SCS-C02 Security Logging and Monitoring Practice Test 3 — 15 Questions

Question 1

A security engineer is troubleshooting an issue where Amazon GuardDuty is not generating findings for a specific EC2 instance that is known to be compromised. The instance is in a VPC with VPC Flow Logs enabled. What could be the reason for the lack of findings?

Accepted Answer

VPC Flow Logs are not being delivered to CloudWatch Logs.. Option C is correct because GuardDuty requires VPC Flow Logs to be enabled and delivered to CloudWatch Logs to analyze network traffic. Option A is wrong because CloudTrail logs management events, not network traffic. Option B is wrong because subnet flow logs are not a concept; flow logs are at the VPC, subnet, or ENI level. Option D is wrong because GuardDuty does not require AWS Config to be enabled.

Answer

CloudTrail is not enabled in the account.

Answer

AWS Config is not enabled for the EC2 instance.

Answer

VPC Flow Logs are only enabled for the subnet, not the instance's ENI.

Question 2

A company wants to monitor failed SSH login attempts to its EC2 instances. Which AWS service should be used to collect and analyze these logs?

Accepted Answer

Amazon CloudWatch Logs with the unified CloudWatch agent. Amazon CloudWatch Logs with the unified CloudWatch agent is the correct choice because the agent can be configured to collect and forward system log files, such as /var/log/secure (Amazon Linux) or /var/log/auth.log (Ubuntu), which record SSH authentication attempts including failures. This allows centralized monitoring and analysis of failed SSH logins via CloudWatch Logs Insights or metric filters.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

AWS Config

Question 3

A company uses Amazon S3 to store sensitive data. The security team needs to be alerted when an S3 bucket policy is changed to allow public access. Which combination of services should be used to meet this requirement?

Accepted Answer

AWS Config with AWS Lambda and Amazon Simple Notification Service (SNS). Option B is correct because AWS Config records S3 bucket policy changes and can trigger a Lambda function via Amazon EventBridge to send alerts. Option A is wrong because CloudTrail alone does not trigger alerts; it logs events but requires further processing. Option C is wrong because AWS Trusted Advisor provides security checks but does not monitor for real-time changes. Option D is wrong because S3 server access logs do not include bucket policy changes.

Answer

AWS CloudTrail and Amazon Simple Notification Service (SNS)

Answer

S3 server access logs and Amazon Athena

Answer

AWS Trusted Advisor and Amazon Simple Notification Service (SNS)

Question 4

A security engineer is investigating a potential security incident involving an EC2 instance that was used to launch an outbound DDoS attack. The engineer needs to determine the source of the attack and the commands executed on the instance. Which logs should be analyzed?

Accepted Answer

EC2 instance OS logs (e.g., /var/log/secure) and CloudTrail logs for API calls that launched the instance. Option A is correct because EC2 instance logs (OS logs) capture commands executed on the instance. Option B is wrong because VPC Flow Logs only show network traffic, not commands. Option C is wrong because CloudTrail logs API calls, not OS commands. Option D is wrong because S3 access logs track S3 access, not EC2 activity.

Answer

VPC Flow Logs and Network ACL logs

Answer

S3 server access logs and CloudWatch Logs

Answer

AWS CloudTrail and AWS Config history

Question 5

A company wants to detect and alert on suspicious IAM user behavior, such as accessing services that are not typically used. Which AWS service provides prebuilt anomaly detection for IAM users?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is the correct answer because it is a threat detection service that uses machine learning and anomaly detection to identify suspicious IAM user behavior, such as accessing services not typically used. It analyzes AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs to establish baselines and generate findings for unusual API calls or access patterns. This prebuilt capability directly addresses the requirement for detecting atypical IAM activity without manual configuration.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 6

A company has enabled AWS CloudTrail in all regions and is delivering logs to a central S3 bucket. The security team needs to ensure that any attempt to delete or modify CloudTrail logs is detected and alerted. What should be done?

Accepted Answer

Enable S3 Object Lock in governance mode on the bucket.. Option D is correct because enabling S3 Object Lock on the bucket prevents deletion or modification of log files. Option A is wrong because MFA Delete alone does not prevent deletion by authorized users. Option B is wrong because S3 server access logs track access but do not prevent deletion. Option C is wrong because bucket policies cannot prevent deletion by the bucket owner.

Answer

Enable S3 server access logging on the bucket and monitor for DELETE requests.

Answer

Enable MFA Delete on the S3 bucket.

Answer

Use a bucket policy that denies s3:DeleteObject for all principals.

Question 7

A company is using Amazon CloudWatch Logs to collect application logs. The security team wants to detect patterns that indicate security threats, such as multiple failed login attempts. Which TWO services can be used together to perform real-time log analysis and alerting?

Accepted Answer

Amazon OpenSearch Service. Options A and C are correct because CloudWatch Logs can stream logs to Amazon OpenSearch Service for analysis, and CloudWatch Logs can also be used with subscription filters to invoke a Lambda function for real-time processing. Option B is wrong because Amazon Athena is for querying data in S3, not real-time streaming. Option D is wrong because Kinesis Data Analytics is for streaming data but requires a Kinesis stream; it is not directly integrated with CloudWatch Logs as a destination. Option E is wrong because AWS Glue is a batch ETL service, not for real-time.

Answer

Amazon Kinesis Data Analytics

Answer

AWS Glue

Answer

Amazon Athena

Question 8

A company uses AWS Organizations and wants to enforce that all member accounts enable VPC Flow Logs for all VPCs. Which THREE services or features should be used to enforce this policy automatically?

Accepted Answer

AWS Organizations Service Control Policies (SCPs). Options A, B, and D are correct because AWS Organizations can use SCPs to restrict actions, AWS Config Rules can evaluate compliance, and AWS CloudFormation StackSets can deploy VPC Flow Logs across accounts. Option C is wrong because AWS CloudTrail records API calls, not resource configurations. Option E is wrong because AWS Service Catalog is for creating and managing IT services, not for enforcing logging.

Answer

AWS Service Catalog

Answer

AWS CloudTrail

Question 9

A security engineer is setting up monitoring for AWS API calls. Which TWO AWS services can be used to capture and analyze API activity?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs can capture and analyze API activity by ingesting log data from various AWS services, including AWS CloudTrail. You can configure CloudWatch Logs to monitor API calls in real time, set up metric filters to detect specific patterns, and trigger alarms based on API activity. This makes it a valid service for capturing and analyzing API calls, especially when combined with CloudTrail for detailed event records.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 10

A security engineer is troubleshooting why CloudTrail logs are not being delivered to an S3 bucket. The bucket policy allows CloudTrail to write objects, and the trail is configured to log management events. However, no log files appear in the bucket. What is the MOST likely cause?

Accepted Answer

The S3 bucket uses SSE-KMS encryption and the trail does not have permission to use the KMS key.. Option C is correct because if the S3 bucket is using SSE-KMS encryption, CloudTrail requires explicit permissions to use the KMS key. Option A is wrong because CloudTrail can deliver logs to buckets in different accounts with proper cross-account permissions. Option B is wrong because management events are logged by default. Option D is wrong because the bucket policy is not missing.

Answer

The trail is not logging data events.

Answer

The S3 bucket is in a different AWS account.

Answer

The bucket policy is missing a Deny statement.

Question 11

A company uses AWS Config to track resource changes. They notice that a weekly compliance report shows an S3 bucket as non-compliant with a rule that checks for server-side encryption. However, the bucket has default encryption enabled. What is the MOST likely reason for this discrepancy?

Accepted Answer

The Config rule checks for SSE on objects, not default bucket encryption.. Option B is correct because AWS Config rules evaluate the bucket configuration at the time of the change, and default encryption is a bucket-level setting, but the rule might be checking for encryption on objects. Option A is wrong because AWS Config evaluates all regions by default but can be scoped. Option C is wrong because the rule exists. Option D is wrong because Config does not require a resource to be tagged to evaluate it.

Answer

The Config rule was deleted and recreated without re-evaluating existing resources.

Answer

The Config rule is only evaluating resources in a single AWS Region.

Answer

The S3 bucket is not tagged with a required tag for the Config rule.

Question 12

A company wants to centrally collect VPC Flow Logs from multiple accounts into a single S3 bucket in the security account. Which solution is the MOST operationally efficient?

Accepted Answer

Use AWS Organizations to centrally enable VPC Flow Logs in all accounts and deliver to the central S3 bucket.. Option A is correct because AWS Organizations allows you to centrally manage VPC Flow Logs across accounts using a CloudFormation StackSet or a central subscription. Option B is wrong because each account must create its own flow log; it cannot be done from the security account directly. Option C is wrong because CloudWatch Logs is not needed if the destination is S3. Option D is wrong because S3 replication adds complexity and does not centralize the logging configuration.

Answer

Use CloudWatch Logs to stream flow logs to a Lambda function that writes to S3.

Answer

Log in to each account and configure VPC Flow Logs to deliver to the central S3 bucket.

Answer

Configure each account's VPC Flow Logs to a local S3 bucket, then use S3 replication to copy to the central bucket.

Question 13

A security team needs to be alerted when an IAM user generates a console login failure. Which combination of AWS services should be used to meet this requirement?

Accepted Answer

CloudTrail, Amazon CloudWatch Logs, and CloudWatch Alarms. Option B is correct because CloudTrail captures IAM console login failures as CloudTrail events, which can be streamed to CloudWatch Logs. A CloudWatch Alarm can then be configured to trigger on a metric filter that matches the specific 'ConsoleLogin' event with a 'Failure' status, enabling real-time alerting via Amazon SNS.

Answer

CloudTrail and Amazon S3

Answer

AWS Config and Amazon SNS

Answer

Amazon GuardDuty and AWS Lambda

Question 14

A company has a CloudTrail trail that logs management events for all regions in the management account. They want to also log data events for all S3 buckets in the organization. Which configuration change will meet this requirement with the LEAST operational overhead?

Accepted Answer

Modify the existing trail to add an event selector for S3 data events with a scope of all buckets.. Option C is correct because a single organization trail can log data events for all S3 buckets across all accounts in the organization. Option A is wrong because creating a new trail in each member account adds overhead. Option B is wrong because CloudTrail supports data events for S3 buckets without needing an event selector per bucket; you can select all buckets. Option D is wrong because CloudWatch Events is not needed; CloudTrail is the correct service.

Answer

Use Amazon EventBridge to capture S3 events and forward them to CloudTrail.

Answer

Enable S3 server access logs for all buckets and aggregate them using Athena.

Answer

Create a new trail in each member account to log S3 data events and deliver to a central S3 bucket.

Question 15

A security engineer needs to ensure that all S3 buckets in an AWS account have server access logging enabled. Which AWS service should be used to continuously monitor for compliance?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of your AWS resource configurations against desired policies. You can create an AWS Config rule, such as the managed rule 's3-bucket-server-access-logging-enabled', which will automatically check all S3 buckets in your account and report any that do not have server access logging enabled, flagging them as noncompliant. This allows for ongoing, automated compliance auditing without manual intervention.

Answer

Amazon GuardDuty

Answer

AWS IAM Access Analyzer

Answer

AWS CloudTrail