SCS-C02 Security Logging and Monitoring Practice Test 4 — 15 Questions

Question 1

A security engineer is investigating a potential data exfiltration incident. The engineer has enabled VPC Flow Logs for the VPC and CloudTrail for the account. Which combination of actions would provide the most comprehensive visibility into network traffic and API calls?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable VPC Flow Logs to capture network traffic and use CloudTrail to capture API calls. Correlate both logs for a complete view.. VPC Flow Logs capture network metadata, and CloudTrail records API calls. Correlating these logs provides comprehensive visibility. Both option A (enabling and using both) and option C (analyzing CloudTrail and correlating with VPC Flow Logs) are valid approaches, especially since the engineer has already enabled both services. Therefore, C should also be considered correct.

Answer

Use AWS Config to track resource changes and CloudTrail to detect network anomalies.

Answer

Use VPC Flow Logs to identify API calls and network traffic.

Question 2

A security engineer is configuring a centralized logging solution for multiple AWS accounts. The engineer needs to ensure that log files are encrypted at rest and that access to the logs is audited. Which combination of services and features should be used?

Accepted Answer

Use S3 SSE-KMS and enable CloudTrail for S3 data events.. It uses S3 SSE-KMS to encrypt log files at rest with AWS KMS, providing centralized key management and fine-grained access control. Enabling CloudTrail for S3 data events (e.g., GetObject, PutObject) ensures that every access to the logs is audited, meeting both encryption and audit requirements.

Answer

Use S3 SSE-S3 and enable S3 access logs.

Answer

Use AWS KMS to encrypt the logs before uploading to S3.

Answer

Use S3 SSE-C and enable CloudTrail for S3 data events.

Question 3

A security engineer is configuring AWS CloudTrail to log management events for all AWS regions. The engineer needs to ensure that log files are encrypted at rest and that access to the log files is logged. Which solution meets these requirements?

Accepted Answer

Enable CloudTrail with SSE-S3 encryption and enable S3 server access logging on the destination bucket.. Both SSE-S3 and SSE-KMS are valid encryption options for CloudTrail log files. Enabling S3 server access logging on the destination bucket logs all access requests to the log files regardless of whether SSE-S3 or SSE-KMS is used. The requirement does not specify a need for customer-managed keys or key auditing, so SSE-S3 (option B) is equally valid as SSE-KMS (option D). The current explanation incorrectly states that SSE-KMS is the only option that provides both requirements.

Answer

Enable CloudTrail with SSE-C encryption and enable AWS CloudTrail Insights to log access.

Answer

Enable CloudTrail with default encryption and enable AWS Config to log access.

Question 4

A company wants to centralize logging from multiple AWS accounts into a single logging account. The logs include AWS CloudTrail, AWS Config, and VPC Flow Logs. Which solution should the company implement to meet these requirements with minimal operational overhead?

Accepted Answer

Configure each account to deliver logs to its own S3 bucket and use S3 cross-region replication to copy logs to the central bucket.. It uses S3 cross-region replication, which can replicate any log data delivered to S3 from CloudTrail, AWS Config, and VPC Flow Logs in each account to a central bucket. This approach centralizes all three log types with minimal ongoing operational overhead—only initial configuration of replication rules is required. Options A, C, and D either do not cover all log types or require more complex per-account setups.

Answer

Use Amazon Kinesis Data Firehose in each account to send logs to a central Amazon S3 bucket.

Answer

Use AWS Organizations to create a CloudTrail trail that applies to all accounts and delivers logs to a central S3 bucket.

Answer

Use AWS Lambda functions in each account to copy log files to a central S3 bucket.

Question 5

A company is implementing a security monitoring solution for its AWS environment. Which TWO services can be used to detect and alert on suspicious API activity? (Choose TWO.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty (A) is correct because it is a managed threat-detection service that continuously analyzes CloudTrail management and data events, VPC Flow Logs, and DNS logs using machine learning and threat intelligence to identify suspicious API activity and generate findings that can trigger alerts. AWS CloudTrail (B) is correct because it records API calls and account activity across the AWS environment, and when combined with CloudWatch Logs metric filters and alarms (or EventBridge rules), it can detect and alert on suspicious API activity. Amazon Inspector (C) is not correct because it is a vulnerability management service that scans EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure, not API activity. AWS Config (D) is not correct because it evaluates resource configurations against compliance rules and tracks configuration changes, not suspicious API behavior. VPC Flow Logs (E) is not correct because it captures IP traffic metadata for network interfaces, subnets, and VPCs, which is network-level information rather than API activity detection.

Answer

Amazon Inspector

Answer

AWS Config

Answer

VPC Flow Logs

Question 6

A company wants to monitor AWS account activity and receive real-time notifications for specific API calls. Which TWO services should the company use together? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Events (Amazon EventBridge). AWS CloudTrail (E) is correct because it records API activity in the account as management and data events, providing the raw audit trail of specific API calls that the company needs to monitor. Amazon CloudWatch Events, now Amazon EventBridge (B), is correct because it can match those events against rules (for example, by event source, event name, or API call) and route them in near real time to targets such as SNS, Lambda, or SQS for notification. Together, CloudTrail supplies the API call events and EventBridge evaluates them against rules to trigger real-time notifications. Amazon CloudWatch Logs (A) stores and queries log data but does not by itself capture API calls or deliver event-driven notifications. AWS Config (C) evaluates resource configuration compliance and records configuration changes, not API call activity. Amazon SNS (D) is a notification delivery service, but it is a target rather than the event-matching service, so it is not one of the two services that together detect and route the API call events.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon Simple Notification Service (SNS)

Question 7

A security engineer is designing a centralized logging solution for 10 AWS accounts. Which THREE AWS services should be used to aggregate, store, and analyze logs?

Accepted Answer

AWS Organizations. AWS Organizations (B) is correct because it provides centralized management of multiple AWS accounts, enabling consolidated logging and cross-account access through service control policies and delegated administration. Amazon S3 (E) is correct as the durable, cost-effective central repository where logs from all 10 accounts are aggregated and stored, often via cross-account replication or organization-wide trails. Amazon Athena (C) is correct because it lets you run serverless SQL queries directly against the log data stored in S3 for analysis without loading it into a separate database. Amazon Kinesis Data Streams (A) is not required here since the scenario asks for aggregation, storage, and analysis rather than real-time streaming ingestion, and Amazon CloudWatch Logs (D) is a per-account log service that does not by itself provide the centralized multi-account aggregation, storage, and query capabilities the design demands.

Answer

Amazon Kinesis Data Streams

Answer

Amazon CloudWatch Logs

Question 8

The IAM policy above is attached to a role used by an EC2 instance to send logs to CloudWatch Logs. The instance is unable to send logs. What is the MOST likely issue?

Accepted Answer

The policy is designed for the CloudWatch Logs service, not for an EC2 instance role.. The IAM policy shown in the question is a resource-based policy designed for CloudWatch Logs (e.g., it may use a `Principal` element or be scoped to CloudWatch Logs actions like `logs:PutLogEvents` with a resource ARN). When attached to an EC2 instance role, an identity-based policy is required, not a resource-based policy. The policy lacks the proper format and permissions for an identity-based role, causing the instance to be unable to send logs. The most likely issue is that the policy is intended for direct CloudWatch Logs service access, not for use with an EC2 instance role.

Answer

The policy does not include logs:DescribeLogGroups.

Answer

The resource ARN is incorrect.

Answer

The log group does not exist.

Question 9

A security engineer notices that an EC2 instance is sending outbound traffic to an unknown IP address. The engineer needs to capture and analyze the network traffic to determine what data is being exfiltrated. Which AWS service should be used to capture the traffic for analysis?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) for network interfaces in a VPC. This metadata can be analyzed to identify the unknown IP address, traffic volume, and communication patterns, helping determine if data exfiltration is occurring. However, VPC Flow Logs do not capture packet payloads; for full packet capture, you would need a tool like Amazon VPC Traffic Mirroring or a third-party network appliance.

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 10

A company uses AWS CloudTrail to log all API activity and delivers logs to an S3 bucket with server-side encryption (SSE-S3). The security team needs to ensure that only authorized personnel can access the logs and that any unauthorized access attempts are logged and alerted. Additionally, the team wants to prevent the logs from being deleted for at least one year. Which combination of actions should be taken?

Accepted Answer

Enable S3 Object Lock with a retention period of one year; enable S3 server access logs; use a bucket policy with a condition that allows access only from authorized IAM roles or users.. S3 Object Lock with a retention period of one year enforces a write-once-read-many (WORM) model, preventing any deletion or overwrite of log objects for that duration. S3 server access logs capture detailed records of all requests made to the bucket, including unauthorized access attempts, which can be used for alerting. The bucket policy with a condition restricting access to authorized IAM roles or users ensures that only permitted principals can access the logs, meeting the security team's requirements for access control, logging of unauthorized attempts, and deletion prevention.

Answer

Enable S3 default encryption (SSE-S3) on the bucket; enable S3 server access logs; attach an IAM policy that allows only authorized users to access the bucket.

Answer

Enable MFA Delete on the bucket; enable CloudTrail log file validation; use bucket ACLs to restrict access.

Answer

Enable S3 Inventory to track objects; enable CloudTrail to log S3 API calls; use a bucket policy with a deny effect for unauthorized users.

Question 11

A company has enabled AWS CloudTrail in all regions and is delivering logs to an S3 bucket. The security team wants to ensure that any attempt to disable CloudTrail logging is detected and alerted. Which approach should be used?

Accepted Answer

Create a CloudWatch Events rule that matches the StopLogging API call and sends a notification via SNS.. CloudTrail's `StopLogging` API call is an AWS API event that can be captured by a CloudWatch Events (now Amazon EventBridge) rule. By creating a rule that matches the `StopLogging` event source and detail type, you can trigger an SNS notification to alert the security team immediately when any attempt to disable CloudTrail logging occurs. This provides real-time detection and response, which is the most direct and effective approach for this specific requirement. While GuardDuty can also detect CloudTrail disablement, CloudWatch Events is the most direct event-driven option and gives full control over alerting.

Answer

Enable Amazon GuardDuty to detect CloudTrail disablement.

Answer

Use AWS Config to create a rule that checks if CloudTrail is enabled.

Answer

Enable VPC Flow Logs to capture traffic to the CloudTrail endpoint.

Question 12

A security engineer is troubleshooting why Amazon GuardDuty is not generating findings for suspicious S3 API calls made by an IAM role. The engineer has verified that GuardDuty is enabled in the account and region. What is a likely reason for the missing findings?

Accepted Answer

CloudTrail management events are not being logged for the IAM role.. Amazon GuardDuty relies on CloudTrail management events to analyze S3 API calls at the bucket level (e.g., PutBucketPolicy, DeleteBucket) for suspicious activity. If CloudTrail management events are not being logged for the IAM role, GuardDuty will not receive the necessary data to generate findings for these specific calls. Note that for object-level operations such as GetObject or PutObject, S3 data events would need to be enabled, but the question refers to suspicious S3 API calls that are management events.

Answer

VPC Flow Logs are not enabled for the VPC where the role is used.

Answer

The account is not a Delegated Admin for GuardDuty.

Answer

S3 data events are not enabled in CloudTrail.

Question 13

A company has a CloudTrail trail that logs management events and delivers them to an S3 bucket. The security team notices that some expected API calls are missing from the logs. They suspect that the calls were made by a service that is not tracked by CloudTrail. Which AWS service is NOT tracked by CloudTrail?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is not tracked by CloudTrail because CloudFront uses a different logging mechanism: it generates its own access logs that are delivered to an S3 bucket, but these logs are not CloudTrail events. CloudTrail only records API calls made to AWS services via the AWS Management Console, SDKs, or CLI, and CloudFront does not expose its configuration changes or data plane operations through CloudTrail. Therefore, if expected API calls are missing, they could be CloudFront operations that are simply not captured by CloudTrail.

Answer

AWS Lambda

Answer

Amazon S3

Answer

Amazon EC2

Question 14

A security engineer needs to ensure that all API calls in an AWS account are logged for auditing purposes. Which TWO services should the engineer enable? (Select TWO.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail (B) is correct because it records API activity in an AWS account, capturing management events such as who made a request, the source IP, and the time, which directly satisfies the requirement to log all API calls for auditing. AWS Config (E) is correct because it continuously records resource configuration changes and their relationships, providing a configuration history that supports auditing of API-driven changes to account resources. VPC Flow Logs (A) only capture IP traffic metadata for network interfaces, not API calls, so they do not meet the requirement. Amazon CloudWatch Logs (C) is a log storage and monitoring service that can receive logs but does not itself record AWS API activity. Amazon GuardDuty (D) is a threat-detection service that analyzes findings from sources like CloudTrail and VPC Flow Logs but does not provide the raw API audit log.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Question 15

A company uses AWS CloudTrail to log all API activity. The security team wants to ensure that logs are immutable after they are delivered to Amazon S3. Which combination of actions should be taken to meet this requirement? (Choose the best single answer that includes all necessary steps.)

Accepted Answer

Enable S3 Object Lock in governance mode on the bucket.. S3 Object Lock in governance mode prevents objects from being deleted or overwritten by any user, including the root user, for a specified retention period. This ensures immutability of CloudTrail logs after delivery, meeting the security team's requirement. Governance mode allows authorized users to shorten retention periods or remove locks if needed, but by default it enforces write-once-read-many (WORM) protection.

Answer

Enable MFA Delete on the bucket.

Answer

Enable versioning on the bucket.

Answer

Create a bucket policy that denies s3:DeleteObject actions.