SCS-C02 Security Logging and Monitoring Practice Test 4 — 15 Questions

Question 1

A company is using Amazon Route 53 and wants to log DNS queries for investigative purposes. The logs must be stored in a centralized S3 bucket in the security account. What is the MOST efficient way to achieve this?

Accepted Answer

Configure Route 53 Resolver query logging to deliver to the central S3 bucket.. Option B is correct because Route 53 resolver query logs can be sent directly to S3, and by using AWS Organizations, you can centralize logging. Option A is wrong because CloudWatch Logs adds an extra step. Option C is wrong because VPC Flow Logs are for network traffic, not DNS queries. Option D is wrong because Route 53 does not have a built-in Lambda integration for this purpose.

Answer

Enable VPC Flow Logs and analyze DNS traffic.

Answer

Enable CloudWatch Logs for Route 53 and stream to a Lambda function that writes to S3.

Answer

Use a custom Lambda function to poll Route 53 logs and write to S3.

Question 2

A company uses AWS CloudTrail to log all API calls. The security team notices that some PutObject API calls are not appearing in the CloudTrail logs. The S3 bucket in question has server access logging enabled. What is the MOST likely reason for the missing CloudTrail events?

Accepted Answer

CloudTrail was not configured to log data events for S3.. Option A is correct because CloudTrail data events for S3 must be explicitly enabled; by default, only management events are logged. Option B is wrong because server access logs are separate from CloudTrail. Option C is wrong because S3 events are logged regardless of whether the request is from the console or CLI. Option D is wrong because the bucket policy does not affect CloudTrail logging; CloudTrail logs all API calls that it is configured to log.

Answer

Server access logs are interfering with CloudTrail.

Answer

The PutObject calls were made via the AWS Management Console.

Answer

The S3 bucket policy denies CloudTrail from logging.

Question 3

A security engineer needs to detect when an EC2 instance is terminated in an AWS account. The solution must provide near-real-time notification. Which combination of services should be used?

Accepted Answer

AWS CloudTrail and Amazon EventBridge. Option C is correct because CloudTrail logs the TerminateInstances API call, and CloudWatch Events (now Amazon EventBridge) can match the event and trigger a notification via SNS. Option A is wrong because AWS Config evaluates configuration changes, but it is not near-real-time for API calls. Option B is wrong because VPC Flow Logs do not capture EC2 instance termination. Option D is wrong because CloudWatch Alarms monitor metrics, not API calls.

Answer

VPC Flow Logs and Amazon CloudWatch Logs

Answer

AWS Config and Amazon SNS

Answer

Amazon CloudWatch Alarms and Amazon SNS

Question 4

A company is designing a centralized logging solution for VPC Flow Logs across multiple AWS accounts. The solution must meet the following requirements: - Centralized storage in an S3 bucket in the security account. - Real-time analysis of flow logs. - Minimal operational overhead. Which TWO actions should the company take? (Choose two.)

Accepted Answer

Use AWS Organizations to enable VPC Flow Logs in all accounts and deliver to a central S3 bucket.. Option A is correct because AWS Organizations allows you to centrally manage flow log subscriptions. Option C is correct because Amazon Kinesis Data Firehose can stream flow logs to S3 and enable real-time analysis via Kinesis Analytics. Option B is wrong because CloudWatch Logs subscription filter is not the most efficient for real-time analysis. Option D is wrong because S3 replication adds complexity and is not real-time. Option E is wrong because cross-account flow logs cannot be delivered directly via a single subscription from the security account; each account must create its own flow log.

Answer

Create a single VPC Flow Log subscription in the security account that captures logs from all VPCs.

Answer

Create a CloudWatch Logs subscription filter in each account to stream logs to the security account.

Answer

Configure S3 replication from each account's bucket to the central bucket.

Question 5

A security engineer is investigating a potential security incident. The engineer has enabled CloudTrail and VPC Flow Logs. Which THREE pieces of information can the engineer obtain from CloudTrail logs that are NOT available in VPC Flow Logs? (Choose three.)

Accepted Answer

The AWS Region where the API call was made.. Options A, B, and D are correct because CloudTrail logs API calls, including details like the IAM user who made the call, the source IP address (could be the same as flow logs but identity is unique), and the AWS region of the API endpoint. Options C and E are wrong because packet payloads are not logged by either service, and VPC Flow Logs provide network traffic metadata (source/destination IP, ports, protocol) not available in CloudTrail.

Answer

The payload of the API request.

Answer

The destination IP address and port of the network traffic.

Question 6

A company is using Amazon GuardDuty to detect threats. The security team wants to receive alerts for specific findings. Which TWO AWS services can be used to forward GuardDuty findings to a custom application for analysis? (Choose two.)

Accepted Answer

Amazon CloudWatch Events (Amazon EventBridge). Options B and D are correct because GuardDuty can send findings to CloudWatch Events (EventBridge) and also to S3 via CloudWatch Events or directly. Option A is wrong because GuardDuty does not natively send to SQS; you need EventBridge. Option C is wrong because GuardDuty does not send to Kinesis directly; you need EventBridge. Option E is wrong because Lambda is not a destination; it can be a target of EventBridge.

Answer

Amazon Kinesis Data Streams

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Lambda

Question 7

A company wants to monitor for unauthorized API calls in real-time. The solution must meet the following requirements: - Detect calls that fail authentication (AccessDenied). - Detect calls that use a revoked IAM role. - Provide a centralized view across multiple accounts. Which THREE services should be used together to implement this solution? (Choose three.)

Accepted Answer

AWS Organizations. Options A, B, and E are correct because CloudTrail logs API calls, CloudWatch Logs can filter for specific error codes, and AWS Organizations enables centralized management across accounts. Option C is wrong because AWS Config does not monitor API calls. Option D is wrong because IAM Access Analyzer analyzes resource policies, not API calls.

Answer

AWS IAM Access Analyzer

Answer

AWS Config

Question 8

A security engineer needs to detect unauthorized API calls in an AWS account. Which AWS service should be used to record and monitor API activity for auditing?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it is specifically designed to record API activity across AWS services, capturing details such as the identity of the caller, the time of the call, the source IP address, and the request parameters. This audit log is essential for detecting unauthorized API calls, as it provides a complete history of all management and data plane operations for security analysis and compliance.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon GuardDuty

Question 9

A company needs to centralize security logs from multiple AWS accounts and on-premises servers. The logs must be encrypted at rest and stored in a cost-effective manner. Which solution meets these requirements?

Accepted Answer

Use Amazon S3 with server-side encryption (SSE-S3). Amazon S3 with SSE-S3 provides cost-effective encrypted storage. CloudWatch Logs is more expensive. Kinesis Firehose can deliver to S3 but adds cost. Glacier is for archival, not active logging.

Answer

Use Amazon S3 Glacier with Vault Lock

Answer

Use Amazon Kinesis Data Firehose to deliver logs to Amazon Redshift

Answer

Use Amazon CloudWatch Logs with KMS encryption

Question 10

A Security Engineer is troubleshooting why AWS CloudTrail is not delivering logs to an S3 bucket. The bucket policy allows CloudTrail access. What is a likely cause of the issue?

Accepted Answer

The S3 bucket uses SSE-KMS and the key policy does not grant CloudTrail permission. When an S3 bucket uses SSE-KMS (Server-Side Encryption with AWS KMS), CloudTrail must have explicit permissions in the KMS key policy to decrypt the key and encrypt log files. Even if the S3 bucket policy grants CloudTrail access, the KMS key policy is a separate authorization layer; without a statement allowing CloudTrail to use the kms:GenerateDataKey and kms:Decrypt actions, log delivery will fail silently or with access denied errors.

Answer

The S3 bucket has a lifecycle policy that deletes objects too quickly

Answer

CloudTrail is not enabled in the region

Answer

The S3 bucket is in a different region than the trail

Question 11

A company wants to monitor failed SSH login attempts to EC2 instances. Which approach should be used?

Accepted Answer

Use the CloudWatch Logs agent to send /var/log/auth.log to CloudWatch Logs. Publish OS-level logs to CloudWatch Logs using the CloudWatch agent. CloudTrail does not capture OS login attempts. VPC Flow Logs capture network traffic, not OS events. Config is for resource compliance.

Answer

Enable AWS CloudTrail for EC2 instances

Answer

Enable VPC Flow Logs

Answer

Use AWS Config to detect SSH access

Question 12

A company uses AWS WAF to protect a web application. The security team needs to analyze blocked requests to identify attack patterns. Which service should be used to query and visualize WAF logs?

Accepted Answer

Amazon Athena. Amazon Athena can query WAF logs stored in S3. CloudWatch Logs Insights is for CloudWatch Logs, not directly for S3. QuickSight can visualize but cannot query directly. WAF does not have a built-in query service.

Answer

Amazon CloudWatch Logs Insights

Answer

Amazon QuickSight

Answer

AWS WAF console

Question 13

A company has a CloudTrail trail that logs management events for all regions. The security team notices that some S3 data events are not being logged. How should the team enable logging for all S3 data events?

Accepted Answer

Update the existing CloudTrail trail to include data events for S3. CloudTrail data events must be explicitly enabled. The existing trail can be updated to include data events. Creating a new trail with management events only would not capture data events. S3 server access logs are separate.

Answer

Create a new CloudTrail trail that logs only data events

Answer

Use Amazon GuardDuty to monitor S3 access

Answer

Enable S3 server access logging on each bucket

Question 14

A company needs to be alerted when root account credentials are used in their AWS account. Which service should be used to create a metric filter and alarm for this event?

Accepted Answer

Amazon CloudWatch Logs. CloudWatch Logs can monitor CloudTrail logs for root account usage. A metric filter and alarm can be set up. GuardDuty has a finding for root usage but the requirement is to create a custom alarm. Config evaluates resources.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

AWS CloudTrail

Question 15

A company uses AWS Organizations to manage multiple accounts. The security team wants to enable CloudTrail for all accounts and centrally store logs. What is the most efficient way to achieve this?

Accepted Answer

Create a CloudTrail trail in the management account and apply it to all accounts in the organization. AWS Organizations can create a trail in the management account that logs all accounts. Deleting existing trails is not required. Each account creating its own trail is inefficient. S3 bucket policy alone does not enable logging.

Answer

Use an S3 bucket policy to allow cross-account log delivery

Answer

Use AWS Lambda to create trails in each account

Answer

Ask each account admin to create their own CloudTrail trail and deliver to a central S3 bucket