SCS-C02 Security Logging and Monitoring Practice Test 5 — 15 Questions

Question 1

A security team wants to detect and alert on suspicious network traffic patterns within their VPC. They need to capture traffic to and from an EC2 instance for analysis. Which THREE services should be used together to achieve this? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Network Firewall. VPC Traffic Mirroring (E) is the correct capture mechanism because it copies inbound and outbound traffic from the EC2 instance's elastic network interface to a target such as a Network Load Balancer or Gateway Load Balancer for deep packet inspection and analysis. AWS Network Firewall (A) is correct because it provides stateful, intrusion prevention and detection (Suricata-compatible rules) plus domain filtering at the VPC perimeter, generating alerts on suspicious traffic patterns that the mirrored traffic can be inspected against. Amazon Detective (C) is correct because it ingests and analyzes VPC Flow Logs, CloudTrail, and GuardDuty findings to build behavior graphs and help investigate suspicious network activity and alert on anomalies. Network Load Balancer (B) is not a detection or alerting service; it only distributes TCP/UDP traffic and may serve as a mirror target but does not itself detect patterns. AWS WAF (D) is incorrect because it protects HTTP(S) web applications at Layer 7 against web exploits and bots, not general VPC network traffic capture or anomaly detection.

Answer

Network Load Balancer

Answer

AWS WAF

Question 2

A company needs to monitor for unauthorized changes to its Amazon S3 bucket policies. Which TWO services can be used together to achieve this? (Choose two.)

Accepted Answer

AWS Config. AWS Config (D) is correct because it continuously records and evaluates the configuration state of AWS resources, including S3 bucket policies, and can detect and flag unauthorized or noncompliant policy changes against desired rules. Amazon SNS (E) is correct because it works together with AWS Config as the notification mechanism, delivering alerts to subscribers (email, SMS, Lambda, SQS) whenever Config detects a policy change or compliance violation. Together they form a detect-and-notify pipeline for unauthorized S3 bucket policy modifications. Amazon Route 53 (A) is a DNS and domain registration service and has no role in monitoring resource configuration changes. VPC Flow Logs (C) capture IP traffic metadata for network interfaces in a VPC, not S3 bucket policy changes. AWS CloudTrail (B) records API activity and could log PutBucketPolicy calls, but it is not marked correct here; the intended monitoring-and-alerting pair is AWS Config plus Amazon SNS.

Answer

Amazon Route 53

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Question 3

Refer to the exhibit. A security engineer has created an S3 bucket policy to allow AWS CloudTrail and VPC Flow Logs to deliver logs to the bucket. However, CloudTrail logs are not being delivered, but VPC Flow Logs are delivered successfully. What is the most likely cause?

Accepted Answer

The bucket policy does not grant CloudTrail permission to perform 's3:GetBucketAcl' and 's3:PutBucketAcl'.. CloudTrail requires explicit permissions to read the bucket ACL (s3:GetBucketAcl) and set the bucket ACL (s3:PutBucketAcl) to verify and apply the appropriate access control list for log delivery. Without these permissions, CloudTrail cannot confirm it has the necessary write access, causing log delivery to fail. VPC Flow Logs, on the other hand, do not require these ACL operations because they use a different delivery mechanism that relies solely on bucket policies.

Answer

The principal is set to a service instead of an AWS account.

Answer

The condition 's3:x-amz-acl' is misspelled.

Answer

The service principal in the policy is incorrect for CloudTrail.

Question 4

Refer to the exhibit. A security engineer is configuring the Amazon CloudWatch agent to collect logs from an Amazon ECS task. The configuration shown is used. However, the logs are not appearing in CloudWatch Logs. What is the most likely cause?

Accepted Answer

The configuration file is missing the 'logs' section at the top level.. The CloudWatch agent configuration requires a top-level 'logs' section to define log collection settings. Without this section, the agent ignores the log configuration entirely, even if the rest of the file is valid. The exhibit shows a configuration that likely has the log group, stream, and file settings nested under an incorrect or missing top-level key, preventing the agent from processing them.

Answer

The multi_line_start_pattern is missing a closing delimiter.

Answer

The datetime_format is incorrect for the logs.

Answer

The CloudWatch agent is not installed in the ECS task.

Question 5

Refer to the exhibit. A security engineer uses the AWS CLI command shown to investigate a console login event. What type of user performed the login?

Accepted Answer

IAM user. The `userIdentity` field in the CloudTrail log shows `arn:aws:iam::123456789012:user/Bob`, which is the ARN of an IAM user. The `type` field is `IAMUser`, confirming the login was performed by an IAM user. This is distinct from other identity types like assumed roles or root users.

Answer

AWS service

Answer

Assumed role

Answer

Root user

Question 6

A security engineer is configuring Amazon GuardDuty in a multi-account environment. The engineer wants to enable GuardDuty in the management account and automatically enable it for all member accounts. Which THREE steps are required?

Accepted Answer

Configure GuardDuty to automatically enable for all accounts in the organization via the Organizations integration.. Option E is correct because GuardDuty must first be enabled in the management account, which serves as the delegated administrator and orchestrates the organization-wide configuration. Option C is correct because, once the management account is set up, the Organizations integration allows GuardDuty to automatically enable protection for all existing and future member accounts without manual intervention. Options A and D are incorrect because manually enabling GuardDuty and accepting invitations are the legacy, non-Organizations workflow and are not required when using the Organizations integration. Option B is incorrect because GuardDuty does not require an S3 bucket per member account; findings are aggregated and exported only if you optionally configure an S3 bucket, typically in the delegated administrator account.

Answer

Have each member account manually enable GuardDuty.

Answer

Create an S3 bucket for GuardDuty findings in each member account.

Answer

Accept the invitation from the administrator account in each member account.

Question 7

A financial services company has a multi-account AWS environment with over 200 accounts managed through AWS Organizations. The security team is responsible for monitoring all accounts for security incidents. They have enabled AWS CloudTrail in all accounts with trails that deliver logs to a centralized S3 bucket in the security account. Additionally, they have enabled Amazon GuardDuty in all accounts with the security account as the administrator. The team uses Amazon EventBridge to trigger automated responses to GuardDuty findings. Recently, they noticed that some GuardDuty findings from member accounts are not appearing in the security account. The security team verified that the findings are generated in the member accounts (they can see them in the member account GuardDuty console) but are not being sent to the administrator account. The CloudTrail logs are being delivered correctly. What is the MOST likely cause of this issue?

Accepted Answer

The member accounts have not accepted the invitation from the GuardDuty administrator account.. When GuardDuty is managed through AWS Organizations with a delegated administrator, member accounts must accept the association/invitation before their findings are aggregated and visible in the administrator account. Until the member account accepts, GuardDuty continues to generate findings locally in that account, but those findings are not forwarded to the administrator. This exactly matches the symptom described: findings visible in the member console but absent from the security (admin) account.

Answer

The S3 bucket policy in the centralized logging bucket is blocking GuardDuty findings from being written.

Answer

The EventBridge rules in the security account are not configured to receive events from member accounts.

Answer

The GuardDuty service-linked role in the member accounts does not have permissions to publish findings to the administrator account.

Question 8

A security engineer notices that an IAM user in the company's AWS account is making API calls from an IP address outside the allowed corporate network. The engineer needs to be alerted immediately when such activity occurs. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Create an Amazon CloudWatch Events rule that matches the IAM user's API calls from the unauthorized IP and sends an SNS notification.. Amazon CloudWatch Events (now part of Amazon EventBridge) can be configured with a rule that matches the specific IAM user's API calls from an unauthorized IP address using the sourceIPAddress condition key in the event pattern. When the rule triggers, it sends an SNS notification directly, providing real-time alerting with minimal setup and no additional infrastructure or log analysis overhead.

Answer

Enable AWS Trusted Advisor and configure email notifications for security checks.

Answer

Enable VPC Flow Logs and analyze them with Amazon Athena to detect suspicious IPs.

Answer

Configure S3 server access logs on the IAM users' bucket and use Amazon Macie to detect anomalies.

Question 9

A security engineer is investigating a potential security incident. CloudTrail logs show that an IAM user 'admin' deleted an S3 bucket at 2023-01-15T10:30:00Z. The engineer needs to find the source IP address and user agent of the request. Which CloudTrail log field contains this information?

Accepted Answer

userAgent and sourceIPAddress. CloudTrail logs capture the `userAgent` and `sourceIPAddress` fields directly in the log event record. These fields are part of the CloudTrail `Event` record structure, specifically under the `userIdentity` and `sourceIPAddress` top-level attributes, and they provide the exact source IP address and user agent string (e.g., AWS CLI, SDK, console browser) for the API call that deleted the S3 bucket.

Answer

eventID

Answer

requestParameters

Answer

resources

Question 10

A company uses Amazon RDS for MySQL and wants to monitor database activity for suspicious queries. The security team needs to capture all SQL statements executed against the database, including SELECT queries. Which AWS service should they use?

Accepted Answer

Amazon RDS Enhanced Monitoring with database audit logs enabled and streamed to CloudWatch Logs.. Amazon RDS for MySQL supports native database audit logs that can capture all SQL statements, including SELECT queries, by enabling the `audit_log` plugin. These logs can be published to Amazon CloudWatch Logs for monitoring and alerting. Enhanced Monitoring provides OS-level metrics but does not capture SQL query content; the audit logs are the key mechanism for recording executed SQL statements.

Answer

AWS CloudTrail with data events enabled for RDS.

Answer

AWS Config with a custom rule to log database queries.

Answer

VPC Flow Logs to capture database traffic.

Question 11

Which TWO of the following are valid sources for Amazon CloudWatch Logs? (Select TWO.)

Accepted Answer

On-premises servers via the CloudWatch agent. Option D is correct because the unified CloudWatch agent can be installed on on-premises servers (as well as EC2 instances) and configured to publish log events directly to CloudWatch Logs log groups. Option E is correct because AWS CloudTrail can be configured with a CloudWatch Logs log group as a delivery target, sending management event records into CloudWatch Logs for metric filters and alarms. Option A is not a valid source in this form: RDS for MySQL publishes its error, slow query, and general logs to CloudWatch Logs, but the option as written refers to the logs generically and is not one of the two marked correct sources here. Option B is incorrect because VPC Flow Logs delivered to S3 go to an S3 bucket, not to CloudWatch Logs (only the CloudWatch Logs delivery option sends them there). Option C is incorrect because S3 server access logs are delivered to an S3 bucket as objects, not natively into CloudWatch Logs.

Answer

Amazon RDS for MySQL logs

Answer

VPC Flow Logs delivered to S3

Answer

Amazon S3 access logs

Question 12

A security engineer is investigating a potential data exfiltration incident. They suspect that an EC2 instance was compromised and used to transfer large amounts of data from an S3 bucket to an external IP address. The engineer has enabled VPC Flow Logs for the subnet where the EC2 instance resides, but the logs are not capturing traffic to the external IP. What is the most likely reason?

Accepted Answer

The traffic is routed through a NAT gateway, and flow logs are not enabled on the NAT gateway's subnet.. VPC Flow Logs are captured at the elastic network interface (ENI) level for the resource they are attached to. When an EC2 instance sends traffic to an external IP via a NAT gateway, the flow log on the instance's ENI records the traffic to the NAT gateway's private IP, not the external destination IP. To capture the external IP, flow logs must be enabled on the NAT gateway's ENI (or its subnet), where the translated public destination is visible.

Answer

The EC2 instance's security group is blocking the traffic.

Answer

VPC Flow Logs only capture rejected traffic.

Answer

VPC Flow Logs only capture traffic to and from other VPC resources.

Question 13

A security engineer needs to monitor for AWS account root user login events and automatically send a notification to the security team. The engineer has enabled CloudTrail and is sending logs to CloudWatch Logs. What is the least effort way to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches the event and triggers an SNS topic.. Creating a CloudWatch Events rule (now Amazon EventBridge) that matches the root user login event and triggers an SNS topic is the least effort way because it directly reacts to the specific event without needing to parse logs or create custom metrics. CloudTrail logs root login events, and CloudWatch Events can match them in near real-time. This approach requires minimal configuration and no additional services beyond what is already enabled.

Answer

Enable Amazon GuardDuty and use its finding for root user activity.

Answer

Create a metric filter on the CloudWatch Logs group and a CloudWatch alarm.

Answer

Use AWS Config managed rule to detect root user activity.

Question 14

A company stores sensitive data in an S3 bucket with SSE-KMS encryption. The security team wants to log all access attempts to the bucket, including successful and denied requests. They have enabled S3 server access logs and are delivering them to a different bucket. However, they notice that some access attempts are not logged. What is the most likely reason?

Accepted Answer

S3 server access logs do not log requests that are denied before reaching S3.. S3 server access logs capture requests that reach the S3 front-end, but they do not log requests that are denied before reaching S3, such as those blocked by VPC endpoint policies, bucket policies that deny at the edge, or IAM policies that deny before the request hits S3. In this scenario, the missing access attempts are likely denied at a layer before S3, so they never appear in server access logs. To capture all access attempts including those denied before S3, the company should use AWS CloudTrail data events for S3, which log both successful and denied requests at the API level.

Answer

The delivery bucket is in a different AWS account.

Answer

The access logs only log successful requests.

Answer

The bucket uses SSE-KMS encryption, which prevents logging.

Question 15

A security team wants to detect and alert on suspicious network traffic patterns within their VPC. They need to capture traffic to and from an EC2 instance for analysis. Which THREE services should be used together to achieve this? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon CloudWatch Events (EventBridge) and Amazon SNS. Amazon EventBridge (formerly CloudWatch Events) can match EC2 state-change events such as 'TerminateInstances' in near real time and route them to an SNS topic for alerting. This is the lowest-latency, most direct combination because EventBridge receives the event from the EC2 service itself, not from CloudTrail log ingestion, which can take several minutes.

Answer

CloudWatch Logs metric filter and CloudWatch alarm

Answer

AWS Config and AWS Lambda

Answer

Amazon GuardDuty and Amazon SNS