SCS-C02 Security Logging and Monitoring Practice Test 20 — 15 Questions

Question 1

A company is using Amazon CloudWatch Logs to store application logs. The security team needs to ensure that logs are encrypted at rest using a customer-managed KMS key (CMK). What configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Associate the CMK with the CloudWatch Logs log group by specifying the key ARN in the log group's encryption configuration.. CloudWatch Logs supports server-side encryption with a customer-managed KMS key (CMK) by associating the key ARN with the log group. This is done via the CloudWatch Logs console, AWS CLI, or SDK using the `associate-kms-key` operation, which encrypts all log data at rest within that log group. The KMS key policy must also grant the CloudWatch Logs service principal (`logs.region.amazonaws.com`) permission to use the key, but the core configuration step is associating the key with the log group.

Answer

Add a KMS key policy that allows CloudWatch Logs to use the key.

Answer

Enable default encryption on the S3 bucket used for log export with a CMK.

Answer

Configure the S3 bucket policy to require SSE-KMS for log delivery.

Question 2

A security engineer is configuring Amazon Inspector to assess EC2 instances for software vulnerabilities. The engineer has installed the SSM Agent on all instances and ensured that the instances have internet access. However, Amazon Inspector shows the instances as 'Unmanaged'. What is the MOST likely cause?

Accepted Answer

The SSM Agent is not running or is not registered with AWS Systems Manager.. Amazon Inspector requires EC2 instances to be managed by AWS Systems Manager (SSM) to install the SSM Agent and register it with the Systems Manager service. If the SSM Agent is not running or not registered, the instance cannot communicate with Systems Manager, and Inspector will report it as 'Unmanaged'. Even with internet access and the agent installed, the agent must be actively running and registered for the instance to be properly managed.

Answer

The IAM role attached to the EC2 instance does not have permissions to publish metrics to CloudWatch.

Answer

The security group attached to the instance blocks outbound traffic to the Amazon Inspector service.

Answer

The instance does not have the EC2 instance metadata service enabled.

Question 3

A company uses AWS CloudTrail to log management events. The security team wants to be alerted when an IAM user creates a new access key. Which solution would meet this requirement with the least operational overhead?

Accepted Answer

Create an Amazon EventBridge rule that matches the CreateAccessKey event and triggers an Amazon SNS notification.. Amazon EventBridge can directly capture CloudTrail API calls (like CreateAccessKey) as events and route them to an SNS topic for notification, requiring no custom code or polling. This serverless, event-driven approach minimizes operational overhead by eliminating the need to manage log groups, metric filters, or scheduled scripts.

Answer

Create a CloudWatch Logs metric filter on the CloudTrail log group for CreateAccessKey events and set an alarm.

Answer

Write a Python script that uses the CloudTrail LookupEvents API and run it on a scheduled basis using Amazon EventBridge Scheduler.

Answer

Develop a custom AWS Lambda function that queries CloudTrail logs in S3 every hour.

Question 4

A company wants to detect and respond to potential security threats in near real-time. Which THREE AWS services should the company use together? (Select THREE.)

Accepted Answer

AWS Security Hub. AWS Security Hub (A) aggregates security findings from multiple AWS services, including Amazon GuardDuty (E) and Amazon Detective (C), into a single dashboard. GuardDuty provides near real-time threat detection by analyzing VPC Flow Logs, DNS logs, and CloudTrail events using machine learning. Detective automates the investigation of those findings by correlating historical data to identify root causes. Together, these three services enable near real-time detection and response to security threats.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 5

A security engineer is investigating a potential data breach. The engineer wants to analyze historical API calls made by a specific IAM user. Which TWO AWS services can be used together to achieve this? (Select TWO.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records API activity across AWS accounts, including who made the call, the source IP address, and the time of the call. By enabling CloudTrail for the specific IAM user, the security engineer can retrieve a history of all API calls made by that user. CloudWatch Logs can then be used to store and query those CloudTrail logs for analysis, such as filtering by user ARN or event name.

Answer

S3 Server Access Logs

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs Insights

Question 6

A security engineer has attached the above IAM policy to a role used by an application to write logs to an S3 bucket. However, the application is unable to write logs. What is the MOST likely reason?

Accepted Answer

The application does not set the x-amz-acl header to bucket-owner-full-control on PutObject requests.. When an IAM policy grants PutObject access to an S3 bucket, the application must also include the `x-amz-acl: bucket-owner-full-control` header in its PutObject requests to ensure the bucket owner retains full control over the uploaded objects. Without this header, the object is owned by the writer (the role), and the bucket owner cannot manage it, causing the write to fail due to access control mismatches, especially in cross-account scenarios or when the bucket policy enforces specific ACLs.

Answer

The Effect is set to Allow, which is too permissive.

Answer

The policy does not allow server-side encryption.

Answer

The resource ARN is incorrect; it should be arn:aws:s3:::my-log-bucket/*.

Question 7

A security engineer needs to ensure that all S3 object-level API calls (e.g., GetObject, PutObject) on the bucket 'my-bucket' are logged. The current CloudTrail configuration is as shown in the exhibit. What change should the engineer make?

Accepted Answer

Change the data resource value to 'arn:aws:s3:::my-bucket/' to cover all objects.. To log all S3 object-level API calls (GetObject, PutObject, etc.) on the bucket 'my-bucket', the DataResources value must specify the bucket's ARN with a trailing slash (arn:aws:s3:::my-bucket/) to indicate all objects within the bucket. Without the trailing slash, CloudTrail interprets the ARN as referring to the bucket itself, not its objects, and thus object-level events are not captured. The trailing slash ensures the selector applies to all object keys under that bucket.

Answer

Remove the DataResources section and add an AdvancedEventSelector for S3.

Answer

Change the bucket ARN to 'arn:aws:s3:::my-bucket' without a trailing slash.

Answer

Enable management events by setting IncludeManagementEvents to true.

Question 8

A security engineer is configuring a multi-account CloudTrail setup. The above bucket policy is attached to the central logging bucket. Despite the policy, CloudTrail in the member account (123456789012) cannot deliver logs. What is the MOST likely issue?

Accepted Answer

The condition s3:x-amz-acl is not required; CloudTrail does not set that ACL.. CloudTrail does not set the s3:x-amz-acl condition key when delivering log files to S3. The bucket policy incorrectly includes this condition, which causes the S3 authorization to fail because the condition key is not present in the CloudTrail PutObject request. Removing the condition or adjusting the policy to not require it resolves the delivery failure.

Answer

The Principal should be the CloudTrail service principal of the member account.

Answer

The Action should be s3:PutObjectAcl instead of s3:PutObject.

Answer

The resource ARN must include the source account ID in the path.

Question 9

A security engineer notices that an Amazon S3 bucket has been accessed from an IP address outside the company's allowed range. The engineer needs to identify the IAM user who made the request. Which AWS service should be used to find this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS services, including S3 operations, and captures the identity of the IAM user or role that made the request. By examining CloudTrail logs, the security engineer can find the specific IAM user associated with the source IP address that accessed the bucket, as CloudTrail logs include both the user identity and the source IP address for each event.

Answer

S3 server access logs

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 10

A company uses AWS Organizations with multiple accounts. The security team wants to centralize the collection of VPC Flow Logs and AWS CloudTrail logs from all accounts into a single Amazon S3 bucket in the management account. The S3 bucket policy must allow cross-account log delivery. Which condition in the bucket policy should be used to restrict log delivery to only the organization's accounts?

Accepted Answer

aws:PrincipalOrgID. The correct condition key is `aws:PrincipalOrgID`, which restricts access to principals (accounts, IAM roles, or users) that are members of the specified AWS Organization. When used in a bucket policy, it ensures that only accounts within the company's organization can deliver logs to the S3 bucket, even if the source account ID changes. Note that `aws:SourceOrgId` is not a valid AWS condition key; `aws:PrincipalOrgID` is the appropriate key for this purpose.

Answer

aws:SourceArn

Answer

aws:SourceOrgId

Answer

aws:SourceAccount

Question 11

A security engineer is configuring Amazon GuardDuty in a multi-account environment using AWS Organizations. The engineer wants to ensure that all member accounts send findings to the delegated administrator account. However, some member accounts are not sending findings. What is the most likely cause?

Accepted Answer

GuardDuty is not enabled in the member accounts, or they have not accepted the invitation.. GuardDuty requires that each member account has the service explicitly enabled and has accepted the invitation from the delegated administrator account. Without these steps, the member accounts cannot send findings to the administrator, even if AWS Organizations is configured correctly. The delegated administrator can only manage findings from accounts that have completed the onboarding process.

Answer

The GuardDuty service-linked role is missing in the member accounts.

Answer

AWS CloudTrail is not enabled in the member accounts.

Answer

VPC Flow Logs are not enabled in the member accounts.

Question 12

A company wants to receive real-time notifications when specific API calls are made in their AWS account, such as creating a new IAM user. Which AWS service should be used to trigger a notification based on CloudTrail events?

Accepted Answer

Amazon EventBridge. Amazon EventBridge is the correct service because it can ingest CloudTrail events in near real-time and use event rules to match specific API calls, such as CreateUser, and then route those events to targets like SNS topics to send notifications. EventBridge provides a serverless event bus that directly integrates with CloudTrail, enabling you to react to API activity without custom polling or additional infrastructure.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon VPC Flow Logs

Question 13

A security engineer is investigating a potential security incident involving an EC2 instance. The engineer needs to capture network traffic to and from the instance for analysis. Which method should be used to capture this traffic without installing any software on the instance?

Accepted Answer

Use VPC Traffic Mirroring.. VPC Traffic Mirroring captures and inspects network traffic at the Elastic Network Interface (ENI) level without requiring any software installation on the EC2 instance. It copies traffic from a source ENI to a target, such as a Network Load Balancer or another ENI, for analysis by security appliances. This meets the requirement of capturing traffic without installing software on the instance.

Answer

Enable VPC Flow Logs for the subnet.

Answer

Configure AWS Network Firewall in the VPC.

Answer

Install the Amazon CloudWatch agent on the instance.

Question 14

A security engineer needs to monitor for unauthorized changes to security group rules in an AWS account. Which AWS service can evaluate security group rules against a desired configuration and alert on changes?

Accepted Answer

AWS Config. AWS Config is correct because it provides a managed rule called 'restricted-ssh' or custom rules using AWS Config managed rules or Lambda functions to evaluate security group rules against a desired configuration. When a security group rule is added, removed, or modified, AWS Config detects the configuration change, evaluates it against the defined rules, and can trigger an Amazon SNS notification to alert the security engineer. This makes AWS Config the appropriate service for continuous monitoring and alerting on unauthorized changes to security group rules.

Answer

AWS Security Hub

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 15

A company uses AWS CloudTrail and wants to ensure that all log files are encrypted at rest using a customer-managed AWS KMS key. The CloudTrail trail is configured to use a KMS key, but some log files appear to be encrypted with the default Amazon S3 managed key (SSE-S3). What is the most likely cause?

Accepted Answer

The KMS key policy does not grant CloudTrail permission to use the key.. The most likely cause is that the KMS key policy does not grant CloudTrail the necessary permissions to use the key for encryption. When a CloudTrail trail is configured with a customer-managed KMS key, the key policy must include a statement that allows the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the kms:GenerateDataKey and kms:Decrypt actions. Without these permissions, CloudTrail falls back to encrypting log files with the default Amazon S3 managed key (SSE-S3), resulting in some logs appearing encrypted with SSE-S3 instead of SSE-KMS.

Answer

The CloudTrail trail is configured to use SSE-S3 instead of SSE-KMS.

Answer

The KMS key is in a different AWS region than the S3 bucket.

Answer

The S3 bucket has default encryption set to SSE-S3.