SCS-C02 Security Logging and Monitoring Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. A security engineer creates this CloudWatch Logs metric filter on a CloudTrail log group to detect root account usage. However, no metrics are generated. What is the most likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The metric filter pattern is incorrectly formatted. The most likely issue is that the metric filter pattern is incorrectly formatted. CloudWatch Logs metric filters require a valid JSON pattern that matches the log event structure. For detecting root account usage, the pattern must correctly reference the `userIdentity.type` field as `Root`. If the pattern syntax is wrong (e.g., missing quotes, incorrect key path, or invalid JSON), no metrics will be generated even if the log group and CloudTrail are properly configured.

Answer

The log group does not exist

Answer

CloudTrail is not enabled for the account

Answer

The metric namespace is invalid

Question 2

A company uses AWS CloudTrail to log all API calls in their AWS account. They need to ensure that log files are not tampered with after they are delivered to the S3 bucket. Which feature should be enabled to provide integrity validation?

Accepted Answer

Enable CloudTrail log file integrity validation.. CloudTrail log file integrity validation uses a SHA-256 hash chain to detect if log files have been modified, deleted, or tampered with after delivery to S3. When enabled, CloudTrail delivers a digest file that contains hashes of the log files, allowing you to verify that no unauthorized changes have occurred. This is the only feature specifically designed for integrity validation of CloudTrail logs.

Answer

Enable S3 Versioning on the CloudTrail bucket.

Answer

Enable S3 server-side encryption with SSE-S3.

Answer

Enable S3 Object Lock on the CloudTrail bucket.

Question 3

A company uses Amazon RDS for MySQL and wants to monitor database activity for security analysis. Which AWS service should be used to capture detailed database activity logs such as login attempts and query execution?

Accepted Answer

Amazon RDS Database Activity Streams. Amazon RDS Database Activity Streams is the correct service because it captures a near-real-time stream of database activity, including login attempts, query execution, and other operations at the database engine level. It integrates with AWS CloudWatch and third-party monitoring tools, providing granular audit logs for security analysis that go beyond what CloudTrail or Enhanced Monitoring offer.

Answer

AWS CloudTrail

Answer

Amazon RDS Enhanced Monitoring

Answer

AWS Config

Question 4

A security engineer is configuring VPC Flow Logs for a VPC that hosts a web application. The engineer wants to capture all traffic to and from the internet. Which of the following is the most appropriate configuration?

Accepted Answer

Configure Flow Logs at the VPC level and set the traffic type to 'All'.. Configuring VPC Flow Logs at the VPC level with traffic type 'All' captures all network traffic across every subnet, including both accepted and rejected traffic to and from the internet. This ensures comprehensive visibility into internet-bound flows. Option A is incorrect because it does not specify the traffic type; without setting it to 'All', it may not capture both accepted and rejected traffic. Options B and D are incorrect because subnet-level logs are less comprehensive and their traffic types ('Reject' or 'Accepted') do not capture all traffic.

Answer

Configure Flow Logs at the VPC level and publish to CloudWatch Logs with a log group name.

Answer

Configure Flow Logs at the subnet level and set the traffic type to 'Reject'.

Answer

Configure Flow Logs at the subnet level and set the traffic type to 'Accepted'.

Question 5

A security team wants to collect and analyze logs from multiple AWS services including CloudTrail, VPC Flow Logs, and AWS WAF. They need a centralized solution that can filter, transform, and route logs to multiple destinations in near real-time. Which AWS service should they use?

Accepted Answer

Amazon Kinesis Data Streams combined with Amazon Kinesis Data Firehose. Amazon Kinesis Data Streams combined with Amazon Kinesis Data Firehose is the correct choice because it provides a fully managed, scalable, and near real-time pipeline for collecting, filtering, transforming, and routing logs from multiple AWS services (CloudTrail, VPC Flow Logs, WAF) to multiple destinations such as Amazon S3, Amazon Redshift, or Amazon Elasticsearch Service. Kinesis Data Streams captures and stores the data stream, while Kinesis Data Firehose can invoke AWS Lambda for transformation and reliably deliver the processed logs to the specified sinks, meeting the requirement for centralized, near real-time log processing.

Answer

Amazon CloudWatch Logs Insights

Answer

Amazon CloudWatch Logs subscription filters with AWS Lambda

Answer

Amazon S3 with S3 Event Notifications

Question 6

A company wants to detect and alert on unauthorized API calls in their AWS account. Which AWS service can provide real-time notifications when specific API calls are made?

Accepted Answer

Amazon CloudWatch Events (EventBridge). Amazon CloudWatch Events (now part of Amazon EventBridge) can capture real-time API calls made to AWS services by using a rule that matches specific API calls via CloudTrail integration. When a matching API call occurs, EventBridge can trigger a target such as an SNS topic or Lambda function to send a notification, enabling immediate alerting on unauthorized API calls.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 7

A company uses AWS CloudTrail and wants to ensure that logs are encrypted at rest using a customer-managed KMS key. The CloudTrail trail is configured to deliver logs to an S3 bucket. After enabling SSE-KMS on the S3 bucket, the logs are not being delivered. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant CloudTrail permission to use the key.. CloudTrail requires explicit permissions in the KMS key policy to use the key for encrypting log files. Even if SSE-KMS is enabled on the S3 bucket, CloudTrail must have `kms:GenerateDataKey` and `kms:Decrypt` permissions granted via the key policy. Without these, CloudTrail cannot encrypt the logs, causing delivery to fail.

Answer

CloudTrail does not support SSE-KMS.

Answer

The KMS key is in a different AWS account.

Answer

The S3 bucket policy does not allow CloudTrail to write logs.

Question 8

A security engineer is investigating a potential security incident. They suspect that an IAM user's credentials were compromised and used to launch EC2 instances in a region where the user normally does not operate. Which AWS service can help the engineer identify the source IP address and user agent of the API calls that launched the instances?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including the source IP address, user agent, and the identity of the caller. By examining CloudTrail logs for the `RunInstances` event, the engineer can identify the exact source IP address and user agent used to launch the EC2 instances, even if the region is unusual for the user.

Answer

AWS CloudHSM

Answer

Amazon Inspector

Answer

AWS Artifact

Question 9

Which THREE are best practices for securing AWS CloudTrail log files? (Choose three.)

Accepted Answer

Restrict access to the S3 bucket using a bucket policy that requires MFA and encryption.. Restricting access to the S3 bucket with a bucket policy that requires MFA (Multi-Factor Authentication) and encryption (e.g., aws:MultiFactorAuthPresent and aws:SecureTransport conditions) ensures that only authenticated and authorized users can access CloudTrail logs, and that data is encrypted in transit. This prevents unauthorized deletion or modification of log files, which is critical for maintaining an immutable audit trail.

Answer

Deliver logs to an S3 bucket in the same region as the trail.

Answer

Set a lifecycle policy to delete logs after 30 days.

Question 10

Which TWO AWS services can be used to monitor and detect unauthorized changes to Amazon S3 bucket policies? (Choose two.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it records all API calls made to Amazon S3, including changes to bucket policies (e.g., PutBucketPolicy, DeleteBucketPolicy). By enabling CloudTrail on the S3 bucket or using a trail that logs data events for S3, you can monitor and detect unauthorized policy modifications in near real-time through the CloudTrail event history or by delivering logs to Amazon CloudWatch Logs for further analysis.

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch Logs

Answer

Amazon VPC Flow Logs

Question 11

A company wants to monitor for unauthorized changes to its Amazon S3 bucket policies. Which AWS service should be used to detect such changes?

Accepted Answer

AWS Config. AWS Config provides managed rules such as 's3-bucket-policy-not-more-permissive' that can evaluate S3 bucket policies for unauthorized changes. Option B is incorrect because AWS CloudTrail logs API calls but does not proactively evaluate policy compliance. Option C is incorrect because Amazon GuardDuty detects malicious activity but not policy changes. Option D is incorrect because Amazon CloudWatch Logs Insights can query log data but is not designed for proactive monitoring of policy changes.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch Logs Insights

Question 12

A company wants to receive real-time notifications for every root user login to the AWS Management Console. Which service should be used?

Accepted Answer

Amazon CloudWatch Events. Amazon CloudWatch Events (now part of Amazon EventBridge) can capture AWS API calls via CloudTrail and trigger a rule that matches the 'RootLogin' event. This allows real-time notification through SNS, Lambda, or other targets whenever a root user signs in to the Management Console.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Config

Question 13

A company is using Amazon Macie to discover sensitive data in S3. The security team wants to be notified when Macie finds a high-severity alert. Which integration should be used?

Accepted Answer

Create an Amazon EventBridge rule that matches Macie findings and targets an SNS topic.. Amazon EventBridge can directly capture Macie findings (which are emitted as events) and route them to an SNS topic for notification. This is the native, event-driven integration that requires no intermediate storage or custom actions, making it the simplest and most reliable approach for real-time alerting on high-severity findings.

Answer

Configure Macie to store findings in an S3 bucket and enable S3 event notifications.

Answer

Integrate Macie with AWS Security Hub and create a custom action to send to SNS.

Answer

Configure Macie to send findings to CloudWatch Logs and create a metric filter.

Question 14

A security team needs to monitor for unauthorized API calls in their AWS account. Which TWO services can provide real-time alerts for such events?

Accepted Answer

AWS CloudTrail with Amazon CloudWatch Events. B is correct because AWS CloudTrail logs all API calls, and by integrating CloudTrail with Amazon CloudWatch Events (now Amazon EventBridge), you can create event rules that trigger real-time alerts (e.g., via SNS or Lambda) for unauthorized API calls. This combination provides the necessary logging and immediate notification capability for security monitoring.

Answer

Amazon CloudWatch Logs Insights

Answer

Amazon VPC Flow Logs

Answer

AWS Config

Question 15

A company wants to ensure that all S3 buckets are encrypted at rest. Which THREE services can be used to detect and alert on unencrypted buckets?

Accepted Answer

AWS Config. AWS Config can evaluate S3 bucket configurations against managed rules like 's3-bucket-server-side-encryption-enabled' to detect unencrypted buckets. When a bucket violates the rule, AWS Config can trigger an Amazon SNS notification or invoke a Lambda function for remediation, enabling real-time alerting.

Answer

Amazon CloudWatch Logs Insights

Answer

Amazon VPC Flow Logs