SCS-C02 Security Logging and Monitoring Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. A security engineer finds this S3 bucket policy on a bucket that should be private. What is the most effective way to detect if this bucket was accessed by unauthorized users?

Accepted Answer

Query AWS CloudTrail for GetObject API calls.. AWS CloudTrail is the most effective service for auditing S3 API calls such as GetObject because it records detailed information including the source IP, user identity, and timestamp. While S3 server access logs also capture request details, they are delivered asynchronously, are not real-time, and lack the comprehensive identity and integration capabilities of CloudTrail. To identify unauthorized access, CloudTrail provides the authoritative audit trail, assuming data events are enabled for the bucket.

Answer

Enable S3 server access logs on the bucket.

Answer

Use CloudWatch Logs to search for GetObject events.

Answer

Analyze VPC Flow Logs for traffic to the bucket.

Question 2

A security team needs to detect unauthorized attempts to access an S3 bucket that contains sensitive data. Which AWS service can automatically analyze S3 access logs and generate findings for suspicious activity?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads. It can analyze VPC Flow Logs, AWS CloudTrail event logs, and DNS logs, and when S3 access logging is enabled, GuardDuty can ingest those logs to detect suspicious S3 access patterns, such as anomalous data exfiltration or access from unusual geographies. GuardDuty then generates security findings that can be automated for remediation.

Answer

Amazon Macie

Answer

AWS Trusted Advisor

Answer

Amazon Detective

Question 3

A company is using Amazon RDS for MySQL and needs to monitor database login attempts for security analysis. Which feature should be enabled to capture authentication events?

Accepted Answer

Enable RDS MySQL audit logs. RDS for MySQL supports the MySQL audit log plugin, which logs authentication events such as successful and failed login attempts. Enabling this feature via the 'audit_logs' option group parameter captures detailed connection and login records, which can be stored in CloudWatch Logs for security analysis.

Answer

Enable VPC Flow Logs for the RDS subnet

Answer

Enable AWS CloudTrail data events for RDS

Answer

Enable the '--log_queries_not_using_indexes' parameter

Question 4

A security engineer needs to capture network traffic between EC2 instances in a VPC for analysis. Which TWO services can provide this capability? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs (B) is correct because VPC Flow Logs can be published directly to a CloudWatch Logs log group, where the captured IP traffic metadata for the EC2 instances' elastic network interfaces can be stored and analyzed. VPC Flow Logs (C) is correct because it is the native VPC feature that captures IP traffic flow information (source/destination IP, ports, protocol, packets, bytes, accept/reject) for network interfaces in the VPC. AWS CloudTrail (A) is incorrect because it records AWS API activity and management events, not network packet or flow data. AWS Config (D) is incorrect because it evaluates resource configuration compliance and changes, not traffic. Amazon GuardDuty (E) is incorrect because it is a threat-detection service that consumes sources like VPC Flow Logs and CloudTrail rather than providing raw traffic capture itself.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon GuardDuty

Question 5

A security engineer is investigating a potential data exfiltration from an EC2 instance. CloudTrail logs show that an IAM user created a new access key for an existing IAM role and used it to call S3 GetObject from an unfamiliar IP address. What is the MOST likely reason the CloudTrail logs captured this activity?

Accepted Answer

CloudTrail was enabled to capture management events.. CloudTrail management events record API calls for creating and modifying IAM resources, such as CreateAccessKey for an IAM role. Since the activity involved creating a new access key (a management event) and then using it to call S3 GetObject (a data event), the management event portion was captured because CloudTrail was enabled to log management events by default. The data event (S3 GetObject) would only be logged if data events were specifically enabled, but the question asks why the activity was captured, and the creation of the access key is the key management event that triggered logging.

Answer

S3 server access logs were enabled on the bucket containing the objects.

Answer

VPC Flow Logs were enabled for the EC2 instance's subnet.

Answer

The security engineer had enabled CloudTrail Insights.

Answer

AWS Config was enabled to record resource changes.

Question 6

A company is using AWS Organizations and wants to enable a central security team to view API activity across all member accounts. Which THREE steps are required? (Choose THREE.)

Accepted Answer

Grant the security team read access to the central S3 bucket via bucket policy or IAM.. The goal is centralized visibility of API activity across all accounts in AWS Organizations, which requires CloudTrail enabled in every account that generates the events. Option D is correct because CloudTrail must be turned on in each member account (or via an organization trail) so that API activity in those accounts is actually recorded. Option C is correct because each account's trail must deliver its log files to a central S3 bucket, typically owned by the security/log-archive account, so the security team has one place to analyze all activity. Option A is correct because the security team needs read access to that central S3 bucket, granted through the bucket policy or an IAM policy, to actually view and query the aggregated logs. Option B is wrong because enabling CloudTrail only in the management account would capture just that account's activity, not the member accounts'. Option E is wrong because assuming a role in each account is not a required step for central log viewing; access is granted to the central S3 bucket instead.

Answer

Enable CloudTrail in the management account only.

Answer

Create an IAM role in each account for the security team to assume.

Question 7

A company uses Amazon GuardDuty in a single AWS account to detect threats. The security team receives an alert that a specific EC2 instance is communicating with a known command and control (C2) server. The security engineer needs to immediately isolate the instance while preserving the root cause evidence. The engineer has access to the AWS Management Console. Which action should the engineer take FIRST?

Accepted Answer

Take a snapshot of the EBS volume and then isolate the instance by modifying the security group.. The correct first action is to take a snapshot of the EBS volume to preserve root cause evidence, then modify the security group to block all outbound traffic, isolating the instance. Option A is incorrect because terminating the instance destroys volatile evidence and may not capture the current state. Option C is incorrect because modifying the security group without first taking a snapshot could lose critical evidence before isolation. Option D is incorrect because installing the CloudWatch agent takes time and does not immediately stop communication or isolate the instance.

Answer

Terminate the instance immediately to stop the communication.

Answer

Modify the security group to block all outbound traffic.

Answer

Install the CloudWatch Logs agent on the instance to capture logs.

Question 8

A security engineer is configuring an Amazon S3 bucket to store CloudTrail logs. The engineer must ensure that the logs are encrypted at rest using an AWS KMS customer managed key (CMK) and that only the CloudTrail service has permission to decrypt the logs. Which bucket policy statement should the engineer add?

Accepted Answer

{"Effect":"Allow","Principal":{"Service":"cloudtrail.amazonaws.com"},"Action":"kms:Decrypt","Resource":"*"}. The question asks for a bucket policy statement, but bucket policies cannot grant KMS actions like kms:Decrypt. KMS permissions must be granted via a key policy. Therefore, none of the provided options are valid bucket policy statements. The correct approach is to attach a key policy to the KMS key allowing the CloudTrail service principal to perform kms:Decrypt (for log delivery) and kms:Encrypt (for log encryption) as needed. Although option B represents the correct key policy for decryption, it is not a bucket policy, so no option is correct in the context of bucket policies.

Answer

{"Effect":"Allow","Principal":{"Service":"cloudtrail.amazonaws.com"},"Action":"kms:Encrypt","Resource":"*"}

Answer

{"Effect":"Allow","Principal":"*","Action":"kms:Decrypt","Resource":"*"}

Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":"kms:Decrypt","Resource":"*"}

Question 9

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The security team has implemented a centralized logging solution using Amazon S3 for ALB access logs and AWS CloudTrail logs. Recently, the team noticed that some ALB access logs are missing for certain time periods. The ALB is configured to deliver logs every 5 minutes to an S3 bucket with a bucket policy that grants the ALB service principal write access. The CloudTrail logs show no errors related to the ALB or S3. The S3 bucket is in the same region as the ALB. What is the most likely cause of the missing logs?

Accepted Answer

The bucket policy does not allow the ALB to write logs.. The most likely cause of missing ALB access logs is a misconfigured bucket policy. Although the stem states the bucket policy grants the ALB service principal write access, the policy may be missing specific actions (e.g., s3:PutObject) or may have incorrect conditions that prevent log delivery. CloudTrail logs may not record S3 bucket policy evaluation failures unless they are explicit deny. Option A is incorrect because enabling versioning does not cause delivery failures. Option C is incorrect because the ALB is configured to deliver logs every 5 minutes. Option D is incorrect because the bucket is explicitly stated to be in the same region as the ALB.

Answer

The S3 bucket has versioning enabled, which causes log delivery failures.

Answer

The ALB is not configured to send logs to the S3 bucket.

Answer

The S3 bucket is in a different AWS region than the ALB.

Question 10

A company has a requirement to retain CloudTrail logs for 7 years for compliance. They currently store logs in an S3 bucket with standard storage. The security team wants to minimize storage costs while meeting the retention requirement. The logs must be available for retrieval within 24 hours of a request. Which storage class should the team use for the logs after the first 30 days?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is the lowest-cost storage class designed for long-term retention of data that is rarely accessed, with a standard retrieval time of 12 hours and bulk retrieval of up to 48 hours. Since the requirement is retrieval within 24 hours, Deep Archive's standard retrieval (12 hours) meets the requirement while minimizing storage costs for 7-year retention. It is the most cost-effective option for compliance archives.

Answer

S3 Glacier Flexible Retrieval

Answer

S3 One Zone-IA

Answer

S3 Standard-IA

Question 11

A security engineer is responsible for monitoring AWS account activity. The engineer needs to receive real-time notifications when specific API calls are made, such as 'DeleteTrail' or 'UpdateTrail'. The engineer wants to use AWS services to achieve this with minimal latency. Which combination of services should the engineer use?

Accepted Answer

CloudTrail -> CloudWatch Logs -> CloudWatch metric filter -> CloudWatch alarm -> Amazon SNS. The correct solution is to send CloudTrail logs to CloudWatch Logs, create a metric filter to match the specific API calls (e.g., 'DeleteTrail', 'UpdateTrail'), and set up a CloudWatch alarm on that metric that publishes to an SNS topic. This provides near-real-time alerts. Option D is correct. Option A is incorrect because while CloudTrail can send events to EventBridge, the event delivery is not as immediate as CloudWatch Logs metric filter approach for this use case. Option B is incorrect because S3 event notifications are for object-level events and not suitable for monitoring CloudTrail API calls. Option C is incorrect because CloudWatch Logs subscription filters are for streaming logs to other destinations, not for directly triggering alarms.

Answer

CloudTrail -> Amazon EventBridge -> Amazon SNS

Answer

CloudTrail -> Amazon S3 -> S3 event notification -> AWS Lambda -> Amazon SNS

Answer

CloudTrail -> CloudWatch Logs -> CloudWatch Logs subscription filter -> AWS Lambda -> Amazon SNS

Question 12

A company has a multi-account AWS environment managed by AWS Organizations. The security team wants to enable a centralized logging solution where all VPC flow logs, CloudTrail logs, and AWS Config configuration items are sent to a single S3 bucket in the security account. The team has already created the S3 bucket with appropriate bucket policies to allow cross-account writes. However, logs are not appearing from all accounts. What is the MOST likely reason for this issue?

Accepted Answer

The member accounts do not have the required IAM roles to allow the logging services to write to the central bucket.. The most likely reason logs are not appearing from all accounts is that the member accounts lack the required IAM roles (service-linked roles) that allow the logging services (CloudTrail, Config, VPC Flow Logs) to assume permissions to write to the central S3 bucket. Even with a correct bucket policy, the logging services in each member account need an appropriate IAM role (e.g., AWSServiceRoleForCloudTrail, AWSServiceRoleForConfig) to be present and properly configured. Without these roles, the services cannot perform the cross-account write. Option C is correct because these roles must exist in each member account. Options A, B, and D are incorrect: A - The security account does not need to be the master account; any designated account can serve as the central logging account. B - The bucket policy should grant permissions to the logging service principal (e.g., config.amazonaws.com, cloudtrail.amazonaws.com), not the root user of member accounts. D - While KMS key policies can cause issues, the question states the S3 bucket is already configured with appropriate bucket policies, and the most common cause of missing logs is missing IAM roles, not KMS encryption.

Answer

The security account is not the master account of the AWS Organization.

Answer

The S3 bucket policy does not grant write access to the root user of each member account.

Answer

The S3 bucket is encrypted with SSE-KMS and the KMS key policy does not allow cross-account access.

Question 13

A security engineer is setting up centralized logging for an AWS organization. The engineer wants to collect CloudTrail logs, VPC Flow Logs, and AWS Config configuration items from all member accounts into a single S3 bucket in the management account. The engineer creates a new S3 bucket with a bucket policy that grants the required permissions. However, logs from member accounts are not being delivered. What is the most likely reason?

Accepted Answer

The S3 bucket policy does not grant write permissions to the member accounts' service principals.. The S3 bucket policy must explicitly grant the `s3:PutObject` permission to the CloudTrail, VPC Flow Logs, and AWS Config service principals from the member accounts. Without this, the services in member accounts cannot write logs to the bucket in the management account, even if the bucket exists and other permissions are set.

Answer

VPC Flow Logs cannot be delivered to an S3 bucket in a different account.

Answer

CloudTrail must be enabled in each member account individually.

Answer

AWS Config must be enabled in the management account and configured to aggregate data from member accounts.

Question 14

A company is using Amazon CloudWatch Logs to centralize application logs from EC2 instances. The security team wants to encrypt the log data at rest using a customer-managed KMS key. After enabling encryption on the log group, they notice that new log events are being encrypted, but existing log events are not encrypted. What should the team do to encrypt the existing log events?

Accepted Answer

Export the existing logs to S3, encrypt them with the KMS key, and re-import them into a new log group.. CloudWatch Logs encryption at rest using a customer-managed KMS key applies only to new log events written after encryption is enabled. Existing log events remain unencrypted. To encrypt them, you must export the log group to Amazon S3 (using CreateExportTask), apply server-side encryption with the KMS key (SSE-KMS) to the exported objects, and then re-import them into a new log group. CloudWatch Logs does not support retroactive encryption of existing log events in place.

Answer

Use the AWS CLI to update the log group's encryption configuration to re-encrypt existing data.

Answer

Enable KMS automatic key rotation on the customer-managed key to encrypt existing logs.

Answer

Change the KMS key to an AWS managed key to automatically encrypt existing logs.

Question 15

Refer to the exhibit. A security engineer finds this S3 bucket policy on a bucket that should be private. What is the most effective way to detect if this bucket was accessed by unauthorized users?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The instance is responding to an inbound SSH connection from the remote IP.. The VPC Flow Log shows an outbound connection from the EC2 instance (10.0.1.5) to remote IP 203.0.113.5 on destination port 443, with source port 22 and an ACCEPT record. Since source port 22 is used by SSH servers, this indicates the instance is sending response packets for an inbound SSH session back to the remote client. The flow log captures the connection as 'outbound' because the packet is leaving the instance's network interface, even though it is a reply to an incoming SSH connection.

Answer

The instance is connecting to a remote server on the internal network.

Answer

The instance is receiving an SSH connection from the remote IP.

Answer

The instance is making an HTTPS request to a web server.