SCS-C02 Security Logging and Monitoring Practice Test 21 — 15 Questions

Question 1

An organization wants to detect and alert on the use of root user credentials in their AWS accounts. They have multiple accounts managed via AWS Organizations. What is the most efficient way to centralize this monitoring?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Amazon GuardDuty in the management account and use the delegated administrator feature.. Amazon GuardDuty, when enabled in the management account with a delegated administrator, can centrally monitor and detect suspicious activity—including root user credential usage—across all member accounts in AWS Organizations. This approach eliminates the need to configure per-account monitoring and provides a single pane of glass for security alerts, making it the most efficient centralized solution.

Answer

Create an AWS CloudTrail trail in each account and aggregate logs to a central S3 bucket.

Answer

Use IAM Access Analyzer to find resources shared with external entities.

Answer

Use AWS Config rules to detect root user usage in each account.

Question 2

A security engineer is configuring logging for an application running on Amazon EC2 instances. The engineer needs to capture both operating system-level logs and application logs. Which TWO services can be used together to achieve this? (Choose two.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the correct service because it provides a centralized location to store, monitor, and access log files from your EC2 instances. The Amazon CloudWatch agent is the correct companion service because it is specifically designed to collect both operating system-level logs (e.g., syslog, Windows Event Log) and application logs from EC2 instances and send them to CloudWatch Logs. Together, they fulfill the requirement of capturing both OS and application logs.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

Amazon Inspector

Question 3

A security engineer is troubleshooting why CloudTrail is not delivering logs to an S3 bucket. The bucket policy allows CloudTrail to write objects, and the trail is configured with the correct bucket name. However, no log files appear. What is the most likely cause?

Accepted Answer

The S3 bucket uses AWS KMS server-side encryption (SSE-KMS) and the KMS key policy does not grant CloudTrail permission to use the key.. When CloudTrail is configured to deliver logs to an S3 bucket that uses SSE-KMS, CloudTrail must have explicit permission to use the KMS key for encrypting the log files. Even if the bucket policy allows CloudTrail to write objects, the KMS key policy must grant the `kms:GenerateDataKey` and `kms:Decrypt` actions to the CloudTrail service principal. Without these permissions, CloudTrail cannot encrypt the logs, and delivery fails silently—no log files appear.

Answer

The S3 bucket has an S3 Object Lock configuration that prevents writes.

Answer

The S3 bucket is in a different AWS Region from the trail.

Answer

CloudTrail is not enabled in the AWS Region where the S3 bucket resides.

Question 4

A company uses Amazon GuardDuty to monitor for threats. The security team receives a high-severity finding: 'UnauthorizedAccess:EC2/SSHBruteForce'. The finding indicates a single EC2 instance with a public IP is receiving SSH connection attempts from multiple external IPs. The instance is part of an Auto Scaling group and is fronted by an Application Load Balancer (ALB). The security team wants to block the attacking IPs without disrupting legitimate traffic. What is the MOST effective approach?

Accepted Answer

Modify the security group of the EC2 instance to deny inbound SSH from the attacking IPs.. Modifying the security group of the EC2 instance to deny inbound SSH from the attacking IPs directly blocks the SSH brute force attempts at the instance level. Since the instance is part of an Auto Scaling group, security group modifications will apply to all instances launched with that security group, and updates are immediate. Option D (AWS WAF on ALB) is ineffective because WAF only inspects HTTP/HTTPS traffic at Layer 7, while SSH traffic operates at Layer 4 and does not pass through the ALB; the ALB only handles HTTP/HTTPS, not SSH. The attackers are targeting the instance's public IP directly over SSH, not through the ALB. Therefore, WAF cannot block SSH traffic. Option A (stop instance) is disruptive and unnecessary. Option C (network ACL) would block traffic at the subnet level but would affect all instances in the subnet and is less granular than a security group.

Answer

Stop the EC2 instance and launch a new one in a different subnet.

Answer

Create a network ACL rule on the subnet to deny inbound traffic from the attacking IPs.

Answer

Configure AWS WAF on the ALB to block the attacking IPs using an IP set rule.

Question 5

A company wants to detect and alert on changes to IAM roles and policies in their AWS account. Which combination of AWS services should they use?

Accepted Answer

AWS CloudTrail and Amazon EventBridge (CloudWatch Events). AWS CloudTrail records all API calls, including changes to IAM roles and policies, and delivers log files to an S3 bucket or CloudWatch Logs. Amazon EventBridge (formerly CloudWatch Events) can then be used to create rules that match specific CloudTrail events (e.g., PutRolePolicy, CreateRole) and trigger alerts via SNS, Lambda, or other targets. This combination provides real-time detection and notification of IAM modifications.

Answer

Amazon GuardDuty and AWS Shield

Answer

Amazon CloudWatch Logs and AWS Lambda

Answer

AWS Config and Amazon Inspector

Question 6

A DevOps engineer notices that an EC2 instance's CloudWatch agent is not sending custom metrics to CloudWatch. The agent is installed and the configuration file is valid. The instance has an IAM role attached. What is the most likely reason for the failure?

Accepted Answer

The IAM role attached to the instance does not have the cloudwatch:PutMetricData permission.. The CloudWatch agent requires IAM permissions to publish custom metrics. Even if the agent is installed, running, and has a valid configuration, it will fail to send metrics if the attached IAM role lacks the `cloudwatch:PutMetricData` action. This is a common misconfiguration where the instance has an IAM role, but the role's policy does not explicitly grant the necessary CloudWatch write permissions.

Answer

The instance does not have internet access to reach CloudWatch endpoints.

Answer

The CloudWatch agent is not running as root.

Answer

The CloudWatch agent configuration file has a syntax error.

Question 7

A security team uses Amazon Macie to discover sensitive data in S3. They have configured Macie to run automated sensitive data discovery jobs. After reviewing the findings, they notice that some S3 objects containing personally identifiable information (PII) are not being flagged. What is the most likely cause?

Accepted Answer

The PII is in a format that Macie's managed data identifiers do not recognize, and no custom data identifier is configured.. Macie uses managed data identifiers to detect PII based on predefined patterns. If the PII in the S3 objects is in a format that does not match any of these managed identifiers (e.g., a non-standard date format or a custom ID number), and no custom data identifier has been configured to recognize that specific pattern, Macie will not flag the objects. This is the most likely cause given that the security team has already configured automated discovery jobs and other common issues like permissions or encryption are not preventing scanning.

Answer

The Macie service-linked role does not have permissions to read the objects.

Answer

The S3 bucket is in a different AWS Region than the Macie job.

Answer

The S3 objects are encrypted with SSE-S3.

Question 8

A company wants to centralize logs from multiple AWS accounts into a single S3 bucket for analysis. The accounts are part of an AWS Organizations organization. Which set of steps will accomplish this?

Accepted Answer

Create an organization trail in the management account with logging enabled for all accounts.. AWS Organizations allows you to create an organization trail from the management account. When you enable logging for all accounts in the organization, CloudTrail automatically creates a trail that applies to every account in the organization, delivering log files from all accounts to a single S3 bucket without needing per-account configuration.

Answer

Use AWS Config to aggregate logs from all accounts into a central S3 bucket.

Answer

Create a CloudTrail trail in each account and configure each to write to the same S3 bucket.

Answer

Set up Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket.

Question 9

A security engineer is investigating a potential data exfiltration incident. They see that an EC2 instance with an IAM role is making API calls to S3 to download objects. The IAM role has an S3 bucket policy that allows access from that role. However, CloudTrail logs show that the calls are being made from an IP address outside the company's network. What is the most likely explanation?

Accepted Answer

The IAM role credentials were stolen and are being used from an external machine.. The CloudTrail logs show the API calls originating from an IP address outside the company's network, which indicates that the IAM role credentials (temporary security credentials from the instance metadata) have been compromised and are being used from an external machine. The S3 bucket policy allows access from the IAM role, but the source IP in the logs is external, confirming the credentials are being used outside the EC2 instance.

Answer

The EC2 instance has a public IP and the calls are originating from the instance itself.

Answer

CloudTrail is logging the IP address of the AWS service endpoint, not the client.

Answer

The S3 bucket policy allows public access.

Question 10

A company uses AWS CloudTrail to log all API activity. They want to ensure that log files are tamper-proof and can be validated for forensic purposes. Which of the following should they enable?

Accepted Answer

CloudTrail log file integrity validation. CloudTrail log file integrity validation uses a SHA-256 hash chain to detect if log files have been modified, deleted, or altered after delivery. When enabled, CloudTrail delivers a digest file that includes the hash of each log file and the hash of the previous digest, creating an immutable chain that can be used to verify log integrity for forensic purposes.

Answer

AWS KMS server-side encryption on the S3 bucket

Answer

S3 bucket versioning

Answer

S3 Object Lock with governance mode

Question 11

A security analyst wants to receive a notification whenever a new security group is created in their AWS account. Which AWS service should they use to trigger an SNS notification based on the CloudTrail event?

Accepted Answer

Amazon EventBridge (CloudWatch Events). Amazon EventBridge (formerly CloudWatch Events) can monitor CloudTrail API calls in real time and trigger an SNS notification when a specific event, such as CreateSecurityGroup, occurs. By creating a rule that matches the event source and detail type, EventBridge evaluates incoming events and routes matching ones to an SNS topic, enabling the desired notification.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

AWS Lambda

Question 12

A security team is designing a logging solution for a multi-account AWS environment using AWS Organizations. They need to collect CloudTrail logs, VPC Flow Logs, and DNS logs from all accounts. Which TWO services can be used to centralize this logging?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs (A) is correct because it can serve as a centralized log repository where log groups from multiple accounts stream CloudTrail, VPC Flow Logs, and Route 53 DNS query logs via subscription filters and cross-account log sharing, enabling a single security account to aggregate and query all log data. Amazon S3 (E) is correct because it is the standard centralized destination for CloudTrail log file delivery (including organization trails), VPC Flow Logs (delivered to S3 buckets), and Route 53 DNS query logs, with cross-account bucket policies and AWS Organizations allowing all member accounts to write into a central logging bucket. AWS CloudTrail (Organization Trail) (B) is not correct here because it only captures CloudTrail API activity across accounts, not VPC Flow Logs or DNS logs, so it cannot centralize all three log types. AWS Config (C) is not correct because it records resource configuration changes and compliance state, not CloudTrail, VPC Flow Log, or DNS log data. Amazon GuardDuty (D) is not correct because it is a threat-detection service that consumes logs to generate findings, not a service for centralizing and storing the raw logs themselves.

Answer

AWS CloudTrail (Organization Trail)

Answer

AWS Config

Answer

Amazon GuardDuty

Question 13

A company wants to monitor unauthorized API calls in their AWS account. Which TWO AWS services can provide real-time alerting on such events?

Accepted Answer

AWS CloudTrail. AWS CloudTrail (B) is correct because it records every API call made in the account as management and data events, and when combined with CloudWatch Logs metric filters and alarms it delivers real-time alerting on unauthorized or suspicious API activity. Amazon GuardDuty (C) is correct because it continuously analyzes CloudTrail management events, VPC Flow Logs, and DNS logs with threat intelligence and machine learning to detect anomalous or unauthorized API calls and generate findings in near real time. AWS Config (A) is not designed for real-time alerting on API calls; it evaluates resource configuration compliance and records configuration changes, not API invocation events. AWS Trusted Advisor (D) provides periodic best-practice checks and recommendations, not real-time monitoring of API activity. Amazon Inspector (E) is a vulnerability management service that scans EC2 instances, container images, and Lambda functions for software vulnerabilities and network exposure, not API call monitoring.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Question 14

A company wants to centralize CloudTrail logs from multiple AWS accounts into a single S3 bucket for security analysis. The logs must be encrypted at rest and access must be logged. What is the MOST secure way to grant cross-account access to the central S3 bucket?

Accepted Answer

Create an S3 bucket policy that grants CloudTrail service principal permission to write objects, with a condition checking the source account ID.. It uses an S3 bucket policy that grants the CloudTrail service principal (cloudtrail.amazonaws.com) permission to write objects, with a condition that checks the source account ID. This ensures that only CloudTrail from authorized accounts can deliver logs, and the service principal approach avoids the need for IAM roles or sharing credentials. The bucket policy also allows encryption at rest via S3 default encryption or a KMS key, and access logging can be enabled separately on the bucket.

Answer

Create an S3 bucket policy that grants s3:PutObject to everyone, and rely on CloudTrail to restrict access.

Answer

Create an IAM role in the central account that each member account can assume to write logs.

Answer

Use an S3 bucket with default encryption enabled and share the KMS key with the other accounts.

Question 15

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that all accounts have CloudTrail enabled and that logs are delivered to a central S3 bucket. A new member account is created and the security engineer wants to enforce this configuration automatically. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a CloudTrail template to all accounts in the organization.. AWS CloudFormation StackSets allows you to deploy a CloudTrail template across all accounts in an AWS Organization from a single administrative account. This approach ensures that every new member account automatically receives the CloudTrail configuration as part of the StackSet's automatic deployment to accounts added to the organization, providing a fully automated, infrastructure-as-code solution with minimal operational overhead.

Answer

Use AWS Config rules to detect accounts without CloudTrail and trigger a remediation via Systems Manager Automation.

Answer

Use an SCP to deny cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.

Answer

Create an AWS Lambda function that runs periodically to check and enable CloudTrail in each account.