SCS-C02 Security Logging and Monitoring Practice Test 5 — 15 Questions

Question 1

A security engineer needs to collect and analyze operating system logs from EC2 instances. Which TWO services are required?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the service that stores, monitors, and accesses operating system logs from EC2 instances. However, to collect and send those logs to CloudWatch Logs, you must install and configure the Amazon CloudWatch Agent on the EC2 instances. The CloudWatch Agent can collect logs from the OS (e.g., /var/log/syslog, /var/log/messages, Windows Event Log) and forward them to CloudWatch Logs for analysis.

Answer

Amazon VPC Flow Logs

Answer

AWS Config

Answer

AWS CloudTrail

Question 2

Which THREE actions can be performed using AWS CloudTrail to enhance security monitoring?

Accepted Answer

Detect unauthorized API calls by analyzing CloudTrail logs.. AWS CloudTrail records API activity in your AWS account, including calls to IAM, S3, and other services. By analyzing CloudTrail logs, you can detect unauthorized API calls (Option B) because every API call is logged with details such as the identity, source IP, and timestamp, enabling security monitoring and alerting on suspicious actions.

Answer

Monitor SSH login attempts to EC2 instances.

Answer

Capture all network traffic to and from EC2 instances.

Question 3

A security engineer needs to capture all DNS queries made by EC2 instances in a VPC and send them to a security analytics tool. Which AWS service should be used to capture this traffic?

Accepted Answer

AWS Network Firewall. AWS Network Firewall can be configured with stateful rule groups that inspect and log DNS traffic. By enabling DNS logging on the firewall, it captures all DNS queries and responses passing through the VPC, which can then be sent to a security analytics tool via Amazon S3, CloudWatch Logs, or Kinesis Data Firehose. This makes it the correct service for capturing DNS queries from EC2 instances.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Question 4

A company uses AWS Organizations and wants to centralize security logs from all member accounts into a single S3 bucket in the management account. The bucket policy allows only the management account's root user to write objects. However, logs are not being delivered from member accounts. What is the MOST likely cause?

Accepted Answer

The bucket policy denies write access to all principals except the management account's root user, preventing cross-account writes.. The bucket policy explicitly restricts write access to only the management account's root user. For cross-account log delivery from member accounts, the policy must grant write permissions to the logging service (e.g., AWS CloudTrail or AWS Config) in each member account. Without such permissions, the service cannot write objects to the bucket, causing log delivery to fail.

Answer

S3 Transfer Acceleration is not enabled.

Answer

VPC endpoints are not configured for the logging service.

Answer

The S3 bucket uses an AWS KMS key, and the key policy does not grant decrypt permissions to the logging service.

Question 5

A security engineer needs to monitor for failed SSH login attempts to EC2 instances and send alerts. Which combination of AWS services should be used?

Accepted Answer

CloudWatch Logs agent on EC2, CloudWatch Logs metric filter, and CloudWatch Alarm.. The CloudWatch Logs agent on EC2 can stream SSH auth logs (e.g., /var/log/secure or /var/log/auth.log) to CloudWatch Logs. A metric filter can then parse these logs for failed SSH login patterns (e.g., 'Failed password'), and a CloudWatch Alarm can trigger an SNS notification or other action when the metric exceeds a threshold. This combination directly monitors OS-level authentication events, which is required for detecting failed SSH attempts.

Answer

VPC Flow Logs and Amazon Athena.

Answer

AWS CloudTrail and Amazon SNS.

Answer

Amazon S3 event notifications and AWS Lambda.

Question 6

A company uses AWS CloudTrail to log all API activity. A security analyst notices that some delete operations on S3 buckets are missing from the CloudTrail logs. What is the MOST likely reason?

Accepted Answer

The trail is configured to log only management events, not data events.. CloudTrail trails can be configured to log management events (control plane operations like CreateBucket) and/or data events (data plane operations like GetObject, DeleteObject). By default, a trail logs only management events. S3 delete operations on objects within a bucket are data events, so if the trail is not configured to log data events, those delete operations will not appear in CloudTrail logs.

Answer

The S3 bucket has server access logging enabled, which overrides CloudTrail.

Answer

The delete operations are performed by a cross-account role, which CloudTrail does not log.

Answer

The root user of the account is excluded from CloudTrail logging.

Question 7

An organization has a requirement to retain all security logs for at least 7 years for compliance. The logs are stored in Amazon S3 and are rarely accessed. Which storage class is the MOST cost-effective for this retention period?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is the most cost-effective storage class for data that is rarely accessed and must be retained for 7 years. It offers the lowest storage cost among S3 classes, designed specifically for long-term retention of archival data where retrieval times of 12 hours are acceptable. The compliance requirement for 7-year retention aligns perfectly with Glacier Deep Archive's intended use case, minimizing costs while meeting the retention mandate.

Answer

S3 Standard

Answer

S3 One Zone-IA

Answer

S3 Intelligent-Tiering

Question 8

A security team wants to receive real-time notifications when an IAM user makes a change to a security group. Which AWS service should be used to trigger the notification?

Accepted Answer

AWS CloudTrail with Amazon CloudWatch Events. AWS CloudTrail captures API calls made by IAM users, including changes to security groups (e.g., AuthorizeSecurityGroupIngress, RevokeSecurityGroupEgress). By sending these CloudTrail events to Amazon CloudWatch Events (now part of Amazon EventBridge), you can create a rule that matches specific API calls and triggers a notification via SNS, Lambda, or other targets in real time.

Answer

AWS Config

Answer

Amazon S3 event notifications

Answer

Amazon GuardDuty

Question 9

A company has multiple AWS accounts and wants to centrally aggregate VPC Flow Logs from all accounts into a single S3 bucket in the logging account. What is the MOST secure way to configure cross-account delivery?

Accepted Answer

Create VPC Flow Logs in each account, specifying the central S3 bucket ARN as the destination, and configure the bucket policy to allow the flow logs service principal to write.. VPC Flow Logs can be published directly to an S3 bucket in another account by specifying the bucket ARN as the destination. The logging account's bucket policy must grant the `s3:PutObject` permission to the VPC Flow Logs service principal (`delivery.logs.amazonaws.com`) for the cross-account write to succeed. This approach avoids sharing credentials or introducing additional services, maintaining a secure and direct delivery path.

Answer

Use AWS CloudTrail to log flow logs and deliver to the central bucket.

Answer

Share the central bucket's access key with each account to write directly.

Answer

Use Amazon Kinesis Data Firehose to stream flow logs from each account to the central S3 bucket.

Question 10

A security engineer needs to ensure that all objects uploaded to an S3 bucket are automatically scanned for malware before being made accessible to users. Which solution is MOST appropriate?

Accepted Answer

Use S3 event notifications to invoke an AWS Lambda function that runs a malware scanning solution.. S3 event notifications can be configured to trigger an AWS Lambda function upon object creation, allowing the Lambda function to run a malware scanning solution (e.g., using ClamAV or an AWS Marketplace partner) before the object is made accessible. This serverless approach ensures automated, near-real-time scanning without manual intervention, and the Lambda function can quarantine or delete malicious objects by adjusting S3 bucket policies or object ACLs.

Answer

Enable VPC Flow Logs to capture all access to the bucket.

Answer

Enable S3 Object Lock on the bucket.

Answer

Configure Amazon CloudWatch Logs to monitor S3 access logs.

Question 11

Which TWO actions are valid ways to send application logs from an EC2 instance to Amazon CloudWatch Logs? (Select TWO.)

Accepted Answer

Install and configure the unified CloudWatch agent on the EC2 instance.. The unified CloudWatch agent (option C) is a valid and recommended method for collecting application logs from EC2 instances and sending them to CloudWatch Logs. It supports collecting logs from various sources, including syslog, and can also collect metrics, providing a single agent for both monitoring and logging.

Answer

Configure the EC2 instance to stream syslog to AWS CloudTrail.

Answer

Write logs to an S3 bucket and use S3 event notifications to send to CloudWatch Logs.

Answer

Enable VPC Flow Logs to capture application traffic.

Question 12

Which THREE are features of Amazon GuardDuty that help with threat detection? (Select THREE.)

Accepted Answer

Analyzes VPC Flow Logs.. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. It ingests and analyzes VPC Flow Logs (option C) to detect suspicious network traffic patterns, such as port scans or data exfiltration attempts. This analysis is a core feature of GuardDuty's threat detection capabilities.

Answer

Analyzes AWS Config configuration history.

Answer

Analyzes S3 object content for malware.

Question 13

Which TWO AWS services can be used to centrally collect and analyze logs from multiple AWS accounts? (Select TWO.)

Accepted Answer

Amazon Athena (to query logs in S3). Amazon S3 can serve as a centralized log repository by aggregating logs from multiple AWS accounts using cross-account S3 bucket policies. Amazon Athena can then query those logs directly in S3 using standard SQL, enabling centralized analysis without moving data. Together, they provide a scalable, serverless solution for multi-account log collection and analysis.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS Shield

Question 14

Refer to the exhibit. A security engineer configured this S3 bucket policy to allow CloudTrail to deliver logs. However, logs are not being delivered. What is the MOST likely reason?

Accepted Answer

The policy is missing s3:GetBucketAcl permission for CloudTrail.. CloudTrail requires the s3:GetBucketAcl permission on the S3 bucket to verify that the bucket policy grants the necessary access for log delivery. Without this permission, CloudTrail cannot confirm it has write access, and log delivery fails even if s3:PutObject is allowed. Option D correctly identifies this missing permission as the root cause.

Answer

The Resource should be arn:aws:s3:::my-trail-bucket/*, not with AWSLogs prefix.

Answer

The Principal is set to a service, but must be an AWS account ID.

Answer

The Action should be s3:GetObject, not s3:PutObject.

Question 15

Refer to the exhibit. This is a line from a VPC Flow Log. A security analyst notices that the log shows an ACCEPT record for a connection from 10.0.1.5 to 10.0.2.10 on port 443. However, the analyst expected the connection to be denied. Which field in the flow log record indicates that the connection was accepted?

Accepted Answer

The action field (ACCEPT). The action field in a VPC Flow Log record explicitly indicates whether the firewall (security group or network ACL) allowed or denied the traffic. In this case, the value 'ACCEPT' confirms that the connection from 10.0.1.5 to 10.0.2.10 on port 443 was permitted, which is why the analyst sees an ACCEPT record despite expecting a denial.

Answer

The version field (2)

Answer

The protocol field (6)

Answer

The destination port field (443)