SCS-C02 Security Logging and Monitoring Practice Test 7 — 15 Questions

Question 1

A security engineer has enabled AWS CloudTrail in all regions and wants to ensure that CloudTrail log files are protected from tampering and that any attempt to delete them is detected. The engineer has already configured an S3 bucket with versioning and MFA delete. Which additional control should the engineer implement to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable CloudTrail log file integrity validation and store the digest files in a separate S3 bucket with restricted access.. CloudTrail log file integrity validation uses cryptographic hashing to prove that log files have not been modified or deleted after delivery. Digest files are created and can be stored separately. This directly addresses tamper detection. The other options either only prevent deletion, monitor configuration changes, or detect suspicious API activity, none of which verify log file integrity.

Answer

Configure an S3 bucket policy that denies s3:DeleteObject for all principals except the CloudTrail service principal.

Answer

Use Amazon GuardDuty to monitor CloudTrail logs for unusual API calls and enable findings for S3 bucket policy changes.

Answer

Enable AWS Config with the cloudtrail-enabled rule and configure an Amazon SNS notification for configuration changes.

Question 2

A company uses AWS Organizations with multiple accounts. A security engineer needs to centrally monitor and analyze AWS CloudTrail logs from all accounts. The engineer wants to use a single S3 bucket in the management account and ensure that member accounts can write logs to it. What should the engineer do to meet these requirements?

Accepted Answer

Create a trail in the management account and enable it for all accounts in the organization.. Creating a trail in the management account and enabling it for all accounts in the organization is the recommended way to centralize CloudTrail logs. CloudTrail automatically configures the S3 bucket policy and IAM roles for member accounts to write logs. This reduces operational overhead and ensures consistent logging across the organization.

Answer

Create a trail in each member account and configure each trail to deliver logs to the central S3 bucket.

Answer

Enable AWS Config in all accounts and configure it to deliver configuration snapshots to the central S3 bucket.

Answer

Use AWS CloudTrail Lake to aggregate logs from all accounts into a single event data store.

Question 3

A security engineer is configuring AWS CloudTrail to log data events for an Amazon S3 bucket. The engineer wants to log both read and write events for all objects in the bucket. Which two actions should the engineer take to ensure that data events are logged? (Choose two.)

Accepted Answer

Enable data events for the S3 bucket in the CloudTrail trail configuration.. To log data events for an S3 bucket, you must enable data events in the CloudTrail trail configuration and specify the bucket ARN. This ensures that object-level API calls are recorded. The other options either do not enable CloudTrail data events or are unrelated to the requirement.

Answer

Configure the S3 bucket to send access logs to a separate S3 bucket.

Answer

Configure the trail to log all management events and set the trail to apply to all Regions.

Answer

Ensure that the IAM role or user creating the trail has permissions to write to the S3 bucket and CloudWatch Logs.

Question 4

A security engineer needs to ensure that all Amazon S3 data events (such as GetObject and PutObject) for a critical bucket are logged and that the logs are protected from tampering. The engineer has already created a CloudTrail trail that logs management events to an S3 bucket. Which TWO additional steps should the engineer take to meet these requirements? (Choose two.)

Accepted Answer

Enable CloudTrail log file validation and store the digest files in a separate S3 bucket with restricted access.. To log S3 data events, the trail must be configured to include data events for the specific bucket. To protect logs from tampering, CloudTrail log file validation should be enabled, and digest files should be stored securely. These two steps together meet the logging and integrity requirements.

Answer

Configure the S3 bucket to use S3 Object Lock in compliance mode with a retention period.

Answer

Enable S3 server access logging on the bucket and deliver logs to the same S3 bucket.

Answer

Enable AWS CloudTrail Insights on the trail to detect unusual data event activity.

Question 5

A security engineer is setting up a centralized logging solution using AWS Organizations. The engineer wants to ensure that all member accounts send their AWS CloudTrail logs to a central S3 bucket in the management account. The engineer has already created the organization trail. Which TWO additional steps are required to ensure that member accounts can deliver logs to the central bucket? (Choose two.)

Accepted Answer

Update the S3 bucket policy to allow the CloudTrail service principal to put objects, with a condition that the aws:SourceArn matches the organization trail ARN.. For an organization trail to deliver logs to a central S3 bucket, the bucket policy must grant CloudTrail permission with a condition on the trail ARN, and the organization trail must be configured to apply to all accounts and specify that bucket. These two steps together enable cross-account delivery. The other options either use the wrong permission mechanism or are redundant.

Answer

Enable AWS CloudTrail in each member account individually and manually point each trail to the central bucket.

Answer

Enable S3 Block Public Access on the central bucket and configure an S3 bucket ACL that grants write access to the member accounts.

Answer

Create an IAM role in each member account that allows CloudTrail to assume it and write to the central bucket.

Question 6

A security engineer needs to analyze AWS CloudTrail logs to identify all API calls made by a specific IAM user over the past 90 days. The logs are stored in an S3 bucket. The engineer wants to use a serverless query service to run SQL queries directly on the logs without loading them into a database. Which AWS service should the engineer use?

Accepted Answer

Amazon Athena. Amazon Athena is a serverless query service that can run SQL directly on CloudTrail logs stored in S3. It requires no infrastructure management and integrates with the AWS Glue Data Catalog. CloudWatch Logs Insights, CloudTrail Lake, and Redshift Spectrum either require data to be in a different location, are not serverless, or add unnecessary complexity.

Answer

AWS CloudTrail Lake

Answer

Amazon CloudWatch Logs Insights

Answer

Amazon Redshift Spectrum

Question 7

A security engineer needs to monitor the root user account for any API activity across all regions. The engineer wants to receive an alert within minutes if the root user is used for any action. Which solution should the engineer implement?

Accepted Answer

Create an Amazon EventBridge rule that matches AWS API calls made by the root user, and target an Amazon SNS topic to send email notifications.. EventBridge is the most direct way to match CloudTrail events for root user activity and trigger immediate notifications. It works in near real time and can be configured across all regions. The other options either do not provide specific root user alerting or introduce unnecessary delay.

Answer

Use AWS Trusted Advisor to monitor root user activity and send notifications via Amazon SNS.

Answer

Enable AWS CloudTrail Insights and configure an alarm on the Insights metric for root user activity.

Answer

Configure an Amazon CloudWatch Logs metric filter on CloudTrail logs to match root user events and create an alarm that notifies via Amazon SNS.

Question 8

A security engineer is configuring AWS CloudTrail to log data events for an S3 bucket. The engineer wants to ensure that all object-level operations, including GetObject and PutObject, are logged. The engineer creates a trail and enables data events for the bucket. However, after testing, the engineer notices that some GetObject calls are not appearing in the logs. What is the most likely reason?

Accepted Answer

The S3 bucket is in a different region than the trail, and the trail is not configured as a multi-region trail.. CloudTrail data events are logged in the region where the trail is active. If the trail is single-region and the S3 bucket is in a different region, object-level operations on that bucket will not be captured. To log data events for buckets in multiple regions, the trail must be configured as multi-region. The other options are incorrect because versioning, bucket ownership, and bucket policies do not affect data event logging.

Answer

The GetObject calls were made by the bucket owner and are not logged by default.

Answer

Data events for S3 are only logged for buckets that have versioning enabled.

Answer

Data events for S3 require an additional S3 bucket policy that grants CloudTrail permission to read object metadata.

Question 9

A security engineer wants to capture all DNS queries made by EC2 instances to detect potential data exfiltration. Which AWS service should be used to log the DNS requests?

Accepted Answer

Use Route 53 Resolver DNS Firewall with query logging. Route 53 Resolver DNS Firewall with query logging is the correct choice because it is specifically designed to log all DNS queries made by EC2 instances that use the Route 53 Resolver. This service captures the domain names being queried, the source IP, and the response, enabling detection of DNS-based data exfiltration (e.g., DNS tunneling). It integrates directly with the VPC's DNS resolver, ensuring all outbound DNS traffic from EC2 instances is logged without additional agents.

Answer

Use Amazon GuardDuty

Answer

Enable VPC Flow Logs

Answer

Enable AWS CloudTrail

Question 10

A company uses AWS CloudTrail to log management events in all regions. The security team notices that some API calls made by an IAM user are not appearing in the CloudTrail event history. What is the most likely reason?

Accepted Answer

CloudTrail event history only retains events for 90 days; older events are not visible. D is correct because CloudTrail event history only retains the last 90 days of events. If the API calls were made more than 90 days ago, they would no longer appear in the event history, even though the trail itself may still be delivering log files to an S3 bucket for longer-term storage. The security team is likely looking at the event history rather than querying the S3 bucket or using Athena for older events.

Answer

The user used the AWS Management Console, not the CLI

Answer

The trail is configured for a single region only

Answer

The API calls were read-only and excluded by default

Question 11

A company requires real-time analysis of AWS CloudTrail logs to detect unauthorized API calls. The logs are stored in Amazon S3. Which architecture minimizes latency and cost?

Accepted Answer

Send CloudTrail logs to Amazon CloudWatch Logs, then use a subscription filter to Amazon Kinesis Data Firehose delivering to Amazon OpenSearch Service. It provides the lowest-latency path for real-time analysis: CloudTrail logs are delivered to CloudWatch Logs in near real-time, and a subscription filter streams them to Kinesis Data Firehose, which buffers and delivers directly to Amazon OpenSearch Service for immediate indexing and search. This architecture avoids batch processing, minimizes data movement overhead, and uses managed services that scale automatically, keeping both latency and cost low.

Answer

Use AWS Glue to crawl S3 and load into Amazon Redshift for analysis

Answer

Query CloudTrail logs directly using Amazon Athena

Answer

Configure S3 event notifications to invoke an AWS Lambda function that writes to Amazon OpenSearch Service

Question 12

A security engineer needs to be alerted when an IAM user attempts to modify an S3 bucket policy. Which method is the MOST efficient?

Accepted Answer

Create an Amazon CloudWatch Events rule that matches the PutBucketPolicy API call and triggers an SNS notification. Amazon CloudWatch Events (now Amazon EventBridge) can directly capture the PutBucketPolicy API call as a real-time event and trigger an SNS notification without any additional compute or polling. This is the most efficient method as it requires no log parsing, no custom code, and no additional infrastructure, providing immediate alerting with minimal overhead.

Answer

Enable VPC Flow Logs and analyze for S3 API traffic

Answer

Configure an AWS Config rule to detect changes and invoke a Lambda function

Answer

Enable S3 server access logs and parse them for PutBucketPolicy entries

Question 13

A company stores sensitive data in Amazon S3 and wants to detect and alert on any public read access to objects. Which combination of services provides the most comprehensive solution?

Accepted Answer

Enable S3 server access logging and use Amazon Athena to query logs, with CloudWatch Events to alert on specific patterns. S3 server access logs capture detailed records of all requests made to a bucket, including the requester, bucket name, request time, action, and response status. By using Amazon Athena to query these logs and CloudWatch Events to trigger alerts on patterns indicating public read access (e.g., a specific HTTP method like GET from an anonymous principal), you can detect and alert on unauthorized public reads comprehensively. This combination provides granular, queryable logging with event-driven alerting, covering both current and historical access patterns.

Answer

Enable VPC Flow Logs and analyze for S3 traffic

Answer

Use AWS Config rules to check for public bucket policies and alert via SNS

Answer

Enable S3 event notifications for all object-level events and send to Amazon SNS

Question 14

A security engineer needs to centrally collect and analyze AWS CloudTrail logs from multiple accounts. Which service is designed for this purpose?

Accepted Answer

Use AWS Organizations to create a CloudTrail trail that applies to all accounts. AWS Organizations allows you to create a single CloudTrail trail that applies to all accounts in the organization, centrally collecting management and data events into a single S3 bucket (and optionally CloudWatch Logs). This eliminates the need to manually configure trails in each account and ensures consistent logging across the entire organization, meeting the requirement for central collection and analysis.

Answer

Configure each account to send logs to a central S3 bucket

Answer

Enable Amazon GuardDuty in each account and aggregate findings

Answer

Use Amazon CloudWatch Logs to stream logs from each account to a central account

Question 15

A company uses AWS CloudTrail and wants to ensure that any modification to the trail itself is detected immediately. What should be done?

Accepted Answer

Create a CloudWatch Events rule that matches the StopLogging or UpdateTrail API calls and sends an alert. CloudWatch Events (now part of Amazon EventBridge) can be configured with a rule that matches specific API calls like StopLogging or UpdateTrail via CloudTrail. When such an API call is made, the rule triggers an action such as sending an SNS notification or invoking a Lambda function, enabling immediate detection of trail modifications. This approach directly monitors the control plane operations that alter the trail's configuration.

Answer

Configure Amazon GuardDuty to monitor for trail modifications

Answer

Enable CloudTrail Insights to detect unusual activity

Answer

Enable S3 event notifications on the trail's S3 bucket