SCS-C02 Security Logging and Monitoring Practice Test 20 — 15 Questions

Question 1

A security engineer is investigating a potential security incident. CloudTrail logs show that an IAM user 'admin' deleted an S3 bucket at 2023-01-15T10:30:00Z. The engineer needs to find the source IP address and user agent of the request. Which CloudTrail log field contains this information?

Accepted Answer

userAgent and sourceIPAddress. Option B is correct because the user agent is stored in the userAgent field and the source IP in sourceIPAddress. Option A is wrong because eventID is a unique identifier. Option C is wrong because requestParameters contains API parameters. Option D is wrong because resources contains ARNs of affected resources.

Answer

eventID

Answer

requestParameters

Answer

resources

Question 2

A company uses Amazon GuardDuty to detect threats. The security team wants to receive real-time notifications for all GuardDuty findings with a severity of HIGH or CRITICAL. What is the MOST efficient way to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches GuardDuty findings with severity HIGH or CRITICAL and targets an SNS topic.. Option C is correct because GuardDuty can send findings to CloudWatch Events, which can then trigger an SNS notification based on severity. Option A is wrong because GuardDuty findings are not sent to S3 directly. Option B is wrong because GuardDuty does not have a built-in notification feature. Option D is wrong because CloudWatch Logs does not parse GuardDuty findings natively.

Answer

Use the GuardDuty console to set up email alerts for high-severity findings.

Answer

Configure GuardDuty to export findings to an S3 bucket and use S3 event notifications to trigger an SNS topic.

Answer

Stream GuardDuty findings to CloudWatch Logs and create a metric filter to trigger an alarm.

Question 3

A company has a multi-account AWS environment using AWS Organizations. The security team wants to ensure that all API activity across all accounts is logged and immutable. CloudTrail is enabled in all accounts, but the logs are stored in individual account buckets. The team wants to centralize logs and prevent any account from disabling logging. What should they do?

Accepted Answer

Apply an SCP to deny cloudtrail:StopLogging and cloudtrail:DeleteTrail, and create an organization trail that delivers logs to a central S3 bucket with a bucket policy that prevents deletion.. Option D is correct because using an SCP to deny cloudtrail:StopLogging and cloudtrail:DeleteTrail prevents disabling, and creating an organization trail ensures logs are delivered to a central bucket. Option A is wrong because an organization trail already covers all accounts. Option B is wrong because S3 MFA Delete alone doesn't prevent CloudTrail disabling. Option C is wrong because CloudWatch Logs doesn't provide immutable storage.

Answer

Create a new CloudTrail trail for each account and configure S3 bucket policies to allow cross-account access.

Answer

Enable S3 MFA Delete on each account's log bucket and require MFA for IAM users.

Answer

Use CloudWatch Logs to aggregate logs and set a retention policy of 10 years.

Question 4

A company uses Amazon RDS for MySQL and wants to monitor database activity for suspicious queries. The security team needs to capture all SQL statements executed against the database, including SELECT queries. Which AWS service should they use?

Accepted Answer

Amazon RDS Enhanced Monitoring with database audit logs enabled and streamed to CloudWatch Logs.. Option A is correct because Amazon RDS supports Enhanced Monitoring for OS metrics and publishes audit logs to CloudWatch Logs when the audit log option is enabled. Option B is wrong because CloudTrail logs API calls to the RDS service, not SQL queries. Option C is wrong because VPC Flow Logs capture network traffic. Option D is wrong because AWS Config records resource configuration changes.

Answer

AWS CloudTrail with data events enabled for RDS.

Answer

AWS Config with a custom rule to log database queries.

Answer

VPC Flow Logs to capture database traffic.

Question 5

A security engineer is reviewing CloudTrail logs and notices an event with the key 'eventType' set to 'AwsServiceEvent'. What does this indicate?

Accepted Answer

The event was initiated by an AWS service.. Option B is correct because AwsServiceEvent indicates the event was initiated by an AWS service on behalf of the customer. Option A is wrong because that would be AwsApiCall. Option C is wrong because that would be AwsConsoleSignin. Option D is wrong because AwsServiceEvent is a valid event type.

Answer

The event was initiated by an IAM user via the AWS Management Console.

Answer

The event was a sign-in event from the AWS Management Console.

Answer

The event type is an error in the log.

Question 6

A company uses Amazon S3 to store sensitive data. The security team wants to detect when objects are made publicly accessible. Which combination of services provides the MOST comprehensive detection with minimal false positives?

Accepted Answer

Enable S3 Block Public Access at the account level and use AWS Config rules to detect public ACLs and bucket policies.. Option D is correct because S3 Block Public Access prevents public access at the account level, and AWS Config rules can detect public ACLs and policies. Option A is wrong because CloudTrail alone cannot detect public access, only API calls. Option B is wrong because GuardDuty does not detect public S3 objects by default. Option C is wrong because Macie is for sensitive data discovery, not public access detection.

Answer

Use Amazon Macie to scan S3 buckets for publicly accessible objects.

Answer

Enable CloudTrail data events for S3 and create a CloudWatch Events rule for PutBucketAcl calls.

Answer

Enable Amazon GuardDuty and review the S3 findings for public access.

Question 7

Which TWO AWS services can be used to centrally collect and analyze logs from multiple AWS accounts? (Choose two.)

Accepted Answer

Amazon CloudWatch Logs. Option A is correct because Amazon S3 can serve as a central log repository. Option C is correct because Amazon CloudWatch Logs can aggregate logs from multiple accounts using cross-account subscriptions. Option B is wrong because Amazon Athena is a query service, not a collector. Option D is wrong because AWS CloudTrail is a log generator, not a central collector. Option E is wrong because Amazon Kinesis Data Firehose is a delivery service, not a storage/analysis service.

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Firehose

Answer

Amazon Athena

Question 8

Which TWO actions should a security engineer take to ensure that CloudTrail logs are protected from unauthorized deletion? (Choose two.)

Accepted Answer

Attach an S3 bucket policy that denies s3:DeleteObject to all principals except the CloudTrail service principal.. Option A is correct because enabling S3 MFA Delete requires MFA to delete objects. Option D is correct because a bucket policy denying s3:DeleteObject for all principals except the CloudTrail service ensures only CloudTrail can delete (which is rare). Option B is wrong because enabling SSE-S3 protects data at rest but not deletion. Option C is wrong because logging to CloudWatch does not prevent deletion. Option E is wrong because versioning alone does not prevent deletion (delete markers can be created).

Answer

Enable S3 versioning on the log bucket.

Answer

Enable S3 default encryption with SSE-S3.

Answer

Configure CloudTrail to send logs to CloudWatch Logs.

Question 9

Which THREE AWS services can be used to detect and alert on suspicious network traffic patterns? (Choose three.)

Accepted Answer

AWS Network Firewall. AWS Network Firewall is correct because it is a managed firewall service that can inspect network traffic at the VPC level using stateful and stateless rules. It can detect suspicious patterns such as port scans, malicious IP addresses, or protocol anomalies and generate alerts via Amazon CloudWatch metrics and logs, enabling real-time notification of suspicious network traffic.

Answer

AWS Systems Manager

Answer

AWS CloudTrail

Question 10

A financial services company has a production AWS account with hundreds of EC2 instances running a mix of Linux and Windows workloads. The security team is responsible for detecting and responding to security incidents. They have enabled CloudTrail, VPC Flow Logs, and GuardDuty. Recently, GuardDuty generated a finding indicating that an EC2 instance is communicating with a known malicious IP address. The security engineer needs to investigate the incident. The engineer examines the GuardDuty finding and sees the affected resource is an EC2 instance ID. The engineer wants to identify which user or role launched the instance and what security groups were associated with it at launch time. Which approach should the engineer take to gather this information?

Accepted Answer

Search CloudTrail logs for the RunInstances event that created the instance, using the instance ID to filter.. Option A is correct because CloudTrail logs the RunInstances API call which includes the user identity, instance ID, and security group IDs. Option B is wrong because AWS Config records the configuration but not the user who launched it. Option C is wrong because EC2 console does not provide historical launch details. Option D is wrong because Systems Manager Inventory does not track launch user or initial security groups.

Answer

Log in to the EC2 console and view the instance details under the 'Security' tab.

Answer

Use AWS Systems Manager Inventory to collect metadata about the instance.

Answer

Use AWS Config to view the configuration history of the EC2 instance and check the security group changes.

Question 11

A company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group, and an RDS MySQL database. The security team wants to monitor for SQL injection attempts. They have enabled AWS WAF on the ALB and are logging all requests. The security engineer needs to analyze the WAF logs to identify if any SQL injection attacks have been attempted. The logs are stored in an S3 bucket. The engineer needs to query the logs for patterns like 'SELECT * FROM' or 'DROP TABLE' in the URI. Which service should the engineer use to perform this analysis?

Accepted Answer

Amazon Athena. Option B is correct because Amazon Athena can query WAF logs stored in S3 using SQL. Option A is wrong because CloudWatch Logs Insights works with CloudWatch Logs, not S3. Option C is wrong because QuickSight is for visualization, not direct querying. Option D is wrong because Kinesis Data Analytics is for real-time streaming, not static S3 logs.

Answer

Amazon Kinesis Data Analytics

Answer

Amazon QuickSight

Answer

CloudWatch Logs Insights

Question 12

A company uses AWS Organizations to manage multiple accounts. The security team needs to implement a centralized logging solution where all VPC Flow Logs from all accounts are sent to a central S3 bucket in the security account. The flow logs must be encrypted with a customer-managed KMS key (CMK) that is owned by the security account. The security engineer has enabled VPC Flow Logs in each account and configured the destination to be the central S3 bucket. However, the flow logs are not being delivered. The engineer checks the S3 bucket policy and confirms that it grants the required permissions to the Flow Logs service principal. What is the MOST likely cause of the failure?

Accepted Answer

The KMS key policy does not grant the Flow Logs service principal permission to use the key.. Option C is correct because the KMS key policy must grant the Flow Logs service principal permission to use the key for encryption. Option A is wrong because VPC Flow Logs can write to cross-account buckets. Option B is wrong because the bucket policy is already set. Option D is wrong because CloudTrail is not involved in Flow Logs delivery.

Answer

The VPC Flow Logs service does not support cross-account delivery.

Answer

CloudTrail must be enabled in the source account for Flow Logs to work.

Answer

The S3 bucket policy is missing a condition for source account.

Question 13

A security engineer notices that CloudTrail logs for a production account are not being delivered to the S3 bucket. The bucket policy allows CloudTrail to write objects. What is the MOST likely cause?

Accepted Answer

The bucket policy does not grant s3:GetBucketAcl to CloudTrail.. Option C is correct because CloudTrail requires specific permissions including s3:GetBucketAcl to verify bucket ownership. Option A is wrong because SSE-S3 is supported. Option B is wrong because S3 versioning is not required. Option D is wrong because CloudTrail can handle existing objects.

Answer

The S3 bucket does not have versioning enabled.

Answer

The S3 bucket uses SSE-KMS encryption.

Answer

The S3 bucket contains existing objects before CloudTrail delivery started.

Question 14

A company wants to monitor AWS API calls for suspicious activity and automatically remediate by revoking IAM roles in real time. Which combination of services should be used?

Accepted Answer

Amazon CloudWatch Events and AWS Lambda. Option A is correct because CloudWatch Events (now Amazon EventBridge) can trigger a Lambda function upon API call patterns, and Lambda can revoke permissions. Option B is wrong because GuardDuty does not directly trigger remediation. Option C is wrong because Config records resource changes but not real-time API calls. Option D is wrong because CloudTrail alone cannot automate remediation.

Answer

AWS CloudTrail and Amazon Inspector

Answer

AWS CloudTrail and AWS Config

Answer

Amazon GuardDuty and AWS Config

Question 15

A security team needs to audit all changes to IAM policies in their AWS account. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. Option B is correct because AWS CloudTrail records all API calls including IAM policy changes. Option A is wrong because AWS Config records resource state but not API calls. Option C is wrong because CloudWatch is for metrics and alarms. Option D is wrong because IAM Access Analyzer finds external access, not change history.

Answer

AWS Config

Answer

Amazon CloudWatch

Answer

IAM Access Analyzer