SCS-C02 Security Logging and Monitoring Practice Test 3 — 15 Questions

Question 1

A company uses AWS CloudTrail to log all API calls. The security team notices that some PutObject API calls are not appearing in the CloudTrail logs. The S3 bucket in question has server access logging enabled. What is the MOST likely reason for the missing CloudTrail events?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CloudTrail was not configured to log data events for S3.. CloudTrail logs are categorized into management events and data events. By default, CloudTrail only logs management events (e.g., CreateBucket, DeleteBucket). Data events, such as S3 object-level operations like PutObject, must be explicitly enabled in the CloudTrail trail configuration. Since the security team sees missing PutObject calls, the most likely cause is that CloudTrail was not configured to log S3 data events.

Answer

Server access logs are interfering with CloudTrail.

Answer

The PutObject calls were made via the AWS Management Console.

Answer

The S3 bucket policy denies CloudTrail from logging.

Question 2

A security engineer needs to detect when an EC2 instance is terminated in an AWS account. The solution must provide near-real-time notification. Which combination of services should be used?

Accepted Answer

AWS CloudTrail and Amazon EventBridge. AWS CloudTrail captures API calls, including TerminateInstances, as management events. Amazon EventBridge can filter these events in near real-time and trigger a notification action (e.g., via SNS or Lambda). This combination provides immediate detection of EC2 termination without polling or delays.

Answer

VPC Flow Logs and Amazon CloudWatch Logs

Answer

AWS Config and Amazon SNS

Answer

Amazon CloudWatch Alarms and Amazon SNS

Question 3

A company is designing a centralized logging solution for VPC Flow Logs across multiple AWS accounts. The solution must meet the following requirements: - Centralized storage in an S3 bucket in the security account. - Real-time analysis of flow logs. - Minimal operational overhead. Which TWO actions should the company take? (Choose two.)

Accepted Answer

Use AWS Organizations to enable VPC Flow Logs in all accounts and deliver to a central S3 bucket.. AWS Organizations allows you to centrally configure VPC Flow Logs across all accounts in the organization using a service control policy (SCP) or a CloudFormation StackSet, enabling logs to be delivered directly to a central S3 bucket in the security account. This approach minimizes operational overhead by avoiding per-account manual setup. Option C is correct because Amazon Kinesis Data Firehose can subscribe to CloudWatch Logs (where VPC Flow Logs are sent) and deliver them to the central S3 bucket with near-real-time latency, supporting the requirement for real-time analysis.

Answer

Create a single VPC Flow Log subscription in the security account that captures logs from all VPCs.

Answer

Create a CloudWatch Logs subscription filter in each account to stream logs to the security account.

Answer

Configure S3 replication from each account's bucket to the central bucket.

Question 4

A company wants to monitor for unauthorized API calls in real-time. The solution must meet the following requirements: - Detect calls that fail authentication (AccessDenied). - Detect calls that use a revoked IAM role. - Provide a centralized view across multiple accounts. Which THREE services should be used together to implement this solution? (Choose three.)

Accepted Answer

AWS Organizations. AWS Organizations is correct because it enables centralized management of multiple AWS accounts, allowing the solution to aggregate CloudTrail logs from all accounts into a single CloudWatch Logs group. This centralization is essential for real-time monitoring of unauthorized API calls across the entire organization, as CloudTrail logs record all API activity including AccessDenied errors and actions taken by revoked IAM roles.

Answer

AWS IAM Access Analyzer

Answer

AWS Config

Question 5

A security engineer needs to detect unauthorized API calls in an AWS account. Which AWS service should be used to record and monitor API activity for auditing?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it is specifically designed to record API activity across AWS services, capturing details such as the identity of the caller, the time of the call, the source IP address, and the request parameters. This audit log is essential for detecting unauthorized API calls, as it provides a complete history of all management and data plane operations for security analysis and compliance.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon GuardDuty

Question 6

A company needs to centralize security logs from multiple AWS accounts and on-premises servers. The logs must be encrypted at rest and stored in a cost-effective manner. Which solution meets these requirements?

Accepted Answer

Use Amazon S3 with server-side encryption (SSE-S3). Amazon S3 with server-side encryption (SSE-S3) meets the requirements because it provides encryption at rest using AES-256, is cost-effective for log storage, and can centralize logs from multiple AWS accounts and on-premises servers via S3 Cross-Account Access and the S3 API. SSE-S3 is fully managed by AWS, requiring no additional key management overhead, and S3's lifecycle policies can transition older logs to lower-cost tiers like S3 Glacier for further cost savings.

Answer

Use Amazon S3 Glacier with Vault Lock

Answer

Use Amazon Kinesis Data Firehose to deliver logs to Amazon Redshift

Answer

Use Amazon CloudWatch Logs with KMS encryption

Question 7

A Security Engineer is troubleshooting why AWS CloudTrail is not delivering logs to an S3 bucket. The bucket policy allows CloudTrail access. What is a likely cause of the issue?

Accepted Answer

The S3 bucket uses SSE-KMS and the key policy does not grant CloudTrail permission. When an S3 bucket uses SSE-KMS (Server-Side Encryption with AWS KMS), CloudTrail must have explicit permissions in the KMS key policy to decrypt the key and encrypt log files. Even if the S3 bucket policy grants CloudTrail access, the KMS key policy is a separate authorization layer; without a statement allowing CloudTrail to use the kms:GenerateDataKey and kms:Decrypt actions, log delivery will fail silently or with access denied errors.

Answer

The S3 bucket has a lifecycle policy that deletes objects too quickly

Answer

CloudTrail is not enabled in the region

Answer

The S3 bucket is in a different region than the trail

Question 8

A company wants to monitor failed SSH login attempts to EC2 instances. Which approach should be used?

Accepted Answer

Use the CloudWatch Logs agent to send /var/log/auth.log to CloudWatch Logs. Failed SSH login attempts are logged by the SSH daemon (sshd) to the system's authentication log file, typically /var/log/auth.log on Debian-based systems or /var/log/secure on Red Hat-based systems. The CloudWatch Logs agent can be configured to tail this log file and send the entries to CloudWatch Logs, where you can create metric filters to detect patterns like 'Failed password' and trigger alarms or automated responses.

Answer

Enable AWS CloudTrail for EC2 instances

Answer

Enable VPC Flow Logs

Answer

Use AWS Config to detect SSH access

Question 9

A company uses AWS WAF to protect a web application. The security team needs to analyze blocked requests to identify attack patterns. Which service should be used to query and visualize WAF logs?

Accepted Answer

Amazon Athena. Amazon Athena is the correct service because it allows you to query AWS WAF logs stored in Amazon S3 directly using standard SQL. WAF logs are not natively indexed for real-time querying like CloudWatch Logs, but Athena's serverless query engine can efficiently analyze large volumes of these logs for attack pattern identification. Combined with Amazon QuickSight for visualization, Athena provides a cost-effective and scalable solution for ad-hoc log analysis.

Answer

Amazon CloudWatch Logs Insights

Answer

Amazon QuickSight

Answer

AWS WAF console

Question 10

A company has a CloudTrail trail that logs management events for all regions. The security team notices that some S3 data events are not being logged. How should the team enable logging for all S3 data events?

Accepted Answer

Update the existing CloudTrail trail to include data events for S3. CloudTrail trails can be configured to log data events for S3 in addition to management events. By updating the existing trail to include S3 data events (e.g., GetObject, PutObject), the security team can capture all object-level API activity without creating a separate trail. This ensures comprehensive logging while maintaining the existing management event logging for all regions.

Answer

Create a new CloudTrail trail that logs only data events

Answer

Use Amazon GuardDuty to monitor S3 access

Answer

Enable S3 server access logging on each bucket

Question 11

A company needs to be alerted when root account credentials are used in their AWS account. Which service should be used to create a metric filter and alarm for this event?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs can monitor CloudTrail log events for root account usage by creating a metric filter that matches the `userIdentity.type` field with a value of `Root`. When the filter detects a match, it triggers a CloudWatch alarm to notify the operations team. This is the standard AWS-recommended approach for alerting on root activity.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

AWS CloudTrail

Question 12

A security engineer needs to analyze VPC Flow Logs to identify traffic to a known malicious IP address. The logs are stored in Amazon S3. Which approach is the most cost-effective for querying the logs?

Accepted Answer

Use Amazon Athena to query the logs in S3. Amazon Athena is the most cost-effective option because it is a serverless query service that allows you to run SQL queries directly on data stored in S3, including VPC Flow Logs, without needing to load or transform the data. You pay only for the data scanned per query, and with partitioning (e.g., by date or region), you can minimize costs by scanning only relevant log files. This avoids the overhead of provisioning clusters or managing infrastructure, making it ideal for ad-hoc analysis of malicious IP traffic.

Answer

Load the logs into an Amazon Redshift cluster

Answer

Use Amazon EMR to run Spark jobs

Answer

Use Amazon QuickSight to connect to S3

Question 13

A company wants to receive notifications when AWS CloudTrail logs are delivered to an S3 bucket. Which TWO AWS services can be used together to achieve this? (Choose TWO.)

Accepted Answer

Amazon S3 Event Notifications. Amazon S3 Event Notifications can be configured to publish events (like `s3:ObjectCreated:*`) when CloudTrail logs are delivered to the S3 bucket. These notifications can be sent directly to Amazon SNS, which then delivers the notification to subscribers (e.g., email, SMS, or HTTP endpoints). Together, S3 Event Notifications and SNS provide a serverless, real-time notification pipeline without needing custom polling or compute resources.

Answer

AWS CloudTrail

Answer

AWS Lambda

Answer

Amazon Simple Queue Service (SQS)

Question 14

A security engineer needs to monitor DNS query logs for malicious domain names. Which THREE services can be used together to collect, analyze, and alert on DNS logs? (Choose THREE.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is correct because it can ingest DNS query logs from Route 53 Resolver Query Logs and serve as a centralized log storage and monitoring service. It allows you to create metric filters and alarms to detect patterns indicative of malicious domain queries, enabling real-time alerting on suspicious DNS activity.

Answer

Amazon GuardDuty

Answer

Amazon Athena

Question 15

Refer to the exhibit. The security team is investigating a security incident in us-west-2 region. They notice that management events from us-west-2 are not appearing in the CloudTrail logs. Based on the exhibit, what is the most likely reason?

Accepted Answer

The trail is not a multi-region trail. The exhibit shows a single-region CloudTrail trail. A single-region trail only logs events in the region where it is created. Since management events from us-west-2 are not appearing, the trail must have been created in a different region. To capture events from us-west-2, the trail would need to be multi-region. Therefore, the most likely reason is that the trail is not a multi-region trail.

Answer

The S3 bucket is in a different region

Answer

The trail is not logging data events

Answer

The trail does not have log file validation enabled