SCS-C02 Security Logging and Monitoring Practice Test 2 — 15 Questions

Question 1

A company is designing a centralized logging solution for VPC Flow Logs across multiple AWS accounts. The solution must meet the following requirements: - Centralized storage in an S3 bucket in the security account. - Real-time analysis of flow logs. - Minimal operational overhead. Which TWO actions should the company take? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Organizations to enable VPC Flow Logs in all accounts and deliver to a central S3 bucket.. Option A is correct because AWS Organizations allows you to centrally enable VPC Flow Logs across all member accounts and configure them to deliver directly to a central S3 bucket in the security account, satisfying centralized storage with minimal operational overhead. Option C is correct because Amazon Kinesis Data Firehose can deliver VPC Flow Logs to the central S3 bucket and supports real-time analysis by streaming data to destinations such as Amazon OpenSearch Service or Splunk, meeting the real-time analysis requirement. Option B is incorrect because a VPC Flow Log subscription is created per VPC (or per ENI/subnet), not in a single security account that can capture logs from all VPCs across accounts. Option D is incorrect because CloudWatch Logs subscription filters stream logs to a destination like Kinesis or Lambda, not directly to a central S3 bucket, and would require additional configuration in every account. Option E is incorrect because S3 replication copies objects between buckets but does not enable VPC Flow Logs or provide real-time analysis, adding operational overhead.

Answer

Create a single VPC Flow Log subscription in the security account that captures logs from all VPCs.

Answer

Create a CloudWatch Logs subscription filter in each account to stream logs to the security account.

Answer

Configure S3 replication from each account's bucket to the central bucket.

Question 2

A company is using Amazon GuardDuty to detect threats. The security team wants to receive alerts for specific findings. Which TWO AWS services can be used to forward GuardDuty findings to a custom application for analysis? (Choose two.)

Accepted Answer

Amazon CloudWatch Events (Amazon EventBridge). Amazon GuardDuty can publish findings to Amazon CloudWatch Events (now part of Amazon EventBridge) as events. These events can then be routed to a custom application via targets like AWS Lambda, SQS, or Kinesis, enabling real-time analysis and alerting. This is the primary, native integration for forwarding GuardDuty findings to downstream systems.

Answer

Amazon Kinesis Data Streams

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Lambda

Question 3

A company uses AWS WAF to protect a web application. The security team needs to analyze blocked requests to identify attack patterns. Which service should be used to query and visualize WAF logs?

Accepted Answer

Amazon Athena. Amazon Athena is the correct service because it allows you to query AWS WAF logs stored in Amazon S3 directly using standard SQL. WAF logs are not natively indexed for real-time querying like CloudWatch Logs, but Athena's serverless query engine can efficiently analyze large volumes of these logs for attack pattern identification. Combined with Amazon QuickSight for visualization, Athena provides a cost-effective and scalable solution for ad-hoc log analysis.

Answer

Amazon CloudWatch Logs Insights

Answer

Amazon QuickSight

Answer

AWS WAF console

Question 4

Refer to the exhibit. A security engineer created this S3 bucket policy to allow CloudTrail to deliver logs. However, log delivery is failing. What is the most likely cause?

Accepted Answer

The bucket policy does not allow s3:GetBucketAcl. CloudTrail requires the S3 bucket policy to grant the `s3:GetBucketAcl` permission to the CloudTrail service principal (`cloudtrail.amazonaws.com`) so that it can verify the bucket's ACL before delivering logs. Without this permission, CloudTrail cannot confirm it has write access, causing log delivery to fail. The missing `s3:GetBucketAcl` action is the most likely cause because the policy must explicitly allow both `s3:PutObject` and `s3:GetBucketAcl` for the service to function.

Answer

The bucket is not in the same region as the trail

Answer

The bucket policy does not specify a condition

Answer

The bucket is encrypted with SSE-KMS

Question 5

Refer to the exhibit. A security engineer creates this CloudWatch Logs metric filter on a CloudTrail log group to detect root account usage. However, no metrics are generated. What is the most likely issue?

Accepted Answer

The metric filter pattern is incorrectly formatted. The most likely issue is that the metric filter pattern is incorrectly formatted. CloudWatch Logs metric filters require a valid JSON pattern that matches the log event structure. For detecting root account usage, the pattern must correctly reference the `userIdentity.type` field as `Root`. If the pattern syntax is wrong (e.g., missing quotes, incorrect key path, or invalid JSON), no metrics will be generated even if the log group and CloudTrail are properly configured.

Answer

The log group does not exist

Answer

CloudTrail is not enabled for the account

Answer

The metric namespace is invalid

Question 6

A security engineer is designing a monitoring solution for an AWS Lambda function that processes sensitive data. The function occasionally fails due to timeouts. The engineer needs to be alerted immediately when the function fails and also wants to analyze the error logs. Which combination of services should the engineer use?

Accepted Answer

Amazon CloudWatch Logs and CloudWatch Alarms with Amazon SNS. Amazon CloudWatch Logs captures the Lambda function's execution logs, including timeout errors, and CloudWatch Alarms can monitor specific metrics like `Errors` or `Throttles` for the function. When the alarm state is triggered (e.g., `ALARM`), it publishes a notification to an Amazon SNS topic, which can send immediate alerts via email, SMS, or other endpoints. This combination provides both real-time alerting and log analysis for troubleshooting.

Answer

Amazon CloudWatch Logs and Amazon Kinesis Data Firehose

Answer

AWS CloudTrail and Amazon SNS

Answer

AWS Config and Amazon SNS

Question 7

A company has a multi-account AWS environment using AWS Organizations. The security team wants to centralize all CloudTrail logs from all accounts into a single S3 bucket in the management account. The bucket policy allows cross-account access. However, logs from member accounts are not being delivered. What is the most likely cause?

Accepted Answer

The S3 bucket policy does not grant `s3:PutObject` permission to the member accounts.. The S3 bucket policy must explicitly grant the `s3:PutObject` permission to the IAM roles or users from the member accounts that CloudTrail uses to deliver logs. Without this permission, CloudTrail in the member accounts cannot write log files to the central bucket, even if the bucket is configured for cross-account access. The bucket policy must also include a condition that the object ownership is set to the bucket owner (via `s3:x-amz-acl: bucket-owner-full-control`) to ensure the management account retains control.

Answer

CloudTrail cannot deliver logs to a bucket in a different account.

Answer

The S3 bucket is not configured with a CloudTrail prefix.

Answer

CloudTrail is not enabled in the member accounts.

Question 8

A security engineer is configuring VPC Flow Logs for a VPC that hosts a web application. The engineer wants to capture all traffic to and from the internet. Which of the following is the most appropriate configuration?

Accepted Answer

Configure Flow Logs at the VPC level and set the traffic type to 'All'.. Configuring VPC Flow Logs at the VPC level with traffic type 'All' captures all network traffic across every subnet, including both accepted and rejected traffic to and from the internet. This ensures comprehensive visibility into internet-bound flows. Option A is incorrect because it does not specify the traffic type; without setting it to 'All', it may not capture both accepted and rejected traffic. Options B and D are incorrect because subnet-level logs are less comprehensive and their traffic types ('Reject' or 'Accepted') do not capture all traffic.

Answer

Configure Flow Logs at the VPC level and publish to CloudWatch Logs with a log group name.

Answer

Configure Flow Logs at the subnet level and set the traffic type to 'Reject'.

Answer

Configure Flow Logs at the subnet level and set the traffic type to 'Accepted'.

Question 9

An organization wants to detect and alert on any IAM user that creates a new access key without using multi-factor authentication (MFA). What is the MOST efficient way to achieve this?

Accepted Answer

Create a CloudWatch Events rule that triggers on CreateAccessKey events, and check if the user's MFA status is inactive.. CloudWatch Events (now Amazon EventBridge) can capture the CreateAccessKey API call in real time, and a Lambda target can check the IAM user's MFA status via the GetLoginProfile or ListMFADevices API. This provides immediate detection and alerting without polling or log analysis, making it the most efficient approach for this specific requirement.

Answer

Analyze S3 server access logs to detect access key creation.

Answer

Enable AWS Config managed rule for IAM user MFA, which monitors if users have MFA enabled.

Answer

Use IAM Access Analyzer to monitor for unused access keys.

Question 10

Refer to the exhibit. A security engineer ran this AWS CLI command to find when a specific CreateKeyPair API call was made. The command returns no results, even though the engineer knows the call was made. What is the MOST likely reason?

Accepted Answer

The --lookup-attributes parameter has incorrect syntax.. The `--lookup-attributes` parameter requires a JSON structure with an `AttributeKey` and `AttributeValue`. The provided syntax `--lookup-attributes EventName=CreateKeyPair` is invalid; the correct format is `--lookup-attributes AttributeKey=EventName,AttributeValue=CreateKeyPair`. This malformed parameter causes the AWS CLI to fail silently or return no results, even though the API call exists.

Answer

The time range is too narrow.

Answer

The command did not specify a region, so it defaults to us-east-1, but the call was made in a different region.

Answer

The event name should be 'CreateKeypair' (lowercase p).

Question 11

A DevOps engineer is configuring VPC Flow Logs for a subnet that contains a public-facing Application Load Balancer (ALB). The engineer wants to capture only accepted traffic for security analysis. What should the engineer do?

Accepted Answer

Create a flow log with a custom format that includes the 'action' field, and filter for 'ACCEPT'.. When creating a VPC Flow Log, you can specify a filter for traffic type: All, Accepted, or Rejected. To capture only accepted traffic, create a flow log with the filter set to 'ACCEPT'. Option D best represents this, as it says to create a flow log and filter for 'ACCEPT'. The custom format is not required but does not prevent correct configuration. Option A is a workaround that captures all traffic and then filters using CloudWatch Logs, which is unnecessary and less efficient.

Answer

Create a flow log and use a subscription filter in CloudWatch Logs to include only records with 'ACCEPT'.

Answer

Configure the security group to log only accepted traffic.

Answer

Use the default flow log format and filter at the S3 bucket using S3 Select.

Question 12

A company is designing a centralized logging solution for multiple AWS accounts. The logs must be encrypted at rest and in transit, and access must be audited. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Configure the S3 bucket policy to restrict PutObject to the CloudTrail service principal with a condition on aws:SourceArn.. Option C is correct because restricting PutObject in the central S3 bucket policy to the CloudTrail service principal with an aws:SourceArn condition ensures only the expected CloudTrail trail in the specified account can deliver logs, which enforces least privilege and supports auditable, tamper-resistant centralized logging. Option D is correct because using AWS KMS customer managed keys (CMKs) to encrypt the central S3 bucket provides encryption at rest with customer-controlled key policies and CloudTrail-auditable key usage, satisfying the encryption-at-rest requirement. Option A is not required because CloudWatch Logs subscriptions aggregate log streams, not the cross-account trail log files described by the S3 bucket policy and KMS controls, and it does not itself provide the S3 encryption-at-rest guarantee. Option B is not appropriate because S3 server access logs record requests to the bucket for auditing access, but they do not encrypt data at rest or in transit and are not the mechanism that secures log delivery. Option E is not necessary because VPC endpoints only keep traffic on the AWS network for supported services; they do not provide encryption at rest or the audited access control required here, and CloudTrail-to-S3 delivery is already encrypted in transit via HTTPS.

Answer

Configure cross-account CloudWatch Logs subscription to aggregate logs centrally.

Answer

Enable S3 server access logs on the central bucket for auditing.

Answer

Use VPC endpoints to ensure logs are transmitted over the AWS network.

Question 13

A company needs to ensure that all API calls made to AWS are logged and that the logs are immutable. Which TWO steps should be taken? (Choose TWO.)

Accepted Answer

Enable AWS CloudTrail in all regions.. Enabling AWS CloudTrail in all regions ensures that all management events across every region are logged, which is essential for comprehensive security monitoring and compliance. However, note that data events (e.g., S3 object-level operations) require explicit configuration in the trail. Option C is correct because storing CloudTrail logs in an S3 bucket with Object Lock enabled in Compliance mode prevents any user, including the root user, from deleting or overwriting log files, ensuring immutability. Together, these steps satisfy the requirement that all API calls are logged and the logs are immutable.

Answer

Enable CloudTrail log file validation.

Answer

Send CloudTrail logs to CloudWatch Logs with a retention policy.

Answer

Enable S3 versioning on the destination bucket.

Question 14

Refer to the exhibit. A security engineer configured the above bucket policy for CloudTrail log delivery. However, logs are not being delivered. What is the most likely cause?

Accepted Answer

The condition requires 'bucket-owner-full-control' ACL, but CloudTrail does not set this ACL when delivering to the same account.. When CloudTrail delivers logs to an S3 bucket in the same AWS account, it does not set the 'bucket-owner-full-control' canned ACL on the objects. The bucket policy condition requiring 's3:x-amz-acl': 'bucket-owner-full-control' will fail, as CloudTrail uses the default ACL (bucket-owner-full-control is only set for cross-account deliveries). This mismatch prevents log delivery.

Answer

The Action should be 's3:PutObjectAcl' instead of 's3:PutObject'.

Answer

The Principal is incorrect; it should be the CloudTrail service principal for the region.

Answer

The Resource ARN is missing the account ID in the path.

Question 15

Refer to the exhibit. A security analyst is reviewing a VPC Flow Log entry. The analyst wants to determine if this flow represents a potentially malicious RDP connection. Based on the log, which conclusion is most accurate?

Accepted Answer

The connection is likely an RDP connection disguised to evade detection.. The VPC Flow Log entry shows destination port 443 (HTTPS) and a TCP SYN flag (12), but the source port is 3389, which is the default port for RDP. This mismatch—RDP source port with HTTPS destination port—indicates the traffic is likely RDP traffic disguised as HTTPS to evade detection, as RDP typically uses port 3389 for both source and destination. The 'ACCEPT' field confirms the connection was allowed, so it is a potentially malicious RDP connection.

Answer

The connection is normal HTTPS traffic destined for the instance.

Answer

The connection was blocked by the security group.

Answer

The connection represents outbound traffic from the instance.