this? (Choose TWO.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it records all API activity across an AWS environment, and when integrated with AWS Organizations, it can deliver a centralized view of API calls from all accounts into a single CloudTrail trail. Amazon CloudWatch Logs is correct because it can ingest CloudTrail logs from a centralized logging account, allowing the security engineer to create metric filters and alarms that trigger alerts for suspicious events based on specific API patterns.

Answer

Amazon GuardDuty

Answer

AWS Lambda

Answer

AWS Config

Question 5

A company runs a critical application on an Auto Scaling group of EC2 instances behind an Application Load Balancer. The security team enabled VPC Flow Logs, CloudTrail, and CloudWatch Logs for the application tier. Recently, they noticed that some EC2 instances are being terminated unexpectedly by an unknown IAM user. The CloudTrail logs show the TerminateInstances API call, but the source IP address is from within the VPC CIDR range. The security team suspects the action is coming from an EC2 instance that has been compromised. They need to identify the specific compromised instance and the IAM role it used. Which combination of steps will provide the necessary information? (Choose TWO.)

Accepted Answer

Review the VPC Flow Logs for any traffic to the EC2 API endpoint. Look for the source IP that made the API call. Then use that IP to find the instance in the EC2 console. Check the IAM role attached to that instance.. Option A is correct because VPC Flow Logs capture traffic to the EC2 API endpoint (at the AWS public IP range for the region). By filtering for traffic to the EC2 API endpoint IP and looking for the source IP that made the API call, you can identify the compromised instance's private IP. Then, checking the IAM role attached to that instance in the EC2 console reveals the role used for the unauthorized action.

Answer

Use AWS Config to find all EC2 instances that were terminated around that time. Then check the CloudTrail event for the IAM role. Finally, use the instance ID from the termination event to identify the source.

Answer

Check the CloudWatch Logs for the Auto Scaling group to find any error messages around the termination time. Correlate with the CloudTrail event to identify the IAM role. Then use the EC2 console to list all instances and check their IAM roles manually.

Question 6

A security engineer needs to ensure that all API calls made in an AWS account are captured and retained for auditing purposes. The engineer must be able to query the logs for specific user activity over the past 90 days. Which AWS service should the engineer use to meet these requirements?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made in an AWS account, including the identity, source IP, request parameters, and response elements. By default, CloudTrail stores event history for the last 90 days, which can be queried via the Event History console or API, meeting the requirement to query logs for specific user activity over the past 90 days without additional configuration.

Answer

Amazon VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 7

A company is using AWS CloudTrail to monitor API activity in its AWS account. The security team needs to be alerted when unauthorized API calls are made to delete Amazon S3 buckets. Which TWO steps should the security team take to meet this requirement? (Choose TWO.)

Accepted Answer

Configure CloudTrail to deliver logs to Amazon CloudWatch Logs and create a metric filter for the DeleteBucket API call.. Option D is correct because CloudTrail can be configured to deliver logs to Amazon CloudWatch Logs, and a metric filter can be created to match the `DeleteBucket` API call. This metric can then trigger an alarm that sends an SNS notification, alerting the security team to unauthorized API calls. Option E is correct because Amazon CloudWatch Events (now Amazon EventBridge) can directly match the `DeleteBucket` API call from CloudTrail and trigger an SNS notification without needing a metric filter or alarm.

Answer

Enable Amazon VPC Flow Logs to capture API calls and use Amazon Athena to query for DeleteBucket events.

Answer

Create an AWS CloudTrail trail that monitors Amazon CloudWatch Logs for DeleteBucket API calls.

Answer

Create an AWS Config rule to detect DeleteBucket API calls and send an SNS notification.

Question 8

Refer to the exhibit. A security engineer is reviewing an IAM policy attached to a user. The policy is intended to allow the user to get and put objects in the S3 bucket 'example-bucket' only from the IP range 203.0.113.0/24. However, the user reports that they are unable to put objects from an IP within that range. What is the most likely cause of this issue?

Accepted Answer

The policy lacks a separate statement to allow 's3:ListBucket' on the bucket resource.. Option D is correct because the policy only grants s3:GetObject and s3:PutObject actions on the bucket's objects (arn:aws:s3:::example-bucket/*), but does not include a separate statement allowing s3:ListBucket on the bucket resource (arn:aws:s3:::example-bucket). Without s3:ListBucket, the user cannot list the bucket's contents, which is often required by the AWS CLI or SDK to resolve object keys before performing put operations. The IP condition is correctly applied, so the issue is the missing list permission.

Answer

The condition key should be 'aws:sourceIp' (lowercase 's').

Answer

The policy should use the 'NotIpAddress' condition operator instead of 'IpAddress'.

Answer

The resource ARN should be 'arn:aws:s3:::example-bucket' without the '/*' suffix.

Question 9

Drag and drop the steps to set up AWS Shield Advanced with automatic application layer DDoS mitigation in the correct order.

Question 10

Drag and drop the steps to respond to a suspected AWS IAM credential compromise in the correct order.

Question 11

Match each AWS CloudTrail log type to its description.

Question 12

Match each AWS security tool to its purpose.

Question 13

A security engineer needs to monitor for suspicious API calls in near real-time and trigger an automated response. Which AWS service should be used to capture and analyze these API calls?

Accepted Answer

AWS CloudTrail. Option B is correct because AWS CloudTrail records API calls and can deliver events to CloudWatch Logs for near real-time analysis. Option A is wrong because AWS Config monitors resource configurations, not API calls. Option C is wrong because Amazon GuardDuty is a threat detection service that uses various data sources, but it does not directly capture API calls for custom analysis. Option D is wrong because AWS CloudHSM is a hardware security module, not a logging service.

Answer

AWS CloudHSM

Answer

Amazon GuardDuty

Answer

AWS Config

Question 14

A company uses AWS Organizations with multiple accounts. The security team wants to centralize security logs (CloudTrail, VPC Flow Logs, AWS Config) from all accounts into a single S3 bucket for analysis. What is the MOST secure way to set up this centralized logging?

Accepted Answer

Create a dedicated S3 bucket in the security account with a bucket policy that grants write access to the logging services of all accounts and enforces encryption in transit and at rest.. Option D is correct because using a centralized S3 bucket with a bucket policy that grants cross-account access and enforces encryption is secure and auditable. Option A is wrong because using the same bucket used for other purposes may break the principle of least privilege and increase risk. Option B is wrong because creating individual buckets for each account defeats centralization. Option C is wrong because enabling S3 default encryption on a bucket that already receives logs via cross-account policies is not sufficient; the bucket policy must explicitly grant permissions.

Answer

Create a dedicated S3 bucket in the management account, enable S3 default encryption, and configure service delivery for each account.

Answer

Configure each account to deliver logs to the same S3 bucket used for other data.

Answer

Create an S3 bucket in each account and use S3 replication to copy logs to a central bucket.

Question 15

A company is using Amazon CloudWatch Logs to store application logs. The security team needs to retain logs for 7 years to comply with regulatory requirements. The logs are accessed infrequently after the first 90 days. What is the MOST cost-effective way to meet these retention and access requirements?

Accepted Answer

Export logs from CloudWatch Logs to an S3 bucket, then use S3 Lifecycle policies to transition logs to S3 Glacier Deep Archive after 90 days.. Option A is correct because exporting logs to S3 and using S3 Lifecycle policies to transition to Glacier Deep Archive provides long-term retention at low cost. Option B is wrong because CloudWatch Logs does not support lifecycle policies to Glacier, only to S3. Option C is wrong because CloudWatch Logs Insights is not designed for long-term archival storage. Option D is wrong because S3 Standard-IA is not cost-effective for 7 years of infrequently accessed data; Glacier Deep Archive is cheaper.

Answer

Stream logs to an S3 bucket using Kinesis, then use S3 Lifecycle policies to transition logs to S3 Standard-IA after 90 days.

Answer

Set a retention policy on the CloudWatch Logs log group to 7 years and use CloudWatch Logs Insights for queries.

Answer

Set a retention policy on the CloudWatch Logs log group to 7 years and use CloudWatch Logs lifecycle policies to transition to Amazon S3 Glacier.