SCS-C02 Security Logging and Monitoring Practice Test 5 — 15 Questions

Question 1

A security engineer needs to analyze VPC Flow Logs to identify traffic to a known malicious IP address. The logs are stored in Amazon S3. Which approach is the most cost-effective for querying the logs?

Accepted Answer

Use Amazon Athena to query the logs in S3. Amazon Athena queries data in S3 directly, only paying for data scanned. QuickSight is for visualization. Redshift is expensive. EMR is overkill.

Answer

Load the logs into an Amazon Redshift cluster

Answer

Use Amazon EMR to run Spark jobs

Answer

Use Amazon QuickSight to connect to S3

Question 2

A company wants to receive notifications when AWS CloudTrail logs are delivered to an S3 bucket. Which TWO AWS services can be used together to achieve this? (Choose TWO.)

Accepted Answer

Amazon S3 Event Notifications. S3 Event Notifications can be sent to SNS, which can then send notifications. SQS is for queueing, not direct notifications. CloudWatch Events (now Amazon EventBridge) can also trigger on S3 events. CloudTrail does not send notifications directly.

Answer

AWS CloudTrail

Answer

AWS Lambda

Answer

Amazon Simple Queue Service (SQS)

Question 3

A security engineer needs to monitor DNS query logs for malicious domain names. Which THREE services can be used together to collect, analyze, and alert on DNS logs? (Choose THREE.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is correct because it can ingest DNS query logs from Route 53 Resolver Query Logs and serve as a centralized log storage and monitoring service. It allows you to create metric filters and alarms to detect patterns indicative of malicious domain queries, enabling real-time alerting on suspicious DNS activity.

Answer

Amazon GuardDuty

Answer

Amazon Athena

Question 4

A company wants to ensure that all API calls in their AWS account are logged and immutable. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Enable S3 Object Lock on the CloudTrail S3 bucket. CloudTrail logs API calls. To ensure immutability, S3 Object Lock prevents deletion or overwriting. MFA delete adds protection. Config does not prevent log tampering. KMS encrypts but does not prevent deletion.

Answer

Enable MFA delete on the S3 bucket

Answer

Use AWS Config rules to monitor CloudTrail configuration

Answer

Encrypt the S3 bucket with AWS KMS

Question 5

Refer to the exhibit. A security engineer created this S3 bucket policy to allow CloudTrail to deliver logs. However, log delivery is failing. What is the most likely cause?

Accepted Answer

The bucket policy does not allow s3:GetBucketAcl. CloudTrail requires s3:GetBucketAcl to verify bucket ownership. The bucket policy must also grant that action. The other options are not missing.

Answer

The bucket is not in the same region as the trail

Answer

The bucket policy does not specify a condition

Answer

The bucket is encrypted with SSE-KMS

Question 6

Refer to the exhibit. The security team is investigating a security incident in us-west-2 region. They notice that management events from us-west-2 are not appearing in the CloudTrail logs. Based on the exhibit, what is the most likely reason?

Accepted Answer

The trail is not a multi-region trail. The trail is not multi-region (IsMultiRegionTrail: false), so it only logs events in us-east-1. Global service events are included but that does not capture other regions.

Answer

The S3 bucket is in a different region

Answer

The trail is not logging data events

Answer

The trail does not have log file validation enabled

Question 7

Refer to the exhibit. A security engineer creates this CloudWatch Logs metric filter on a CloudTrail log group to detect root account usage. However, no metrics are generated. What is the most likely issue?

Accepted Answer

The metric filter pattern is incorrectly formatted. The filter pattern syntax is incorrect. CloudWatch Logs filter patterns for JSON use a different syntax, e.g., { ($.userIdentity.type = "Root") }. The backslashes are not needed.

Answer

The log group does not exist

Answer

CloudTrail is not enabled for the account

Answer

The metric namespace is invalid

Question 8

A company uses AWS CloudTrail to log all API calls in their AWS account. They need to ensure that log files are not tampered with after they are delivered to the S3 bucket. Which feature should be enabled to provide integrity validation?

Accepted Answer

Enable CloudTrail log file integrity validation.. Option B is correct because CloudTrail log file integrity validation uses SHA-256 hashing and digital signatures to verify that log files have not been altered. Option A is incorrect because server-side encryption (SSE-S3) only encrypts data at rest, not integrity. Option C is incorrect because S3 Versioning helps preserve object versions but does not validate integrity. Option D is incorrect because S3 Object Lock prevents deletion but not modification detection.

Answer

Enable S3 Versioning on the CloudTrail bucket.

Answer

Enable S3 server-side encryption with SSE-S3.

Answer

Enable S3 Object Lock on the CloudTrail bucket.

Question 9

A security engineer is designing a monitoring solution for an AWS Lambda function that processes sensitive data. The function occasionally fails due to timeouts. The engineer needs to be alerted immediately when the function fails and also wants to analyze the error logs. Which combination of services should the engineer use?

Accepted Answer

Amazon CloudWatch Logs and CloudWatch Alarms with Amazon SNS. Option D is correct because CloudWatch Logs captures Lambda execution logs, and CloudWatch Alarms can trigger SNS notifications based on metrics like errors. Option A is incorrect because CloudTrail records API calls, not function execution logs. Option B is incorrect because Config tracks resource configuration changes, not runtime errors. Option C is incorrect because Kinesis Data Firehose is for data streaming, not real-time alerting.

Answer

Amazon CloudWatch Logs and Amazon Kinesis Data Firehose

Answer

AWS CloudTrail and Amazon SNS

Answer

AWS Config and Amazon SNS

Question 10

A company has a multi-account AWS environment using AWS Organizations. The security team wants to centralize all CloudTrail logs from all accounts into a single S3 bucket in the management account. The bucket policy allows cross-account access. However, logs from member accounts are not being delivered. What is the most likely cause?

Accepted Answer

The S3 bucket policy does not grant `s3:PutObject` permission to the member accounts.. Option B is correct because CloudTrail in member accounts must have permissions via a bucket policy that grants the `s3:PutObject` action. Option A is incorrect because CloudTrail is enabled by default for the last 90 days, but that is not related to delivery. Option C is incorrect because CloudTrail supports delivering logs to another account's S3 bucket. Option D is incorrect because CloudTrail logs are delivered to a prefix, not a separate bucket.

Answer

CloudTrail cannot deliver logs to a bucket in a different account.

Answer

The S3 bucket is not configured with a CloudTrail prefix.

Answer

CloudTrail is not enabled in the member accounts.

Question 11

A company uses Amazon RDS for MySQL and wants to monitor database activity for security analysis. Which AWS service should be used to capture detailed database activity logs such as login attempts and query execution?

Accepted Answer

Amazon RDS Database Activity Streams. Option A is correct because Amazon RDS Enhanced Monitoring provides OS-level metrics, not database activity. Option B is correct because AWS CloudTrail logs API calls to RDS, not SQL queries. Option D is correct because AWS Config tracks configuration changes. Option C is the correct answer because database activity streams capture detailed SQL-level activity.

Answer

AWS CloudTrail

Answer

Amazon RDS Enhanced Monitoring

Answer

AWS Config

Question 12

A security engineer is configuring VPC Flow Logs for a VPC that hosts a web application. The engineer wants to capture all traffic to and from the internet. Which of the following is the most appropriate configuration?

Accepted Answer

Configure Flow Logs at the VPC level and publish to CloudWatch Logs with a log group name.. Option C is correct because VPC Flow Logs can capture all traffic types, including accepted and rejected traffic. Option A is incorrect because Flow Logs can capture both accepted and rejected traffic. Option B is incorrect because Flow Logs can be published to CloudWatch Logs or S3. Option D is incorrect because Flow Logs are not real-time; they are published periodically.

Answer

Configure Flow Logs at the subnet level and set the traffic type to 'Reject'.

Answer

Configure Flow Logs at the VPC level and set the traffic type to 'All'.

Answer

Configure Flow Logs at the subnet level and set the traffic type to 'Accepted'.

Question 13

A security team wants to collect and analyze logs from multiple AWS services including CloudTrail, VPC Flow Logs, and AWS WAF. They need a centralized solution that can filter, transform, and route logs to multiple destinations in near real-time. Which AWS service should they use?

Accepted Answer

Amazon Kinesis Data Streams combined with Amazon Kinesis Data Firehose. Option D is correct because Amazon CloudWatch Logs subscription filter can send logs to Lambda for transformation, but not route to multiple destinations easily. Option A is correct because Amazon Kinesis Data Streams can ingest logs and then use Kinesis Data Analytics for transformation and Kinesis Data Firehose for routing to multiple destinations. Option B is incorrect because S3 is a storage destination, not a processing and routing service. Option C is incorrect because CloudWatch Logs Insights is for querying, not real-time routing.

Answer

Amazon CloudWatch Logs Insights

Answer

Amazon CloudWatch Logs subscription filters with AWS Lambda

Answer

Amazon S3 with S3 Event Notifications

Question 14

A company wants to detect and alert on unauthorized API calls in their AWS account. Which AWS service can provide real-time notifications when specific API calls are made?

Accepted Answer

Amazon CloudWatch Events (EventBridge). Option B is correct because CloudWatch Events (now Amazon EventBridge) can match patterns in CloudTrail events and trigger notifications. Option A is incorrect because AWS Config evaluates resource configurations, not API calls. Option C is incorrect because AWS Trusted Advisor provides recommendations, not real-time alerts. Option D is incorrect because Amazon GuardDuty focuses on threat detection, not specific API call patterns.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 15

A company uses AWS CloudTrail and wants to ensure that logs are encrypted at rest using a customer-managed KMS key. The CloudTrail trail is configured to deliver logs to an S3 bucket. After enabling SSE-KMS on the S3 bucket, the logs are not being delivered. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant CloudTrail permission to use the key.. Option A is correct because CloudTrail needs explicit permissions to use the KMS key for encrypting log files. Option B is incorrect because CloudTrail can use KMS keys from other accounts. Option C is incorrect because CloudTrail supports SSE-KMS. Option D is incorrect because bucket policies for CloudTrail must allow `s3:PutObject`.

Answer

CloudTrail does not support SSE-KMS.

Answer

The KMS key is in a different AWS account.

Answer

The S3 bucket policy does not allow CloudTrail to write logs.