SCS-C02 Security Logging and Monitoring Practice Test 7 — 15 Questions

Question 1

A company uses AWS CloudTrail and wants to ensure that log files are encrypted at rest and that access to the logs is logged. Which combination of S3 features should be enabled on the destination bucket?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Default encryption and server access logging. Enabling default encryption on the S3 bucket ensures that all CloudTrail log files are encrypted at rest using SSE-S3 or SSE-KMS, satisfying the encryption requirement. Enabling server access logging on the same bucket creates detailed records of every request made to the bucket, including who accessed the logs and from where, thus logging access to the logs themselves. This combination directly addresses both requirements: encryption at rest and access logging.

Answer

S3 Transfer Acceleration and default encryption

Answer

MFA Delete and versioning

Answer

S3 Object Lock and versioning

Question 2

A company wants to monitor for suspicious IAM activity, such as a user creating access keys without authorization. Which THREE AWS services can be used together to detect and alert on this activity in real-time? (Choose THREE.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is correct because it can ingest and monitor log data from AWS CloudTrail in real-time. By creating a CloudWatch Logs metric filter on CloudTrail logs for events like CreateAccessKey, you can trigger an alarm that sends notifications via SNS when unauthorized access key creation occurs. This enables real-time detection and alerting for suspicious IAM activity.

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 3

A security engineer needs to capture network traffic between EC2 instances in a VPC for analysis. Which TWO services can provide this capability? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs can capture network traffic by using a unified CloudWatch agent or the EC2 instance's operating system to collect and forward log data, such as syslog or custom application logs that include network packet details. VPC Flow Logs capture metadata about IP traffic going to and from network interfaces in a VPC, including source/destination IPs, ports, protocols, and packet counts, but not the full packet payload. Together, these two services enable both detailed OS-level traffic logging (CloudWatch Logs) and network-level flow metadata (VPC Flow Logs) for comprehensive analysis.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon GuardDuty

Question 4

A company is using AWS CloudTrail and wants to detect when an IAM user performs a specific action, such as stopping an EC2 instance. The security engineer needs to set up a real-time notification. Which THREE steps should the engineer take? (Choose THREE.)

Accepted Answer

Create a metric filter in CloudWatch Logs to match the StopInstances event. A metric filter in CloudWatch Logs can parse CloudTrail log events for the 'StopInstances' API call and convert it into a CloudWatch metric. This metric can then trigger an alarm for real-time notification, enabling the security engineer to detect the specific action as required.

Answer

Use Amazon QuickSight to visualize CloudTrail logs

Answer

Use Amazon Athena to query CloudTrail logs in S3

Question 5

Refer to the exhibit. An IAM policy is attached to an IAM user. The user reports that they can upload objects to the S3 bucket but cannot list the contents of the bucket. Which statement explains this behavior?

Accepted Answer

The policy does not include the s3:ListBucket action.. The IAM policy grants the s3:PutObject action, which allows the user to upload objects, but it does not include the s3:ListBucket action. The s3:ListBucket action is required to list the contents of an S3 bucket (e.g., via the ListObjects API call). Without this permission, the user can upload but cannot see the bucket's object listing.

Answer

The policy includes s3:ListBucket but is missing the bucket ARN.

Answer

The policy denies the s3:ListBucket action.

Answer

The policy explicitly denies s3:ListBucket.

Question 6

Refer to the exhibit. A security engineer runs the above AWS CLI command to search for CreateKeyPair events in CloudTrail. The command returns no results, but the engineer knows that a key pair was created during that time. What is the most likely reason for the missing events?

Accepted Answer

The command was run in a different region than where the key pair was created.. CloudTrail logs are region-specific. The `aws cloudtrail lookup-events` command without the `--region` flag defaults to the region configured in the AWS CLI (e.g., via `AWS_DEFAULT_REGION` or the CLI profile). If the CreateKeyPair event occurred in a different region, the command would return no results. The engineer must specify the correct region using `--region` to retrieve events from that region.

Answer

CreateKeyPair is a data event and not recorded by CloudTrail.

Answer

CloudTrail events are only available after 24 hours.

Answer

CloudTrail is not enabled for management events.

Question 7

A company has a multi-account AWS environment using AWS Organizations. The security team has enabled AWS CloudTrail with an organization trail that delivers logs to a centralized S3 bucket in the management account. They have also enabled Amazon GuardDuty in all accounts. Recently, they noticed that some EC2 instances in a member account are exhibiting unusual network behavior, such as outbound traffic to known malicious IP addresses. The security engineer needs to quickly determine the source of the traffic and identify which EC2 instances are affected. The engineer has access to the management account and the member account. Which course of action should the engineer take to most efficiently investigate this incident?

Accepted Answer

Use Amazon Detective to investigate the GuardDuty findings and analyze VPC Flow Logs to identify the affected instances.. Amazon Detective automatically aggregates and analyzes VPC Flow Logs, CloudTrail logs, and GuardDuty findings, providing a visual investigation of the incident, including identifying the affected EC2 instances and the source of the traffic. This is the most efficient approach compared to manually querying logs with Athena (Option D), which would require writing SQL queries and interpreting raw data. Option A (AWS Config) is for tracking configuration changes, not network traffic. Option C (Amazon Inspector) is for vulnerability scanning, not network behavior analysis.

Answer

Use AWS Config to review the configuration changes of the EC2 instances and identify any anomalies.

Answer

Use Amazon Inspector to scan the EC2 instances for vulnerabilities and correlate with network traffic.

Answer

Query the VPC Flow Logs stored in the centralized S3 bucket using Amazon Athena to find the source IP and affected instances.

Question 8

A company uses AWS Organizations with multiple accounts. The security team needs to centralize CloudTrail logs from all accounts into a single S3 bucket in the management account. Which configuration ensures that only the management account can delete the log files?

Accepted Answer

Use an S3 bucket policy that denies s3:DeleteObject unless the principal is the management account.. It uses an S3 bucket policy with a conditional deny that explicitly restricts the s3:DeleteObject action to only the management account. This ensures that even if an IAM user or role in a member account has S3 permissions, they cannot delete log files unless they are from the management account. The policy leverages the aws:PrincipalOrgID or a specific account ID condition to enforce this restriction.

Answer

Enable S3 Object Lock on the bucket with governance mode.

Answer

Use an S3 bucket policy that denies s3:DeleteObject for all principals.

Answer

Enable MFA Delete on the S3 bucket.

Answer

Configure CloudTrail to automatically delete logs older than 90 days.

Question 9

A security engineer is investigating a potential data exfiltration from an EC2 instance. CloudTrail logs show that an IAM user created a new access key for an existing IAM role and used it to call S3 GetObject from an unfamiliar IP address. What is the MOST likely reason the CloudTrail logs captured this activity?

Accepted Answer

CloudTrail was enabled to capture management events.. CloudTrail management events record API calls for creating and modifying IAM resources, such as CreateAccessKey for an IAM role. Since the activity involved creating a new access key (a management event) and then using it to call S3 GetObject (a data event), the management event portion was captured because CloudTrail was enabled to log management events by default. The data event (S3 GetObject) would only be logged if data events were specifically enabled, but the question asks why the activity was captured, and the creation of the access key is the key management event that triggered logging.

Answer

S3 server access logs were enabled on the bucket containing the objects.

Answer

VPC Flow Logs were enabled for the EC2 instance's subnet.

Answer

The security engineer had enabled CloudTrail Insights.

Answer

AWS Config was enabled to record resource changes.

Question 10

A company has enabled AWS Config to record resource changes. The security team needs to be notified when a security group is modified to allow inbound SSH from 0.0.0.0/0. Which AWS service should be used to evaluate the Config rules and trigger notifications?

Accepted Answer

AWS Config with a custom rule that triggers an SNS notification. AWS Config with a custom rule is the correct choice because it allows you to define a custom Lambda-backed rule that evaluates security group configurations against the condition of allowing inbound SSH (port 22) from 0.0.0.0/0. When the rule detects non-compliance, it can directly trigger an Amazon SNS notification to alert the security team. This is the native AWS Config mechanism for custom evaluations and notifications, without requiring additional services.

Answer

AWS Lambda

Answer

AWS Security Hub

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 11

A company is required to audit all changes to IAM policies. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity in your AWS account, including all IAM policy changes made via the AWS Management Console, SDKs, CLI, or AWS services. Each event is captured as a CloudTrail event with details such as the identity making the request, the time of the request, and the request parameters, enabling a complete audit trail of IAM policy modifications.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

Amazon S3

Answer

IAM Access Analyzer

Question 12

A security engineer needs to monitor AWS API calls for potential unauthorized access. The engineer wants to be alerted when a specific IAM user performs a high-risk action like deleting a CloudTrail trail. What is the MOST efficient way to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches the API call and sends an SNS notification.. CloudWatch Events (now part of Amazon EventBridge) can directly capture AWS API calls from CloudTrail in near real-time. By creating a rule that matches the specific API call (e.g., `DeleteTrail`) from a specific IAM user, you can trigger an SNS notification instantly without the latency or cost of log shipping, metric filters, or periodic queries. This is the most efficient method for real-time alerting on specific API actions.

Answer

Configure CloudTrail to send logs to CloudWatch Logs and create a metric filter with an alarm.

Answer

Enable VPC Flow Logs and analyze with Elasticsearch.

Answer

Use Amazon Athena to query CloudTrail logs daily for the action.

Answer

Enable Amazon GuardDuty with a custom threat list.

Question 13

A company wants to detect and alert on SSH brute force attacks on EC2 instances. Which AWS service should be used?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, including SSH brute force attacks. It uses machine learning and integrated threat intelligence to analyze VPC Flow Logs, DNS logs, and CloudTrail events, and can generate findings for 'UnauthorizedAccess:EC2/SSHBruteForce' when repeated failed SSH login attempts are detected.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

AWS Shield

Question 14

A security engineer is designing a centralized logging solution for multiple AWS accounts. Which TWO services should be used to aggregate logs from all accounts into a single account? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs can receive log data from multiple AWS accounts via cross-account subscription filters, allowing a centralized logging account to aggregate logs from all source accounts. AWS CloudTrail can be configured to deliver trail logs from multiple accounts to a single S3 bucket in a central account, enabling consolidated audit logging. Together, these two services provide a comprehensive centralized logging solution for multi-account environments.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon S3

Question 15

A company is using AWS Organizations and wants to enable a central security team to view API activity across all member accounts. Which THREE steps are required? (Choose THREE.)

Accepted Answer

Grant the security team read access to the central S3 bucket via bucket policy or IAM.. To enable a central security team to view API activity across all member accounts in AWS Organizations, three steps are required: (A) Grant the security team read access to the central S3 bucket (via bucket policy or IAM) so they can retrieve the logs; (C) Configure each account's CloudTrail to deliver logs to a central S3 bucket in the security account, aggregating all logs in one location; and (D) Enable CloudTrail in each member account to generate the API activity logs. Option B is incorrect because enabling CloudTrail only in the management account would capture API activity only for that account, not for member accounts. Option E is unnecessary because cross-account access to the logs is provided via the bucket policy, eliminating the need to create IAM roles in each member account.

Answer

Enable CloudTrail in the management account only.

Answer

Create an IAM role in each account for the security team to assume.