SCS-C02 Security Logging and Monitoring Practice Test 6 — 15 Questions

Question 1

A security engineer notices that S3 server access logs are not being delivered to the specified destination bucket. The source bucket has a bucket policy that grants s3:PutObject permission to the Log Delivery group. The destination bucket is in the same AWS account but a different region. What is the most likely cause of the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The destination bucket is in a different AWS region.. S3 server access logs are delivered by the Log Delivery group, which is a special AWS service principal. When the destination bucket is in a different AWS region, the Log Delivery group cannot write logs cross-region because S3 server access logging only supports delivering logs to a bucket in the same region as the source bucket. This is a hard limitation of the S3 service, not a permission or configuration issue.

Answer

The destination bucket does not have versioning enabled.

Answer

The destination bucket is in a different AWS account.

Answer

The Log Delivery group does not have an IAM role assigned.

Question 2

A DevOps engineer is configuring VPC Flow Logs for a subnet that contains a public-facing Application Load Balancer (ALB). The engineer wants to capture only accepted traffic for security analysis. What should the engineer do?

Accepted Answer

Create a flow log with a custom format that includes the 'action' field, and filter for 'ACCEPT'.. When creating a VPC Flow Log, you can specify a filter for traffic type: All, Accepted, or Rejected. To capture only accepted traffic, create a flow log with the filter set to 'ACCEPT'. Option D best represents this, as it says to create a flow log and filter for 'ACCEPT'. The custom format is not required but does not prevent correct configuration. Option A is a workaround that captures all traffic and then filters using CloudWatch Logs, which is unnecessary and less efficient.

Answer

Create a flow log and use a subscription filter in CloudWatch Logs to include only records with 'ACCEPT'.

Answer

Configure the security group to log only accepted traffic.

Answer

Use the default flow log format and filter at the S3 bucket using S3 Select.

Question 3

A company is using AWS CloudTrail to monitor API activity. The security team wants to be alerted when an IAM user creates a new access key. Which CloudTrail event should be used to create a CloudWatch Events rule?

Accepted Answer

CreateAccessKey. The correct event is CreateAccessKey because this is the specific CloudTrail event that is logged when an IAM user creates a new access key. CloudTrail captures this API call as a management event, and a CloudWatch Events rule can be configured to match this event name to trigger an alert. The security team's requirement is to detect the creation of access keys, which is directly represented by the CreateAccessKey event.

Answer

EnableMFADevice

Answer

UpdateAccessKey

Answer

UploadSigningCertificate

Question 4

A security analyst wants to monitor unsuccessful login attempts to the AWS Management Console. Which AWS service and log combination should be used?

Accepted Answer

AWS CloudTrail.. AWS CloudTrail is the correct service because it records all API calls made to the AWS Management Console, including failed login attempts (ConsoleLogin events with an 'errorMessage' field). CloudTrail logs these events as management events, which can be delivered to Amazon CloudWatch Logs or an S3 bucket for monitoring and alerting. This makes it the only option that captures authentication failures at the console level.

Answer

Amazon S3 server access logs.

Answer

VPC Flow Logs.

Answer

Amazon CloudWatch Logs.

Question 5

A company is using AWS Config to track resource changes. They want to receive notifications when a security group is modified to allow inbound traffic from 0.0.0.0/0. What is the most efficient way to achieve this?

Accepted Answer

Create a custom AWS Config rule with an AWS Lambda function that checks for public inbound traffic.. AWS Config custom rules allow you to define a Lambda function that evaluates security group configurations against your compliance requirements. By writing a rule that checks for inbound rules with '0.0.0.0/0' on ports like SSH (22) or RDP (3389), you can trigger notifications via Amazon SNS when non-compliant changes occur. This is the most efficient approach as it directly monitors the desired condition without relying on external services or manual log analysis.

Answer

Use IAM Access Analyzer to detect publicly accessible security groups.

Answer

Enable Amazon GuardDuty and use its findings for security group changes.

Answer

Create a CloudTrail trail and filter on AuthorizeSecurityGroupIngress events.

Question 6

A security engineer is investigating a potential security incident and needs to determine if an EC2 instance was launched with a specific AMI ID. Which AWS log should be examined?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made within an AWS account, including the RunInstances API call that launches an EC2 instance. The CloudTrail event for RunInstances contains the AMI ID in the request parameters, allowing you to determine if a specific AMI was used. This makes CloudTrail the correct log to examine for this investigation.

Answer

AWS Config timeline

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs (EC2 agent logs)

Question 7

A company uses Amazon GuardDuty and wants to automatically isolate a compromised EC2 instance by removing it from the security group. Which approach should be used?

Accepted Answer

Create an Amazon EventBridge rule that triggers an AWS Lambda function to remove the instance from the security group.. Amazon GuardDuty publishes findings to Amazon EventBridge, which can be used to trigger an AWS Lambda function. The Lambda function can then call the EC2 API to modify the security group and remove the compromised instance, achieving automated isolation without requiring direct GuardDuty integration with security groups.

Answer

Set up an AWS Config rule to detect the finding and remediate.

Answer

Configure GuardDuty to directly modify the security group.

Answer

Use AWS Systems Manager Automation to automatically modify the security group based on GuardDuty findings.

Question 8

A security engineer is investigating a possible data exfiltration from an S3 bucket. Which THREE AWS services can be used to detect and alert on suspicious activity? (Choose THREE.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, including data exfiltration from S3 buckets. It uses machine learning and integrated threat intelligence to analyze CloudTrail management and data events, VPC flow logs, and DNS logs, generating alerts for suspicious patterns like unusual data transfers or API calls from known malicious IPs.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 9

Refer to the exhibit. A security analyst is reviewing a VPC Flow Log entry. The analyst wants to determine if this flow represents a potentially malicious RDP connection. Based on the log, which conclusion is most accurate?

Accepted Answer

The connection is likely an RDP connection disguised to evade detection.. The VPC Flow Log entry shows destination port 443 (HTTPS) and a TCP SYN flag (12), but the source port is 3389, which is the default port for RDP. This mismatch—RDP source port with HTTPS destination port—indicates the traffic is likely RDP traffic disguised as HTTPS to evade detection, as RDP typically uses port 3389 for both source and destination. The 'ACCEPT' field confirms the connection was allowed, so it is a potentially malicious RDP connection.

Answer

The connection is normal HTTPS traffic destined for the instance.

Answer

The connection was blocked by the security group.

Answer

The connection represents outbound traffic from the instance.

Question 10

Refer to the exhibit. A security engineer finds this S3 bucket policy on a bucket that should be private. What is the most effective way to detect if this bucket was accessed by unauthorized users?

Accepted Answer

Query AWS CloudTrail for GetObject API calls.. AWS CloudTrail is the most effective service for auditing S3 API calls such as GetObject because it records detailed information including the source IP, user identity, and timestamp. While S3 server access logs also capture request details, they are delivered asynchronously, are not real-time, and lack the comprehensive identity and integration capabilities of CloudTrail. To identify unauthorized access, CloudTrail provides the authoritative audit trail, assuming data events are enabled for the bucket.

Answer

Enable S3 server access logs on the bucket.

Answer

Use CloudWatch Logs to search for GetObject events.

Answer

Analyze VPC Flow Logs for traffic to the bucket.

Question 11

A company is using AWS CloudTrail to log API calls and wants to ensure that log files are not tampered with after delivery to S3. Which feature should be enabled to validate the integrity of CloudTrail log files?

Accepted Answer

Enable CloudTrail log file validation. Enabling CloudTrail log file validation creates a digest file for each log file delivery, which includes a SHA-256 hash of the log file. This digest is signed using the private key of a dedicated CloudTrail key pair, allowing you to verify the integrity and authenticity of the log files by comparing the hash against the digest, ensuring no tampering occurred after delivery to S3.

Answer

Enable MFA Delete on the S3 bucket

Answer

Enable S3 Versioning on the bucket

Answer

Enable S3 bucket default encryption

Question 12

A security team notices that an S3 bucket containing sensitive data has been repeatedly accessed from an IP address outside the company's network. They need to set up a real-time alert when such access occurs. Which combination of services should they use?

Accepted Answer

Amazon GuardDuty and Amazon EventBridge. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity, including unusual API calls and unauthorized access patterns from external IPs. When GuardDuty detects such access to an S3 bucket, it can generate findings that are sent to Amazon EventBridge, which then triggers a real-time alert (e.g., via SNS or Lambda). This combination provides immediate, automated notification of the suspicious access without requiring custom log parsing.

Answer

VPC Flow Logs and Amazon QuickSight

Answer

AWS Config and Amazon SNS

Answer

CloudWatch Logs Insights and Amazon SES

Question 13

A company wants to monitor CPU utilization of their EC2 instances and receive an alert when utilization exceeds 80% for 5 consecutive minutes. Which AWS service should be used to set up this metric alarm?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms is the correct service because it is specifically designed to monitor CloudWatch metrics, such as EC2 CPU utilization, and trigger actions (e.g., SNS notifications) when a metric crosses a defined threshold for a specified number of consecutive evaluation periods. In this scenario, you would create a CloudWatch Alarm on the `CPUUtilization` metric with a threshold of 80%, set the period to 1 minute, and configure the alarm to evaluate 5 consecutive datapoints (periods) to meet the '5 consecutive minutes' requirement.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS CloudTrail

Question 14

A security engineer is reviewing AWS CloudTrail logs and finds that an IAM user 'developer1' deleted an S3 bucket. The engineer needs to determine the source IP address of the delete operation. Which field in the CloudTrail log record contains this information?

Accepted Answer

sourceIPAddress. The `sourceIPAddress` field in a CloudTrail log record captures the IP address from which the API call was made. For S3 bucket deletion via the AWS Management Console, AWS CLI, or SDK, this field records the originating IP address, enabling the security engineer to trace the delete operation back to its source.

Answer

userIdentity

Answer

requestParameters

Answer

eventTime

Question 15

A company is using Amazon RDS for MySQL and needs to monitor database login attempts for security analysis. Which feature should be enabled to capture authentication events?

Accepted Answer

Enable RDS MySQL audit logs. RDS for MySQL supports the MySQL audit log plugin, which logs authentication events such as successful and failed login attempts. Enabling this feature via the 'audit_logs' option group parameter captures detailed connection and login records, which can be stored in CloudWatch Logs for security analysis.

Answer

Enable VPC Flow Logs for the RDS subnet

Answer

Enable AWS CloudTrail data events for RDS

Answer

Enable the '--log_queries_not_using_indexes' parameter