SCS-C02 Security Logging and Monitoring Practice Test 22 — 15 Questions

Question 1

A company uses Amazon GuardDuty to detect threats. The security team wants to receive real-time notifications for all GuardDuty findings with a severity of HIGH or CRITICAL. What is the MOST efficient way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a CloudWatch Events rule that matches GuardDuty findings with severity HIGH or CRITICAL and targets an SNS topic.. Amazon GuardDuty integrates natively with Amazon CloudWatch Events (now part of Amazon EventBridge) to emit findings as events. By creating a CloudWatch Events rule that filters for findings with a severity value of 7.0 or higher (HIGH or CRITICAL), you can directly target an Amazon SNS topic to send real-time notifications. This approach is the most efficient as it avoids intermediate storage or polling, providing near-instantaneous alerting with minimal latency and operational overhead.

Answer

Use the GuardDuty console to set up email alerts for high-severity findings.

Answer

Configure GuardDuty to export findings to an S3 bucket and use S3 event notifications to trigger an SNS topic.

Answer

Stream GuardDuty findings to CloudWatch Logs and create a metric filter to trigger an alarm.

Question 2

A company has a multi-account AWS environment using AWS Organizations. The security team wants to ensure that all API activity across all accounts is logged and immutable. CloudTrail is enabled in all accounts, but the logs are stored in individual account buckets. The team wants to centralize logs and prevent any account from disabling logging. What should they do?

Accepted Answer

Apply an SCP to deny cloudtrail:StopLogging and cloudtrail:DeleteTrail, and create an organization trail that delivers logs to a central S3 bucket with a bucket policy that prevents deletion.. It uses an SCP to prevent disabling CloudTrail (denying cloudtrail:StopLogging and cloudtrail:DeleteTrail) and creates an organization trail that delivers logs to a central S3 bucket. The central bucket policy prevents deletion of logs, ensuring immutability and centralized logging across all accounts in the AWS Organization.

Answer

Create a new CloudTrail trail for each account and configure S3 bucket policies to allow cross-account access.

Answer

Enable S3 MFA Delete on each account's log bucket and require MFA for IAM users.

Answer

Use CloudWatch Logs to aggregate logs and set a retention policy of 10 years.

Question 3

A security engineer is reviewing CloudTrail logs and notices an event with the key 'eventType' set to 'AwsServiceEvent'. What does this indicate?

Accepted Answer

The event was initiated by an AWS service.. In AWS CloudTrail, the 'eventType' field indicates the source of the event. When set to 'AwsServiceEvent', it means the event was generated by an AWS service on behalf of the customer, such as automatic backups, scaling actions, or health checks. This is distinct from events initiated by a user or federated identity, which would have 'eventType' set to 'AwsApiCall' or 'AwsConsoleSignIn'.

Answer

The event was initiated by an IAM user via the AWS Management Console.

Answer

The event was a sign-in event from the AWS Management Console.

Answer

The event type is an error in the log.

Question 4

A company uses Amazon S3 to store sensitive data. The security team wants to detect when objects are made publicly accessible. Which combination of services provides the MOST comprehensive detection with minimal false positives?

Accepted Answer

Enable S3 Block Public Access at the account level and use AWS Config rules to detect public ACLs and bucket policies.. S3 Block Public Access at the account level provides a preventive control that denies all public access, while AWS Config rules (e.g., s3-bucket-public-read-prohibited, s3-bucket-policy-not-more-permissive) continuously evaluate and detect any public ACLs or bucket policies that would allow public access. This combination ensures comprehensive detection with minimal false positives because Config rules are deterministic and based on explicit policy evaluation, not on heuristic or behavioral analysis.

Answer

Use Amazon Macie to scan S3 buckets for publicly accessible objects.

Answer

Enable CloudTrail data events for S3 and create a CloudWatch Events rule for PutBucketAcl calls.

Answer

Enable Amazon GuardDuty and review the S3 findings for public access.

Question 5

Which TWO AWS services can be used to centrally collect and analyze logs from multiple AWS accounts? (Choose two.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs can centrally collect logs from multiple AWS accounts by using cross-account subscription filters or by aggregating logs into a central account via CloudWatch Logs destination. This enables centralized monitoring and analysis of log data from various sources, meeting the requirement for a multi-account log collection and analysis solution.

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Firehose

Answer

Amazon Athena

Question 6

Which TWO actions should a security engineer take to ensure that CloudTrail logs are protected from unauthorized deletion? (Choose two.)

Accepted Answer

Attach an S3 bucket policy that denies s3:DeleteObject to all principals except the CloudTrail service principal.. Attaching an S3 bucket policy that denies s3:DeleteObject to all principals except the CloudTrail service principal prevents any user or role (including root) from deleting log files, while still allowing CloudTrail to write logs. This ensures that even if an attacker gains administrative access, they cannot delete the logs, preserving their integrity for forensic analysis.

Answer

Enable S3 versioning on the log bucket.

Answer

Enable S3 default encryption with SSE-S3.

Answer

Configure CloudTrail to send logs to CloudWatch Logs.

Question 7

Which THREE AWS services can be used to detect and alert on suspicious network traffic patterns? (Choose three.)

Accepted Answer

AWS Network Firewall. AWS Network Firewall is correct because it is a managed firewall service that can inspect network traffic at the VPC level using stateful and stateless rules. It can detect suspicious patterns such as port scans, malicious IP addresses, or protocol anomalies and generate alerts via Amazon CloudWatch metrics and logs, enabling real-time notification of suspicious network traffic.

Answer

AWS Systems Manager

Answer

AWS CloudTrail

Question 8

A financial services company has a production AWS account with hundreds of EC2 instances running a mix of Linux and Windows workloads. The security team is responsible for detecting and responding to security incidents. They have enabled CloudTrail, VPC Flow Logs, and GuardDuty. Recently, GuardDuty generated a finding indicating that an EC2 instance is communicating with a known malicious IP address. The security engineer needs to investigate the incident. The engineer examines the GuardDuty finding and sees the affected resource is an EC2 instance ID. The engineer wants to identify which user or role launched the instance and what security groups were associated with it at launch time. Which approach should the engineer take to gather this information?

Accepted Answer

Search CloudTrail logs for the RunInstances event that created the instance, using the instance ID to filter.. CloudTrail records every EC2 API call, including RunInstances, with the identity of the caller (user or role), the request parameters (including security group IDs), and the response (including the instance ID). By searching CloudTrail logs for the RunInstances event and filtering by the instance ID in the response elements, the engineer can determine who launched the instance and which security groups were specified at launch.

Answer

Log in to the EC2 console and view the instance details under the 'Security' tab.

Answer

Use AWS Systems Manager Inventory to collect metadata about the instance.

Answer

Use AWS Config to view the configuration history of the EC2 instance and check the security group changes.

Question 9

A company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group, and an RDS MySQL database. The security team wants to monitor for SQL injection attempts. They have enabled AWS WAF on the ALB and are logging all requests. The security engineer needs to analyze the WAF logs to identify if any SQL injection attacks have been attempted. The logs are stored in an S3 bucket. The engineer needs to query the logs for patterns like 'SELECT * FROM' or 'DROP TABLE' in the URI. Which service should the engineer use to perform this analysis?

Accepted Answer

Amazon Athena. Amazon Athena is a serverless interactive query service that can query data directly from S3 using standard SQL, making it ideal for analyzing WAF logs stored in S3. The engineer can run SQL queries with LIKE clauses to search for patterns like 'SELECT * FROM' or 'DROP TABLE' in the URI field. Athena integrates natively with S3 and requires no infrastructure management.

Answer

Amazon Kinesis Data Analytics

Answer

Amazon QuickSight

Answer

CloudWatch Logs Insights

Question 10

A company uses AWS Organizations to manage multiple accounts. The security team needs to implement a centralized logging solution where all VPC Flow Logs from all accounts are sent to a central S3 bucket in the security account. The flow logs must be encrypted with a customer-managed KMS key (CMK) that is owned by the security account. The security engineer has enabled VPC Flow Logs in each account and configured the destination to be the central S3 bucket. However, the flow logs are not being delivered. The engineer checks the S3 bucket policy and confirms that it grants the required permissions to the Flow Logs service principal. What is the MOST likely cause of the failure?

Accepted Answer

The KMS key policy does not grant the Flow Logs service principal permission to use the key.. When VPC Flow Logs are delivered to an S3 bucket encrypted with a customer-managed KMS key, the Flow Logs service principal must have permission to use that key. Even if the S3 bucket policy grants access, the KMS key policy must also allow the Flow Logs service to encrypt data. Without this, the delivery fails. This is the most likely cause given the scenario.

Answer

The VPC Flow Logs service does not support cross-account delivery.

Answer

CloudTrail must be enabled in the source account for Flow Logs to work.

Answer

The S3 bucket policy is missing a condition for source account.

Question 11

A security engineer notices that CloudTrail logs for a production account are not being delivered to the S3 bucket. The bucket policy allows CloudTrail to write objects. What is the MOST likely cause?

Accepted Answer

The bucket policy does not grant s3:GetBucketAcl to CloudTrail.. CloudTrail requires the `s3:GetBucketAcl` permission on the destination S3 bucket to verify that the bucket policy grants CloudTrail the necessary write access. Without this permission, CloudTrail cannot confirm its ability to deliver logs, even if the bucket policy explicitly allows `s3:PutObject`. This is a prerequisite check performed by CloudTrail before any log delivery occurs.

Answer

The S3 bucket does not have versioning enabled.

Answer

The S3 bucket uses SSE-KMS encryption.

Answer

The S3 bucket contains existing objects before CloudTrail delivery started.

Question 12

A company wants to monitor AWS API calls for suspicious activity and automatically remediate by revoking IAM roles in real time. Which combination of services should be used?

Accepted Answer

Amazon CloudWatch Events and AWS Lambda. The combination of Amazon CloudWatch Events and AWS Lambda enables real-time monitoring and automated remediation of AWS API calls. CloudWatch Events can capture API calls from AWS CloudTrail (or other sources) and trigger a Lambda function to revoke IAM roles based on suspicious activity patterns, providing the required real-time response.

Answer

AWS CloudTrail and Amazon Inspector

Answer

AWS CloudTrail and AWS Config

Answer

Amazon GuardDuty and AWS Config

Question 13

A security team needs to audit all changes to IAM policies in their AWS account. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made in the AWS account, including IAM policy changes such as CreatePolicy, PutRolePolicy, and AttachUserPolicy. These events are captured as CloudTrail log entries, which can be audited to track who made the change, when it was made, and from which source IP. CloudTrail is the primary service for auditing and logging all management events across AWS services.

Answer

AWS Config

Answer

Amazon CloudWatch

Answer

IAM Access Analyzer

Question 14

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all CloudTrail trails are enabled in all accounts and log to a central S3 bucket. What is the MOST efficient way to enforce this?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a CloudTrail template to all accounts.. AWS CloudFormation StackSets allows you to deploy a CloudTrail template across multiple accounts and Regions from a single management account, ensuring all accounts have a trail configured to log to the central S3 bucket. This approach is the most efficient as it automates deployment, enforces consistent configuration, and scales across the entire organization without requiring per-account manual intervention or custom scripting.

Answer

Use AWS Lambda to check each account and enable CloudTrail if missing.

Answer

Use AWS Config aggregator to verify compliance and send alerts.

Answer

Create a service control policy (SCP) that requires CloudTrail.

Question 15

A company needs to monitor for unauthorized S3 bucket deletions. Which CloudWatch Logs metric filter should be used on CloudTrail logs?

Accepted Answer

eventName = DeleteBucket. The CloudTrail event `DeleteBucket` is logged when an S3 bucket is deleted. By creating a CloudWatch Logs metric filter that matches `eventName = DeleteBucket` on the CloudTrail log group, you can trigger an alarm or automated response to detect unauthorized bucket deletions. This directly addresses the monitoring requirement.

Answer

eventName = GetBucketAcl

Answer

eventName = PutBucketPolicy

Answer

eventName = ListBuckets