SCS-C02 Security Logging and Monitoring Practice Test 6 — 15 Questions

Question 1

A security engineer is investigating a potential security incident. They suspect that an IAM user's credentials were compromised and used to launch EC2 instances in a region where the user normally does not operate. Which AWS service can help the engineer identify the source IP address and user agent of the API calls that launched the instances?

Accepted Answer

AWS CloudTrail. Option B is correct because AWS CloudTrail records all API calls with details like source IP address and user agent. Option A is incorrect because Amazon Inspector is for vulnerability assessment. Option C is incorrect because AWS CloudHSM is for hardware security modules. Option D is incorrect because AWS Artifact is for compliance reports.

Answer

AWS CloudHSM

Answer

Amazon Inspector

Answer

AWS Artifact

Question 2

Which TWO actions should a security engineer take to ensure that Amazon GuardDuty can effectively monitor for suspicious activity in a VPC? (Choose two.)

Accepted Answer

Enable DNS query logging and publish to CloudWatch Logs.. Option B is correct because GuardDuty can analyze VPC Flow Logs for network activity. Option C is correct because GuardDuty can analyze DNS logs for suspicious domain queries. Option A is incorrect because CloudTrail management events are already analyzed by GuardDuty, but enabling data events is not necessary. Option D is incorrect because GuardDuty does not analyze Config history. Option E is incorrect because GuardDuty does not analyze S3 access logs directly.

Answer

Enable CloudTrail data events for S3.

Answer

Enable S3 server access logs.

Answer

Enable AWS Config configuration history.

Question 3

Which THREE are best practices for securing AWS CloudTrail log files? (Choose three.)

Accepted Answer

Restrict access to the S3 bucket using a bucket policy that requires MFA and encryption.. Option A is correct because encrypting logs at rest protects confidentiality. Option C is correct because enabling log file integrity validation ensures tamper detection. Option D is correct because limiting access to the S3 bucket using bucket policies ensures only authorized principals can access logs. Option B is incorrect because CloudTrail logs should be retained for at least one year, not 30 days. Option E is incorrect because CloudTrail does not support cross-region delivery to a single bucket automatically without additional configuration.

Answer

Deliver logs to an S3 bucket in the same region as the trail.

Answer

Set a lifecycle policy to delete logs after 30 days.

Question 4

Which TWO AWS services can be used to monitor and detect unauthorized changes to Amazon S3 bucket policies? (Choose two.)

Accepted Answer

AWS CloudTrail. Option A is correct because AWS Config can track changes to S3 bucket policies and trigger notifications. Option B is correct because CloudTrail logs API calls that modify S3 bucket policies. Option C is incorrect because CloudWatch Logs is for storing logs, not detecting changes. Option D is incorrect because VPC Flow Logs do not track S3 policy changes. Option E is incorrect because GuardDuty does not monitor S3 policy changes.

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch Logs

Answer

Amazon VPC Flow Logs

Question 5

A company uses AWS CloudTrail to log all API calls. The security team needs to be alerted when an IAM user creates a new access key. Which approach is most efficient?

Accepted Answer

Create a CloudWatch Events rule that matches the CreateAccessKey event and targets an SNS topic.. Option B is correct because CloudWatch Events can filter specific API calls and trigger a Lambda function to send notifications. Option A is incorrect because CloudTrail does not natively send alerts; it delivers logs to S3. Option C is incorrect because CloudWatch Logs Insights requires querying logs manually, not real-time alerting. Option D is incorrect because Config records resource changes but is not optimized for API call alerts.

Answer

Enable AWS Config managed rule to detect access key creation and trigger an SNS notification.

Answer

Use CloudWatch Logs Insights to run a query every minute on CloudTrail logs and send results to SNS.

Answer

Configure CloudTrail to send logs to an S3 bucket and enable S3 event notifications to an SNS topic.

Question 6

A security engineer needs to centralize logs from multiple AWS accounts into a single S3 bucket. Which solution is most secure?

Accepted Answer

Configure each account's CloudTrail to deliver to a centralized S3 bucket in a logging account, with a bucket policy allowing CloudTrail from source accounts.. Option A is correct because using a centralized S3 bucket with a bucket policy that grants cross-account permissions from each source account's CloudTrail is a standard secure approach. Option B is incorrect because writing from one account to another requires explicit permissions, not automatic. Option C is incorrect because delivering to separate buckets then copying adds complexity and potential security gaps. Option D is incorrect because Kinesis Firehose can be used but is not required; S3 bucket policy is simpler and secure.

Answer

Deliver logs to separate buckets per account and use S3 replication to copy them to a central bucket.

Answer

Use a single S3 bucket in the management account and have each account write logs directly without additional permissions.

Answer

Stream logs to Amazon Kinesis Data Firehose in each account and consolidate into a single S3 bucket via cross-account delivery.

Question 7

A company is using Amazon GuardDuty to detect threats. The security team notices that GuardDuty findings are not triggering the intended automated response via a CloudWatch Events rule. What is the most likely reason?

Accepted Answer

The CloudWatch Events rule's event pattern does not match the GuardDuty finding event structure.. Option D is correct because GuardDuty sends findings as custom events in the 'aws.guardduty' source; the CloudWatch Events rule must have an event pattern that matches this source and detail type. Option A is incorrect because GuardDuty does not require VPC Flow Logs to generate findings. Option B is incorrect because GuardDuty findings are generated in the region where GuardDuty is enabled; cross-region aggregation is not a common issue. Option C is incorrect because IAM roles are not required for CloudWatch Events to trigger a Lambda function; Lambda needs a role to execute, but that wouldn't prevent the event from triggering.

Answer

The GuardDuty detector is in a different region than the CloudWatch Events rule.

Answer

The Lambda function invoked by CloudWatch Events does not have an IAM role assigned.

Answer

VPC Flow Logs are not enabled.

Question 8

A company wants to monitor for unauthorized changes to its Amazon S3 bucket policies. Which AWS service should be used to detect such changes?

Accepted Answer

AWS Config. Option C is correct because AWS Config has managed rules like 's3-bucket-policy-not-more-permissive' that can evaluate bucket policies. Option A is incorrect because CloudTrail logs API calls but does not evaluate policies. Option B is incorrect because GuardDuty detects threats but not policy compliance. Option D is incorrect because CloudWatch Logs Insights can query logs but is not proactive detection.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch Logs Insights

Question 9

A security analyst needs to review all failed SSH login attempts to an EC2 instance. Which combination will provide this information?

Accepted Answer

Enable VPC Flow Logs for the subnet and query the logs in CloudWatch Logs Insights for rejected traffic on port 22.. Option B is correct because VPC Flow Logs capture network traffic metadata including destination port and action (accept/reject), and CloudWatch Logs Insights can query for SSH traffic (port 22) that was rejected. Option A is incorrect because CloudTrail logs API calls, not OS-level login attempts. Option C is incorrect because CloudWatch agent can collect OS logs but is not the simplest way; VPC Flow Logs are more straightforward. Option D is incorrect because Config does not monitor OS logs.

Answer

Use AWS Config to record EC2 instance configuration and check for security group changes.

Answer

Install the CloudWatch agent on the EC2 instance to collect /var/log/secure and stream to CloudWatch Logs.

Answer

Enable AWS CloudTrail and search for EC2-related events.

Question 10

A company has enabled AWS CloudTrail in all accounts and regions, with log file validation enabled. The security team needs to verify that a specific log file has not been modified since it was delivered. Which action should be taken?

Accepted Answer

Use the AWS CLI `validate-logs` command with the digest file from the S3 bucket.. Option A is correct because CloudTrail provides a digest file that contains a hash of each log file; you can use the AWS CLI command `aws cloudtrail validate-logs` to verify integrity. Option B is incorrect because S3 server-side encryption does not provide integrity verification. Option C is incorrect because CloudWatch Logs Insights does not validate log file integrity. Option D is incorrect because S3 Object Lock prevents deletion but not modification of existing objects; it does not verify integrity against a digest.

Answer

Query the log files using Amazon CloudWatch Logs Insights.

Answer

Enable S3 server-side encryption with AWS KMS (SSE-KMS) on the CloudTrail bucket.

Answer

Enable S3 Object Lock on the bucket to prevent modifications.

Question 11

A company wants to receive real-time notifications for every root user login to the AWS Management Console. Which service should be used?

Accepted Answer

Amazon CloudWatch Events. Option B is correct because CloudWatch Events can match the RootLogin event from CloudTrail and trigger an SNS notification. Option A is incorrect because CloudTrail itself does not send notifications. Option C is incorrect because GuardDuty may detect unusual root activity but is not designed for real-time notifications of all root logins. Option D is incorrect because AWS Config does not monitor root logins.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Config

Question 12

A security engineer notices that an S3 bucket containing sensitive logs is publicly accessible. Which service should be used to automatically remediate this by applying a bucket policy?

Accepted Answer

AWS Config. Option C is correct because AWS Config rules can be set to auto-remediate using Systems Manager Automation or Lambda functions to apply a restrictive bucket policy. Option A is incorrect because CloudTrail cannot remediate. Option B is incorrect because GuardDuty detects threats but does not remediate S3 bucket policies. Option D is incorrect because Trusted Advisor provides best practice checks but does not automatically remediate.

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 13

A company is using Amazon Macie to discover sensitive data in S3. The security team wants to be notified when Macie finds a high-severity alert. Which integration should be used?

Accepted Answer

Create an Amazon EventBridge rule that matches Macie findings and targets an SNS topic.. Option D is correct because Macie can publish findings to Amazon EventBridge (formerly CloudWatch Events), which can then trigger SNS notifications. Option A is incorrect because Macie does not send to CloudWatch Logs directly. Option B is incorrect because Macie does not send to S3 directly; it stores findings in its own service. Option C is incorrect because Macie does not natively integrate with Security Hub for alerting; EventBridge is the direct method.

Answer

Configure Macie to store findings in an S3 bucket and enable S3 event notifications.

Answer

Integrate Macie with AWS Security Hub and create a custom action to send to SNS.

Answer

Configure Macie to send findings to CloudWatch Logs and create a metric filter.

Question 14

A security team needs to monitor for unauthorized API calls in their AWS account. Which TWO services can provide real-time alerts for such events?

Accepted Answer

AWS CloudTrail with Amazon CloudWatch Events. Options A and D are correct. CloudTrail logs API calls, and when combined with CloudWatch Events, can trigger real-time alerts. GuardDuty also detects suspicious API activity and can generate findings in real-time. Option B is incorrect because AWS Config evaluates resource configurations, not API calls. Option C is incorrect because VPC Flow Logs capture network traffic, not API calls. Option E is incorrect because CloudWatch Logs Insights is a query tool, not a real-time alerting service.

Answer

Amazon CloudWatch Logs Insights

Answer

Amazon VPC Flow Logs

Answer

AWS Config

Question 15

A company wants to ensure that all S3 buckets are encrypted at rest. Which THREE services can be used to detect and alert on unencrypted buckets?

Accepted Answer

AWS Config. Options A, B, and C are correct. AWS Config has a managed rule 's3-bucket-server-side-encryption-enabled' to detect unencrypted buckets. CloudTrail logs PutBucketEncryption API calls, and you can set up CloudWatch Events to alert when encryption is not enabled. Security Hub aggregates findings from multiple services including Config and GuardDuty, and can generate alerts. Option D is incorrect because VPC Flow Logs do not relate to S3 encryption. Option E is incorrect because CloudWatch Logs Insights is a query tool, not a detection service.

Answer

Amazon CloudWatch Logs Insights

Answer

Amazon VPC Flow Logs