SCS-C02 Security Logging and Monitoring Practice Test 23 — 15 Questions

Question 1

A security engineer wants to detect and alert on AWS account root user activity. Which THREE services can be used together to achieve this? (Select THREE.)

Accepted Answer

Amazon CloudWatch Events (EventBridge). Amazon CloudTrail (C) is correct because it records AWS API activity including root user sign-in events and console logins, which are captured as management events in the CloudTrail event history and delivered to an S3 bucket or CloudWatch Logs. Amazon CloudWatch Logs (D) is correct because CloudTrail can be configured to send its trail logs to a CloudWatch Logs log group, where log data can be retained and made available for metric filters and alarms. Amazon CloudWatch Events (EventBridge) (B) is correct because it can match specific CloudTrail API events (for example, events with a userIdentity type of Root) via event patterns and route them to targets such as SNS or Lambda to generate alerts. AWS Config (A) is not correct because it evaluates resource configuration compliance and records configuration changes, not real-time API activity or root user sign-in events. Amazon GuardDuty (E) is not correct because it is a threat detection service that analyzes VPC flow logs, DNS logs, and CloudTrail management events for malicious or anomalous behavior, but it does not provide the event-matching and alerting pipeline for root user activity described here.

Answer

AWS Config

Answer

Amazon GuardDuty

Question 2

Which TWO AWS services can be used to monitor network traffic for malicious activity? (Select TWO.)

Accepted Answer

AWS Network Firewall. AWS Network Firewall (A) is correct because it is a managed, stateful network firewall and intrusion prevention service that inspects VPC traffic (including VPC-to-VPC, egress, and ingress) and can alert on or block malicious activity using Suricata-compatible rules and managed threat signatures. Amazon GuardDuty (B) is correct because it continuously monitors network traffic and account activity—analyzing VPC Flow Logs, DNS logs, and CloudTrail events—to detect malicious or unauthorized behavior such as crypto-mining, port scanning, and communication with known malicious IPs. AWS Shield (C) is not the right answer because it is a managed DDoS protection service that mitigates volumetric and layer 3/4 attacks but does not provide general network traffic monitoring for malicious activity. AWS WAF (D) is not the right answer because it filters HTTP(S) requests at layer 7 against web exploits like SQL injection and XSS, not network traffic monitoring. Amazon Inspector (E) is not the right answer because it is a vulnerability management service that scans EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure, rather than monitoring live network traffic.

Answer

AWS Shield

Answer

AWS WAF

Answer

Amazon Inspector

Question 3

Refer to the exhibit. A security engineer configured this S3 bucket policy for CloudTrail, but CloudTrail logs are not being delivered. What is the MOST likely missing permission?

Accepted Answer

Missing s3:PutObject permission for the bucket.. For CloudTrail to deliver logs to an S3 bucket, the bucket policy must grant CloudTrail the s3:PutObject permission on the bucket's objects (the /* ARN), in addition to s3:GetBucketAcl on the bucket itself. The exhibit's policy is missing the s3:PutObject statement, so CloudTrail cannot write log files even though it can check the bucket ACL. This is the most likely missing permission.

Answer

Missing s3:GetBucketAcl permission.

Answer

The condition StringEquals should be StringLike.

Answer

The bucket ARN is incorrect.

Question 4

A company has a multi-account AWS Organization with 50 accounts. The security team wants to monitor for unauthorized IAM role assumption across all accounts. They have enabled AWS CloudTrail in all accounts and are delivering logs to a central S3 bucket in the security account. They also have Amazon GuardDuty enabled in all accounts. The security team wants a centralized dashboard to visualize cross-account role assumption events. They have limited budget and want to use existing services. What should they do?

Accepted Answer

Use Amazon Athena to query CloudTrail logs in S3 and visualize with Amazon QuickSight.. Amazon Athena can query CloudTrail logs stored in S3 using standard SQL, and Amazon QuickSight can create visualizations from Athena query results. This leverages existing services without additional cost for Amazon QuickSight (pay-per-session pricing) and minimal cost for Athena (based on data scanned). Option B is incorrect because AWS Config aggregator provides a view of resource configuration across accounts, not API call analysis. Option C is incorrect because CloudWatch Logs Insights cannot directly query logs stored in S3; it requires logs to be in CloudWatch Logs. Option D is incorrect because Amazon Elasticsearch Service incurs additional costs and complexity, which the company wants to avoid.

Answer

Use AWS Config aggregator to view cross-account IAM role creation.

Answer

Use Amazon CloudWatch Logs Insights to query logs from the central S3 bucket.

Answer

Use Amazon Elasticsearch Service to index CloudTrail logs from S3 and visualize with Kibana.

Question 5

A company wants to ensure that all API calls made to their AWS account are logged and immutable. They have enabled AWS CloudTrail and are delivering logs to an S3 bucket. The security team requires that logs cannot be deleted or modified by anyone, including the root user. What should they do?

Accepted Answer

Enable S3 Object Lock with Compliance retention mode on the bucket.. S3 Object Lock in Compliance mode prevents any principal — including the root user and AWS itself — from deleting or overwriting an object version until its retention period expires. This is the only option that provides true WORM (write once, read many) immutability for CloudTrail logs. It satisfies the requirement that logs cannot be deleted or modified by anyone, including root.

Answer

Enable MFA Delete on the S3 bucket.

Answer

Enable S3 Versioning on the bucket.

Answer

Add a bucket policy that denies s3:DeleteObject for all principals.

Question 6

A company uses Amazon CloudWatch Logs to collect application logs from EC2 instances. The security team wants to create an alarm that triggers when a specific error pattern appears in the logs. They have set up a metric filter and an alarm. However, the alarm is not triggering even though the error pattern exists in the logs. What is the most likely cause?

Accepted Answer

The metric filter is only applied to log events that occur after the filter is created.. CloudWatch Logs metric filters are not retroactive: they only evaluate log events that are ingested after the filter is created. If the error pattern existed in the logs before the metric filter was created, those events will not generate metric data points, so the alarm will not trigger based on historical events. This is the most likely cause of the alarm not firing.

Answer

The log group retention period is set to 1 day.

Answer

The metric filter uses a custom namespace that is not allowed.

Answer

The metric filter was created before the log group.

Question 7

A company uses AWS CloudTrail to log all API calls across multiple accounts in AWS Organizations. The security team notices that management events are being logged, but data events for Amazon S3 are not appearing in the CloudTrail logs for any account. The team needs to enable data event logging for S3 across all accounts. Currently, the organization trail is configured in the management account, and all member accounts have default CloudTrail configurations. What is the MOST efficient way to enable S3 data event logging for all current and future accounts in the organization?

Accepted Answer

Update the existing organization trail's event selectors in the management account to include S3 data events for all accounts.. An organization trail in the management account can have its event selectors updated to include S3 data events for all accounts in the organization. This change automatically applies to all existing and future member accounts, as organization trails are replicated to all accounts by AWS CloudTrail. No additional configuration is needed in member accounts, making it the most efficient approach.

Answer

Ask each member account to create a new trail in their own account with S3 data events enabled.

Answer

Enable S3 server access logging on all S3 buckets across the organization and aggregate logs in a central S3 bucket.

Answer

Create a new organization trail in the management account with S3 data events enabled, and share it with member accounts.

Question 8

A company uses Amazon GuardDuty to monitor for malicious activity in its AWS environment. The security team receives a high number of findings, many of which are false positives. They want to reduce noise by suppressing findings for known benign activities, such as internal vulnerability scans performed by the security team. GuardDuty has a feature to create suppression rules based on finding criteria. However, the team also wants to ensure that if a new type of threat is detected, it is immediately escalated. What is the MOST effective way to manage GuardDuty findings?

Accepted Answer

Create suppression rules that automatically archive findings matching the known benign activity criteria, and periodically review the suppressed findings.. GuardDuty suppression rules automatically archive findings that match specified criteria (e.g., a known internal scanner IP), removing them from the active findings list without disabling detection. Periodically reviewing suppressed findings ensures that if the benign activity pattern changes or a real threat reuses that IP, the team can catch it. This balances noise reduction with the requirement to escalate genuinely new threats.

Answer

Set GuardDuty to only generate findings for medium and high severity, ignoring low severity findings.

Answer

Create a suppression rule that blocks all findings from the internal IP range used by the security team.

Answer

Disable the specific GuardDuty finding types that generate false positives.

Question 9

Refer to the exhibit. A security engineer reviews IAM permissions for the 'admin' user. The user is a member of the 'Administrators' group, which has the 'AdministratorAccess' managed policy attached. Additionally, the user has an inline policy named 'AllowSSH'. The engineer wants to ensure that the user can only start SSM sessions on instances with the tag 'SSH: enabled'. However, the user can still start sessions on any instance. What is the most likely reason?

Accepted Answer

The inline policy uses 'Allow' instead of 'Deny' for instances without the tag, so it does not restrict access.. In AWS IAM, an explicit Allow in any attached policy grants access — there is no 'most restrictive wins' rule for Allow statements. Because the user already has AdministratorAccess (which allows ssm:StartSession on *), the inline AllowSSH policy's Allow statement cannot restrict anything; it only adds permissions. To restrict the user to tagged instances, the inline policy must contain an explicit Deny for ssm:StartSession when the resource tag condition is not met (or the AdministratorAccess policy must be removed/scoped).

Answer

The inline policy does not include 'ec2:DescribeInstances' for the SSM session, so it cannot start sessions.

Answer

The condition 'aws:ResourceTag/SSH' should be 'aws:RequestTag/SSH' to check the request tag.

Answer

The inline policy 'AllowSSH' is not effective because it is overridden by the group policy 'AdministratorAccess'.

Question 10

Refer to the exhibit. After invoking the Lambda function, why are there no log streams in the log group?

Accepted Answer

The Lambda function's execution role lacks permissions to write to CloudWatch Logs.. Lambda writes logs to CloudWatch Logs using the permissions granted to its execution role. If that role lacks the required actions (logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents), the function still executes but the log writes are silently denied, so no log streams appear in the log group. This is the classic cause of an empty log group after a successful invocation.

Answer

The CloudWatch Logs log group retention policy is set to 0 days.

Answer

The Lambda function is not configured with a CloudWatch Logs log group.

Answer

The Lambda function timed out before writing logs.

Question 11

Refer to the exhibit. An AWS Config rule checks that S3 buckets deny HTTP requests. The bucket 'my-bucket' is reported as non-compliant. Which change would make the bucket compliant?

Accepted Answer

Add the bucket ARN to the Resource element in the policy.. The bucket policy denies actions when 'aws:SecureTransport' is false (HTTP). However, the policy only applies to the bucket's objects (arn:aws:s3:::my-bucket/*), not to the bucket itself. To deny HTTP requests to the bucket as well, the resource should include the bucket ARN (arn:aws:s3:::my-bucket). The rule likely checks that both bucket and objects are denied.

Answer

Add a bucket policy that allows only HTTPS requests.

Answer

Change the Effect to Allow.

Answer

Remove the Condition element from the policy.

Question 12

A security engineer needs to ensure that all API activity in an AWS account is logged and that the logs are retained for 10 years for compliance. The engineer enables AWS CloudTrail with a multi-Region trail and delivers logs to an Amazon S3 bucket. The engineer must prevent any user, including administrators, from deleting or altering the logs during the retention period. Which solution meets these requirements?

Accepted Answer

Enable S3 Object Lock in compliance mode on the S3 bucket with a retention period of 10 years.. S3 Object Lock in compliance mode provides immutable storage for a specified retention period, even preventing the root user from deleting objects. This is the only option that guarantees logs cannot be deleted or altered for 10 years. Other options either allow administrators to bypass protections or do not enforce retention.

Answer

Apply an S3 bucket policy that denies s3:DeleteObject and s3:PutObject for all principals except the CloudTrail service.

Answer

Configure AWS CloudTrail to use a customer-managed AWS KMS key to encrypt the logs and enable key rotation.

Answer

Enable S3 Versioning and configure a lifecycle rule to transition objects to S3 Glacier Deep Archive after 30 days.

Question 13

A security engineer manages a VPC with a fleet of Amazon EC2 instances running behind an Application Load Balancer. The engineer needs to capture, in near real time, metadata about all IP traffic entering and leaving the network interfaces in the VPC, including source and destination IP, ports, and protocol, and then store the records in Amazon S3 for later analysis. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Enable VPC Flow Logs at the VPC level with a destination of Amazon S3 and the default format.. VPC Flow Logs are the native AWS feature for capturing IP traffic metadata for network interfaces in a VPC. Publishing directly to Amazon S3 avoids the need for agents or custom pipelines and provides the required fields in the default format. The other options either capture the wrong type of data or introduce unnecessary complexity.

Answer

Install the CloudWatch agent on each EC2 instance and configure it to collect network traffic metrics and send them to CloudWatch Logs.

Answer

Deploy a third-party network monitoring appliance on an EC2 instance and mirror all VPC traffic to it using AWS PrivateLink.

Answer

Enable AWS CloudTrail data events on the network interfaces and deliver the logs to Amazon S3.

Question 14

A security engineer is configuring a new AWS account and wants to ensure that all API activity is logged and that logs are protected from deletion. The engineer plans to use AWS CloudTrail and Amazon S3. Which TWO actions should the engineer take to meet these requirements? (Choose two.)

Accepted Answer

Enable S3 Object Lock in compliance mode on the S3 bucket used for CloudTrail logs.. To log all API activity, a multi-region trail that logs management events is necessary. To protect logs from deletion, S3 Object Lock in compliance mode provides immutability. Other options either do not prevent deletion, provide only detection, or address confidentiality rather than integrity. Together, these two actions meet the requirements for logging and protection.

Answer

Enable CloudTrail log file validation to ensure logs are not tampered with.

Answer

Configure the S3 bucket policy to deny deletion of objects by any principal except the security engineer's IAM role.

Answer

Use AWS Key Management Service (AWS KMS) to encrypt the CloudTrail logs in the S3 bucket.

Question 15

A security engineer is reviewing AWS CloudTrail logs and notices a large number of DeleteBucket API calls from an unfamiliar IAM role. The engineer wants to automatically notify the security team when similar suspicious API activity occurs in the future. The notification must be sent within minutes and should include details such as the IAM role and the bucket name. Which solution should the engineer implement?

Accepted Answer

Create an Amazon EventBridge rule that matches AWS API calls via CloudTrail, filter for the DeleteBucket event, and route the event to an Amazon SNS topic that notifies the security team.. EventBridge can match CloudTrail management events and filter for specific API calls like DeleteBucket. Routing the event to SNS provides near real-time notification with the full event details, including the IAM role and bucket name. This is the most direct and low-latency solution for the requirement.

Answer

Enable CloudTrail Insights and configure an Amazon CloudWatch alarm on the Insights metric to send notifications via Amazon SNS.

Answer

Use Amazon GuardDuty to monitor for S3 bucket deletion activity and configure GuardDuty findings to send notifications via Amazon SNS.

Answer

Configure AWS Config to record configuration changes for S3 buckets and use an AWS Config rule to trigger an Amazon SNS notification when a bucket is deleted.