SCS-C02 Security Logging and Monitoring Practice Test 2 — 15 Questions

Question 1

A company runs a critical application on an Auto Scaling group of EC2 instances behind an Application Load Balancer. The security team enabled VPC Flow Logs, CloudTrail, and CloudWatch Logs for the application tier. Recently, they noticed that some EC2 instances are being terminated unexpectedly by an unknown IAM user. The CloudTrail logs show the TerminateInstances API call, but the source IP address is from within the VPC CIDR range. The security team suspects the action is coming from an EC2 instance that has been compromised. They need to identify the specific compromised instance and the IAM role it used. Which combination of steps will provide the necessary information? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Examine the CloudTrail event for TerminateInstances and note the 'userIdentity' field to identify the IAM role. Then use the 'sourceIPAddress' field to find the instance's private IP. Cross-reference with VPC Flow Logs to find the network interface with that IP at the time of the event.. CloudTrail provides the IAM role (userIdentity) and the source private IP (sourceIPAddress) for the TerminateInstances call. To identify the specific compromised instance, cross-reference the source IP with VPC Flow Logs to find the network interface (ENI) associated with that IP at the time of the event. Flow logs include the ENI ID, which can be mapped to an EC2 instance. Option A is not a reliable method because VPC Flow Logs capture network traffic but do not indicate which API call a flow corresponds to; you cannot determine 'the source IP that made the API call' from flow logs alone without the CloudTrail timestamp and destination IP. Therefore, only B is a correct step.

Answer

Review the VPC Flow Logs for any traffic to the EC2 API endpoint. Look for the source IP that made the API call. Then use that IP to find the instance in the EC2 console. Check the IAM role attached to that instance.

Answer

Use AWS Config to find all EC2 instances that were terminated around that time. Then check the CloudTrail event for the IAM role. Finally, use the instance ID from the termination event to identify the source.

Answer

Check the CloudWatch Logs for the Auto Scaling group to find any error messages around the termination time. Correlate with the CloudTrail event to identify the IAM role. Then use the EC2 console to list all instances and check their IAM roles manually.

Question 2

Drag and drop the steps to set up AWS Shield Advanced with automatic application layer DDoS mitigation in the correct order.

Accepted Answer

Step 1: Subscribe to AWS Shield Advanced. Step 2: Add protection to AWS resources. Step 3: Integrate with AWS WAF and create a mitigation rule. Step 4: Enable health-based detection.. Shield Advanced requires subscription first, then resource protection, WAF integration, mitigation rule, and health-based detection.

Answer

Step 1: Add protection to AWS resources. Step 2: Subscribe to AWS Shield Advanced. Step 3: Integrate with AWS WAF and create a mitigation rule. Step 4: Enable health-based detection.

Answer

Step 1: Subscribe to AWS Shield Advanced. Step 2: Integrate with AWS WAF and create a mitigation rule. Step 3: Add protection to AWS resources. Step 4: Enable health-based detection.

Answer

Step 1: Subscribe to AWS Shield Advanced. Step 2: Add protection to AWS resources. Step 3: Enable health-based detection. Step 4: Integrate with AWS WAF and create a mitigation rule.

Question 3

Drag and drop the steps to respond to a suspected AWS IAM credential compromise in the correct order.

Accepted Answer

Rotate IAM user access keys, then review CloudTrail logs, then disable the IAM user, then revoke temporary credentials, then notify stakeholders.. Credential compromise response starts with rotation, log review, disabling user, revoking temp creds, and notification.

Answer

Review CloudTrail logs, then rotate IAM user access keys, then disable the IAM user, then revoke temporary credentials, then notify stakeholders.

Answer

Disable the IAM user, then rotate IAM user access keys, then review CloudTrail logs, then revoke temporary credentials, then notify stakeholders.

Answer

Notify stakeholders, then rotate IAM user access keys, then review CloudTrail logs, then disable the IAM user, then revoke temporary credentials.

Question 4

Match each AWS CloudTrail log type to its description.

Accepted Answer

Management events: Records management operations performed on AWS resources, such as creating or deleting VPCs.. CloudTrail has three main log types: Management events (control plane, logged by default), Data events (data plane, optional), and Insight events (anomaly detection, optional). Common confusions include swapping management vs data definitions, or misunderstanding insight events as real-time logs.

Answer

Management events: Records resource operations performed on or within a resource, such as reading or writing S3 objects.

Answer

Insight events: Records all API calls made in your account in real-time.

Question 5

A security engineer is troubleshooting an issue where Amazon GuardDuty is not generating findings for a specific EC2 instance that is known to be compromised. The instance is in a VPC with VPC Flow Logs enabled. What could be the reason for the lack of findings?

Accepted Answer

VPC Flow Logs are not being delivered to CloudWatch Logs.. GuardDuty relies on VPC Flow Logs as a data source to analyze network traffic for threats. If VPC Flow Logs are not being delivered to CloudWatch Logs, GuardDuty cannot ingest the flow data, and therefore cannot generate findings for that EC2 instance, even if the instance is compromised.

Answer

CloudTrail is not enabled in the account.

Answer

AWS Config is not enabled for the EC2 instance.

Answer

VPC Flow Logs are only enabled for the subnet, not the instance's ENI.

Question 6

A security engineer is investigating a potential security incident involving an EC2 instance that was used to launch an outbound DDoS attack. The engineer needs to determine the source of the attack and the commands executed on the instance. Which logs should be analyzed?

Accepted Answer

EC2 instance OS logs (e.g., /var/log/secure) and CloudTrail logs for API calls that launched the instance. The EC2 instance's OS logs (e.g., auditd logs, bash history) contain the exact commands executed and user authentication events, which are essential for identifying the source and actions of the attacker. CloudTrail logs for API calls that launched the instance provide the identity of the principal (IAM user/role), source IP, and the time the instance was created, linking the instance to the initiating entity. Together, these logs allow the engineer to trace both the operational commands on the instance and the administrative actions that created it.

Answer

VPC Flow Logs and Network ACL logs

Answer

S3 server access logs and CloudWatch Logs

Answer

AWS CloudTrail and AWS Config history

Question 7

A company wants to detect and alert on suspicious IAM user behavior, such as accessing services that are not typically used. Which AWS service provides prebuilt anomaly detection for IAM users?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is the correct answer because it is a threat detection service that uses machine learning and anomaly detection to identify suspicious IAM user behavior, such as accessing services not typically used. It analyzes AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs to establish baselines and generate findings for unusual API calls or access patterns. This prebuilt capability directly addresses the requirement for detecting atypical IAM activity without manual configuration.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 8

A company has enabled AWS CloudTrail in all regions and is delivering logs to a central S3 bucket. The security team needs to ensure that any attempt to delete or modify CloudTrail logs is detected and alerted. What should be done?

Accepted Answer

Enable S3 server access logging on the bucket and monitor for DELETE requests.. Enabling S3 server access logging on the bucket directly records all requests, including DELETE operations, providing the data needed to detect and alert on unauthorized attempts to delete or modify CloudTrail logs. By integrating these logs with monitoring services (e.g., Amazon CloudWatch, AWS Lambda), the security team can meet the explicit requirement for detection and alerting. While options B, C, and D prevent deletion or modification, they do not inherently provide detection or alerting mechanisms. Therefore, option A is the most direct and correct solution.

Answer

Enable S3 Object Lock in governance mode on the bucket.

Answer

Enable MFA Delete on the S3 bucket.

Answer

Use a bucket policy that denies s3:DeleteObject for all principals.

Question 9

A company is using Amazon CloudWatch Logs to collect application logs. The security team wants to detect patterns that indicate security threats, such as multiple failed login attempts. Which TWO services can be used together to perform real-time log analysis and alerting?

Accepted Answer

Amazon OpenSearch Service. Amazon OpenSearch Service (option B) is correct because it provides a powerful search and analytics engine that can ingest CloudWatch Logs in real time via a subscription filter or a Lambda function, enabling the security team to query for patterns like multiple failed login attempts using OpenSearch Dashboards. AWS Lambda (option C) is correct because it can be triggered by CloudWatch Logs subscription filters to process log events in real time, perform custom pattern detection (e.g., counting failed logins per source IP), and then send alerts via Amazon SNS or other services. Together, they form a serverless, real-time log analysis and alerting pipeline.

Answer

Amazon Kinesis Data Analytics

Answer

AWS Glue

Answer

Amazon Athena

Question 10

A company uses AWS Organizations and wants to enforce that all member accounts enable VPC Flow Logs for all VPCs. Which THREE services or features should be used to enforce this policy automatically?

Accepted Answer

AWS Organizations Service Control Policies (SCPs). AWS Organizations Service Control Policies (SCPs) can be used to prevent member accounts from disabling VPC Flow Logs or from creating VPCs without a specific tag that triggers auto-remediation, but SCPs alone cannot directly enforce that VPC Flow Logs are enabled at VPC creation because flow logs are created as a separate resource. To automatically enforce the policy across all accounts and regions, you need AWS CloudFormation StackSets to deploy VPC Flow Log configurations (log group, IAM role, flow log resource) to each member account. AWS Config Conformance Packs provide a collection of AWS Config rules and remediation actions that continuously evaluate existing VPCs and automatically enable flow logs on non-compliant VPCs via AWS Systems Manager Automation or Lambda. Together, SCPs prevent tampering, StackSets ensure initial deployment, and Conformance Packs maintain compliance.

Answer

AWS Service Catalog

Answer

AWS CloudTrail

Question 11

A security engineer is setting up monitoring for AWS API calls. Which TWO AWS services can be used to capture and analyze API activity?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs can capture and analyze API activity by ingesting log data from various AWS services, including AWS CloudTrail. You can configure CloudWatch Logs to monitor API calls in real time, set up metric filters to detect specific patterns, and trigger alarms based on API activity. This makes it a valid service for capturing and analyzing API calls, especially when combined with CloudTrail for detailed event records.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 12

A company uses AWS Config to track resource changes. They notice that a weekly compliance report shows an S3 bucket as non-compliant with a rule that checks for server-side encryption. However, the bucket has default encryption enabled. What is the MOST likely reason for this discrepancy?

Accepted Answer

The Config rule checks for SSE on objects, not default bucket encryption.. The AWS Config managed rule `s3-bucket-server-side-encryption-enabled` specifically checks whether the bucket policy enforces server-side encryption on objects uploaded to the bucket, not whether the bucket has default encryption configured. Default encryption only applies to objects that do not have an encryption setting at the time of upload, but the rule evaluates the bucket's policy for a condition that requires SSE for all PUT requests. Therefore, a bucket with default encryption enabled but without a policy enforcing SSE will be reported as non-compliant.

Answer

The Config rule was deleted and recreated without re-evaluating existing resources.

Answer

The Config rule is only evaluating resources in a single AWS Region.

Answer

The S3 bucket is not tagged with a required tag for the Config rule.

Question 13

A company wants to centrally collect VPC Flow Logs from multiple accounts into a single S3 bucket in the security account. Which solution is the MOST operationally efficient?

Accepted Answer

Log in to each account and configure VPC Flow Logs to deliver to the central S3 bucket.. VPC Flow Logs can be delivered directly to an S3 bucket in another account by configuring the flow log with the destination bucket ARN and ensuring the bucket policy grants write permissions to the flow log service. This eliminates the need for Lambda processing, S3 replication, or any unsupported central management feature. Configuring each account's VPC Flow Logs to deliver directly to the central S3 bucket is the simplest and most operationally efficient approach.

Answer

Use CloudWatch Logs to stream flow logs to a Lambda function that writes to S3.

Answer

Configure each account's VPC Flow Logs to a local S3 bucket, then use S3 replication to copy to the central bucket.

Answer

Use AWS Organizations to centrally enable VPC Flow Logs in all accounts and deliver to the central S3 bucket.

Question 14

A security team needs to be alerted when an IAM user generates a console login failure. Which combination of AWS services should be used to meet this requirement?

Accepted Answer

CloudTrail, Amazon CloudWatch Logs, and CloudWatch Alarms. CloudTrail captures IAM console login failures as CloudTrail events, which can be streamed to CloudWatch Logs. A CloudWatch Alarm can then be configured to trigger on a metric filter that matches the specific 'ConsoleLogin' event with a 'Failure' status, enabling real-time alerting via Amazon SNS.

Answer

CloudTrail and Amazon S3

Answer

AWS Config and Amazon SNS

Answer

Amazon GuardDuty and AWS Lambda

Question 15

A security engineer needs to ensure that all S3 buckets in an AWS account have server access logging enabled. Which AWS service should be used to continuously monitor for compliance?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of your AWS resource configurations against desired policies. You can create an AWS Config rule, such as the managed rule 's3-bucket-server-access-logging-enabled', which will automatically check all S3 buckets in your account and report any that do not have server access logging enabled, flagging them as noncompliant. This allows for ongoing, automated compliance auditing without manual intervention.

Answer

Amazon GuardDuty

Answer

AWS IAM Access Analyzer

Answer

AWS CloudTrail