SCS-C02 Security Logging and Monitoring Practice Test 6 — 15 Questions

Question 1

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The security team needs to monitor for unauthorized changes to security groups. They have enabled AWS Config with the security-group-change detection rule. However, they notice that changes are being detected but not all changes trigger a notification. The team wants to ensure that every security group modification (create, delete, or rule change) sends an alert to the security operations center via Amazon SNS. The current setup: AWS Config rules evaluate resources periodically, and SNS notifications are sent only when the rule compliance status changes. What should the team do to achieve real-time alerts for all security group changes?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an Amazon EventBridge rule that matches API calls via CloudTrail for security group modifications and sends notifications to an SNS topic.. CloudTrail logs all API calls, including security group modifications, in real time. By creating an Amazon EventBridge rule that matches SecurityGroup events and targets an SNS topic, the team can receive immediate notifications. Option A is incorrect because GuardDuty focuses on threat detection (e.g., suspicious API activity), not on monitoring all security group configuration changes. Option C is incorrect because even with frequent evaluations, AWS Config rules evaluate configuration snapshots periodically and do not provide real-time alerting for each change. Option D is incorrect because VPC Flow Logs monitor network traffic, not security group modifications.

Answer

Deploy Amazon GuardDuty and enable the Security Group Monitoring feature.

Answer

Increase the frequency of AWS Config rule evaluations to every minute to reduce detection latency.

Answer

Enable VPC Flow Logs and set up a metric filter for security group-related traffic anomalies.

Question 2

A company is migrating its on-premises log aggregation system to AWS. They have multiple applications running on EC2 instances that generate logs in JSON format. The security team needs a centralized logging solution that can ingest logs from all instances, store them durably, and allow real-time searching and alerting. The team also needs to retain logs for at least one year for compliance. The current plan is to use Amazon CloudWatch Logs for ingestion and search, but the team is concerned about the cost of long-term storage and the need for ad-hoc querying. Which solution meets the requirements with the LEAST operational overhead?

Accepted Answer

Use the CloudWatch agent to send logs to CloudWatch Logs for real-time monitoring, then export logs to Amazon S3 daily, and use S3 lifecycle policies to expire logs after one year.. Option C combines CloudWatch Logs for real-time ingestion, search, and alerting with daily export to S3 for cheap durable storage, and S3 lifecycle policies to expire objects after one year — satisfying real-time monitoring, durability, compliance retention, and ad-hoc querying (via Athena on S3) with minimal operational overhead. This is the canonical AWS pattern for cost-effective centralized logging. The other options either overpay for storage, lack real-time capability, or add unnecessary operational burden.

Answer

Send all logs to CloudWatch Logs and set a retention policy of one year.

Answer

Send logs directly to an S3 bucket and use Amazon Athena to query logs in real time.

Answer

Send logs to Amazon OpenSearch Service (formerly Elasticsearch) with a one-year retention policy.

Question 3

A company has a multi-account AWS environment using AWS Organizations. The security team wants to centralize all CloudTrail logs from all accounts into a single S3 bucket in the management account. They have enabled CloudTrail in the management account with an organization trail that delivers logs to an S3 bucket. However, logs from member accounts are not appearing. The S3 bucket policy includes permissions for CloudTrail to write logs, but it does not explicitly grant access to member accounts. What should the team do to ensure that member account CloudTrail logs are delivered to the central S3 bucket?

Accepted Answer

Verify that the organization trail is configured correctly with the 'Include all accounts in my organization' option enabled, and that the S3 bucket policy allows CloudTrail to write from all accounts.. For an organization trail to deliver logs from all member accounts to a central S3 bucket, the trail must be configured with the 'Include all accounts in my organization' option enabled. Additionally, the S3 bucket policy must allow CloudTrail to write logs from all accounts, typically by granting permission to the CloudTrail service principal with a condition that restricts to the organization ID. This ensures member account logs are delivered.

Answer

Ask each member account to create a new trail that delivers logs to the same S3 bucket.

Answer

Disable the organization trail and recreate it, ensuring that all member accounts are selected.

Answer

Modify the S3 bucket policy to grant write access to the CloudTrail service principal for each member account's AWS account ID.

Question 4

Refer to the exhibit. A security engineer investigates a potential unauthorized deletion of an AWS CloudTrail trail. The engineer runs the command and receives the output shown. Which additional step should the engineer take to determine if the trail deletion was unauthorized?

Accepted Answer

Enable AWS Config rules to monitor CloudTrail configuration changes and cross-reference the event time with an approved change window.. The question asks for an ADDITIONAL step to determine whether the deletion was authorized. AWS Config rules can monitor CloudTrail configuration changes (e.g., using the cloudtrail-enabled managed rule) and record the exact time the trail was deleted. Cross-referencing that event time against an approved change window is the standard way to distinguish an authorized maintenance action from an unauthorized deletion.

Answer

Check the source IP address 203.0.113.50 against a list of approved corporate IP ranges.

Answer

Review the IAM user 'admin' permissions to see if they have the cloudtrail:DeleteTrail permission.

Answer

Use CloudTrail Insights to detect unusual API activity for the DeleteTrail event.

Question 5

Refer to the exhibit. A security engineer applies this S3 bucket policy to enforce server-side encryption. However, users report that they can still upload objects without encryption. What is the most likely reason the policy is not working as intended?

Accepted Answer

The policy uses 's3:x-amz-server-side-encryption-customer-algorithm' instead of the correct condition key 's3:x-amz-server-side-encryption'.. The policy likely uses the condition key 's3:x-amz-server-side-encryption-customer-algorithm' instead of the correct key 's3:x-amz-server-side-encryption'. The former enforces SSE-C, while the latter is required for general server-side encryption (SSE-S3 or SSE-KMS). Because the policy uses the SSE-C-specific key, it does not apply to requests that lack that header, allowing users to upload unencrypted objects. Option A is incorrect because bucket policies apply to all principals, including the bucket owner, regardless of the access method. Option B is incorrect because using 'Deny' with a condition is the standard method to enforce encryption. Option C is incorrect because the PutObjectAcl action is not related to encryption enforcement.

Answer

The bucket policy does not apply to objects uploaded by the bucket owner when using the AWS Management Console.

Answer

The bucket policy uses 'Deny' instead of 'Allow', which is incorrect for enforcing encryption.

Answer

The policy does not include 's3:PutObjectAcl' action, so users can bypass encryption via ACLs.

Question 6

Refer to the exhibit. A security engineer wants to monitor a Lambda function for errors and create a CloudWatch alarm when errors exceed a threshold. The engineer notices the log group exists but has no metric filters. What should the engineer do to set up the alarm?

Accepted Answer

Create a metric filter on the log group to count occurrences of 'ERROR' in log streams, then create an alarm based on that metric.. CloudWatch Logs metric filters allow you to extract and count specific patterns (like 'ERROR') from log streams, and then create a CloudWatch alarm based on that metric. This directly addresses the requirement to monitor the Lambda function for errors without needing to modify the function code or rely on external tools.

Answer

Enable CloudWatch Contributor Insights for the Lambda function to automatically detect errors.

Answer

Configure the Lambda function to publish custom metrics for errors instead of relying on logs.

Answer

Use CloudWatch Logs Insights to query logs for errors and create an alarm directly from the query results.

Question 7

Refer to the exhibit. An AWS Config rule 's3-bucket-ssl-requests-only' evaluates whether S3 buckets deny HTTP requests. The exhibit shows the evaluation result and the bucket policy. Why is the bucket marked as NON_COMPLIANT despite having a Deny policy for HTTP requests?

Accepted Answer

The bucket policy is missing the 'aws:SecureTransport': 'false' condition for the bucket resource (without /*).. The AWS Config rule 's3-bucket-ssl-requests-only' requires that the bucket policy explicitly deny both HTTP requests to the bucket itself (arn:aws:s3:::bucket-name) and to its objects (arn:aws:s3:::bucket-name/*). The exhibit shows a policy that only includes the object resource with the condition 'aws:SecureTransport': 'false', but omits the bucket resource. Without a Deny statement covering the bucket ARN without the /*, the rule considers the bucket non-compliant because HTTP requests to the bucket (e.g., ListBucket, GetBucketAcl) are not explicitly denied. The correct fix is to add a second Resource entry for the bucket itself with the same condition.

Answer

The policy uses 'Deny' but the rule expects an 'Allow' statement for HTTPS only.

Answer

The bucket policy only denies HTTP requests to objects, not to the bucket itself.

Answer

The annotation says 'Bucket does not have a policy that denies HTTP requests.' but the policy does have one, so this is a false positive.

Question 8

Refer to the exhibit. An IAM policy is attached to a Lambda execution role. Which action will be denied if the Lambda function attempts to write logs to a log group in a different AWS account?

Accepted Answer

logs:PutLogEvents. The policy allows 'logs:PutLogEvents' only for a specific log group ARN in account 123456789012. Writing to a log group in another account would require a different ARN, so the action will be denied by default.

Answer

All actions will be allowed.

Answer

logs:CreateLogStream

Answer

s3:PutObject

Question 9

Refer to the exhibit. A security engineer is investigating a CloudTrail event. Which statement is true about the trail that was created?

Accepted Answer

The trail will log global service events.. The CloudTrail event shown in the exhibit indicates that the trail was created with the `--include-global-service-events` flag (or equivalent console setting), meaning it will capture events from global services like IAM, STS, and CloudFront. In AWS CloudTrail, global service events are only logged if the trail is configured to include them; by default, trails created via the console include global events, but trails created via CLI/SDK do not unless explicitly specified. The exhibit likely shows the `CreateTrail` API call with `IncludeGlobalServiceEvents` set to true, confirming that the trail will log global service events.

Answer

The source IP address is from an AWS service.

Answer

The trail was created using the AWS CLI.

Answer

The trail is a single-region trail.

Question 10

Refer to the exhibit. A CloudWatch Logs metric filter is configured. Which log event will trigger the filter to create a metric?

Accepted Answer

"ERROR: Connection refused". The metric filter pattern is configured to match log events that begin with the string 'ERROR:'. Option B starts with 'ERROR:', so it triggers the metric filter. Options A, C, and D start with a timestamp and do not match the pattern.

Answer

"2023-01-01 12:00:00 ERROR Connection refused"

Answer

"2023-01-01 12:00:00 WARNING Disk full"

Answer

"2023-01-01 12:00:00 INFO Starting process"

Question 11

A security engineer is configuring Amazon GuardDuty in a multi-account environment managed by AWS Organizations. The engineer wants to ensure that GuardDuty is enabled in all existing and future member accounts and that findings are centralized in the management account. The engineer has already enabled GuardDuty in the management account. Which additional step should the engineer take?

Accepted Answer

In the management account, designate a delegated administrator for GuardDuty and enable the service in all member accounts via the Organizations console.. Designating a delegated administrator for GuardDuty in the management account allows centralized management of GuardDuty across all member accounts in AWS Organizations. This automatically enables GuardDuty for new accounts and aggregates findings to the delegated administrator account, meeting the requirements.

Answer

Use AWS Config to record GuardDuty configurations and set up an aggregator to collect findings.

Answer

Create an IAM role in each member account that allows the management account to assume it and enable GuardDuty.

Answer

Enable AWS CloudTrail in all member accounts and configure CloudTrail to send logs to a central S3 bucket.

Question 12

A security engineer needs to monitor for any changes to IAM policies across all accounts in an AWS Organization. The engineer wants to receive an alert within 5 minutes of a policy change and ensure that the alert includes the identity that made the change. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Enable AWS CloudTrail in all accounts and configure a CloudWatch Logs metric filter for IAM policy changes, then create a CloudWatch alarm that publishes to an SNS topic.. CloudTrail logs all IAM policy changes as management events. A CloudWatch Logs metric filter can detect specific API calls, and an alarm can trigger SNS notifications quickly. This approach is low-overhead, works across accounts when CloudTrail is organization-wide, and captures the userIdentity. Other options either do not monitor the specific event, add complexity, or are designed for threat detection rather than change monitoring.

Answer

Use AWS Config with the iam-policy-in-use rule and configure the rule to send notifications to an SNS topic.

Answer

Set up an Amazon EventBridge rule that matches CloudTrail API calls for IAM policy changes and targets an SNS topic.

Answer

Enable Amazon GuardDuty in all accounts and configure findings to be sent to an SNS topic.

Question 13

A security engineer needs to capture VPC Flow Logs for a production VPC and analyze them for rejected traffic. The engineer wants to query the logs with minimal setup and no need to manage a database or ETL pipeline. Which solution meets these requirements?

Accepted Answer

Publish VPC Flow Logs to CloudWatch Logs and use CloudWatch Logs Insights to query them.. VPC Flow Logs can be delivered to CloudWatch Logs, where CloudWatch Logs Insights offers immediate, interactive querying without managing storage schemas or ETL. This satisfies the requirement to analyze rejected traffic with minimal setup. The other choices either require more infrastructure, introduce unnecessary services, or use the wrong log type entirely.

Answer

Publish VPC Flow Logs to Amazon S3 and use Amazon Athena to query them.

Answer

Enable AWS CloudTrail data events for the VPC and query them in Amazon CloudWatch Logs Insights.

Answer

Publish VPC Flow Logs to Amazon Kinesis Data Firehose and use AWS Lambda to parse and store them in Amazon DynamoDB.

Question 14

A company uses AWS CloudTrail to log all API activity. A security engineer needs to receive an alert whenever an IAM policy is changed to allow public access to an S3 bucket. The engineer has configured CloudTrail to deliver logs to CloudWatch Logs. Which solution will meet this requirement with the LEAST operational overhead?

Accepted Answer

Create a CloudWatch Logs metric filter for the PutBucketPolicy event and an alarm that publishes to an Amazon SNS topic.. CloudWatch Logs metric filters can monitor for specific API calls like PutBucketPolicy and trigger an alarm to an SNS topic. This is a native, serverless solution that requires minimal configuration and no custom code, making it the least operational overhead.

Answer

Enable Amazon GuardDuty and configure it to alert on S3 bucket policy changes that allow public access.

Answer

Create an AWS Lambda function that is triggered by CloudTrail logs via Amazon S3 event notifications and parses the logs for policy changes.

Answer

Use AWS Config to monitor S3 bucket policies and trigger an Amazon EventBridge rule when a policy changes to public.

Question 15

A security engineer is configuring AWS CloudTrail in a multi-account organization. The engineer needs to ensure that CloudTrail log files are encrypted at rest using a customer-managed AWS KMS key that the security team controls, and that the key policy allows CloudTrail to encrypt logs but does not allow any other AWS account to decrypt them. Which combination of actions will meet these requirements?

Accepted Answer

Create a customer-managed KMS key in the same account as the S3 bucket that receives the logs, update the key policy to allow CloudTrail to encrypt and the bucket owner to decrypt, and configure the trail to use this key.. A customer-managed KMS key gives the security team full control over the key policy, allowing them to grant CloudTrail encryption permissions and limit decryption to authorized principals. Creating the key in the same account as the S3 bucket simplifies key management and policy scoping. AWS managed keys and SSE-S3 do not provide the required control.

Answer

Use an AWS managed key (aws/cloudtrail) for encryption and modify its key policy to deny decryption to all other accounts.

Answer

Enable default encryption on the S3 bucket using SSE-S3 and rely on bucket policies to restrict access to the log files.

Answer

Create a customer-managed KMS key in the management account, configure the key policy to allow CloudTrail to use the key for encryption, and specify this key when creating the trail.