SCS-C02 Security Logging and Monitoring Practice Test 8 — 15 Questions

Question 1

Refer to the exhibit. This is a line from a VPC Flow Log. A security analyst notices that the log shows an ACCEPT record for a connection from 10.0.1.5 to 10.0.2.10 on port 443. However, the analyst expected the connection to be denied. Which field in the flow log record indicates that the connection was accepted?

Accepted Answer

The action field (ACCEPT). Option D is correct. The 11th field (ACCEPT) is the action field, which indicates whether the traffic was accepted or rejected. Option A is wrong because the version field (1st field) is 2. Option B is wrong because the protocol field (7th field) is 6 (TCP). Option C is wrong because the destination port (5th field) is 443.

Answer

The version field (2)

Answer

The protocol field (6)

Answer

The destination port field (443)

Question 2

Refer to the exhibit. A security engineer ran this AWS CLI command to find when a specific CreateKeyPair API call was made. The command returns no results, even though the engineer knows the call was made. What is the MOST likely reason?

Accepted Answer

The --lookup-attributes parameter has incorrect syntax.. Option B is correct. The --lookup-attributes parameter syntax requires a space after the comma, not an equals sign. The correct syntax is 'AttributeKey=EventName, AttributeValue=CreateKeyPair' or use separate parameters. Option A is wrong because the time range is valid. Option C is wrong because the region is not specified, but the command uses the default region; however, that might cause missing results if the call was in another region. Option D is wrong because the event name is correct.

Answer

The time range is too narrow.

Answer

The command did not specify a region, so it defaults to us-east-1, but the call was made in a different region.

Answer

The event name should be 'CreateKeypair' (lowercase p).

Question 3

A security engineer notices that S3 server access logs are not being delivered to the specified destination bucket. The source bucket has a bucket policy that grants s3:PutObject permission to the Log Delivery group. The destination bucket is in the same AWS account but a different region. What is the most likely cause of the failure?

Accepted Answer

The destination bucket is in a different AWS region.. S3 server access logs cannot be delivered to a bucket in a different region; the destination bucket must be in the same region as the source bucket. Option A is wrong because cross-account delivery is possible with proper permissions. Option B is wrong because no additional IAM role is needed for server access logs. Option D is wrong because enabling versioning is not required for log delivery.

Answer

The destination bucket does not have versioning enabled.

Answer

The destination bucket is in a different AWS account.

Answer

The Log Delivery group does not have an IAM role assigned.

Question 4

A company wants to centrally collect CloudTrail logs from multiple AWS accounts and enable real-time analysis. Which combination of services should be used?

Accepted Answer

CloudTrail, Amazon S3, S3 Event Notifications, and AWS Lambda.. Using CloudTrail to deliver logs to a central S3 bucket, with S3 Event Notifications triggering a Lambda function that ingests logs into CloudWatch Logs for real-time analysis, is a common pattern. Option A is wrong because Kinesis Data Firehose can be used but adds latency. Option B is wrong because CloudWatch Logs does not directly aggregate across accounts. Option D is wrong because SQS alone does not provide analysis.

Answer

CloudTrail, Amazon Kinesis Data Firehose, and Amazon Athena.

Answer

CloudTrail, Amazon CloudWatch Logs, and cross-account log subscription.

Answer

CloudTrail, Amazon S3, and Amazon Simple Queue Service (SQS).

Question 5

A DevOps engineer is configuring VPC Flow Logs for a subnet that contains a public-facing Application Load Balancer (ALB). The engineer wants to capture only accepted traffic for security analysis. What should the engineer do?

Accepted Answer

Create a flow log and use a subscription filter in CloudWatch Logs to include only records with 'ACCEPT'.. VPC Flow Logs can filter by acceptance status. The 'accept' field in the flow log record indicates whether traffic was accepted or rejected. Setting a filter to capture only 'ACCEPT' records meets the requirement. Option A is wrong because security groups accept all traffic allowed by rules. Option C is wrong because network ACLs also accept traffic. Option D is wrong because changing the format does not filter.

Answer

Configure the security group to log only accepted traffic.

Answer

Use the default flow log format and filter at the S3 bucket using S3 Select.

Answer

Create a flow log with a custom format that includes the 'action' field, and filter for 'ACCEPT'.

Question 6

A company is using AWS CloudTrail to monitor API activity. The security team wants to be alerted when an IAM user creates a new access key. Which CloudTrail event should be used to create a CloudWatch Events rule?

Accepted Answer

CreateAccessKey. The CreateAccessKey API call is the correct event for creating an access key. Option B is wrong because UpdateAccessKey modifies an existing key. Option C is wrong because UploadSigningCertificate is for uploads, not access keys. Option D is wrong because EnableMFADevice is for MFA devices.

Answer

EnableMFADevice

Answer

UpdateAccessKey

Answer

UploadSigningCertificate

Question 7

A security analyst wants to monitor unsuccessful login attempts to the AWS Management Console. Which AWS service and log combination should be used?

Accepted Answer

AWS CloudTrail.. AWS CloudTrail logs console sign-in events, including failed attempts. The ConsoleLogin event with a failure status is logged. Option A is wrong because S3 access logs track object-level access. Option B is wrong because VPC Flow Logs track network traffic. Option C is wrong because CloudWatch Logs is a destination, not a source of login events.

Answer

Amazon S3 server access logs.

Answer

VPC Flow Logs.

Answer

Amazon CloudWatch Logs.

Question 8

A company is using AWS Config to track resource changes. They want to receive notifications when a security group is modified to allow inbound traffic from 0.0.0.0/0. What is the most efficient way to achieve this?

Accepted Answer

Create a custom AWS Config rule with an AWS Lambda function that checks for public inbound traffic.. AWS Config rules can evaluate resources against desired configurations. A custom AWS Config rule using a Lambda function can check security group rules and trigger notifications via SNS. Option A is wrong because CloudTrail logs API calls but requires parsing. Option C is wrong because IAM Access Analyzer focuses on resource policies. Option D is wrong because GuardDuty is for threat detection.

Answer

Use IAM Access Analyzer to detect publicly accessible security groups.

Answer

Enable Amazon GuardDuty and use its findings for security group changes.

Answer

Create a CloudTrail trail and filter on AuthorizeSecurityGroupIngress events.

Question 9

A company has a requirement to retain CloudTrail logs for 7 years to meet regulatory compliance. They want to minimize storage costs while ensuring logs are immutable and cannot be deleted by anyone, including the root user. What should they do?

Accepted Answer

Enable S3 Object Lock in Compliance mode on the destination bucket.. S3 Object Lock with Compliance mode ensures that objects cannot be deleted or overwritten by any user, including the root user, for the specified retention period. Governance mode allows some users to override. Option A is wrong because MFA Delete does not prevent deletion by root. Option C is wrong because S3 Glacier Deep Archive is a storage class, not immutability. Option D is wrong because CloudTrail does not provide immutability.

Answer

Configure the S3 bucket with MFA Delete enabled.

Answer

Use CloudTrail log file validation and enable AWS CloudTrail Insights.

Answer

Store the logs in Amazon S3 Glacier Deep Archive with a vault lock policy.

Question 10

A security engineer is investigating a potential security incident and needs to determine if an EC2 instance was launched with a specific AMI ID. Which AWS log should be examined?

Accepted Answer

AWS CloudTrail. CloudTrail logs API calls, including RunInstances, which contains the AMI ID. Option A is wrong because VPC Flow Logs do not contain instance metadata. Option B is wrong because CloudWatch Logs does not capture EC2 launch events by default. Option D is wrong because AWS Config records resource configurations but not the API call details.

Answer

AWS Config timeline

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs (EC2 agent logs)

Question 11

A company uses Amazon GuardDuty and wants to automatically isolate a compromised EC2 instance by removing it from the security group. Which approach should be used?

Accepted Answer

Create an Amazon EventBridge rule that triggers an AWS Lambda function to remove the instance from the security group.. GuardDuty can send findings to EventBridge, which triggers a Lambda function to modify the security group. Option A is wrong because GuardDuty does not have native remediation actions. Option C is wrong because Systems Manager Automation is possible but requires a runbook. Option D is wrong because AWS Config does not react to GuardDuty findings.

Answer

Set up an AWS Config rule to detect the finding and remediate.

Answer

Configure GuardDuty to directly modify the security group.

Answer

Use AWS Systems Manager Automation to automatically modify the security group based on GuardDuty findings.

Question 12

A company is designing a centralized logging solution for multiple AWS accounts. The logs must be encrypted at rest and in transit, and access must be audited. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Configure the S3 bucket policy to restrict PutObject to the CloudTrail service principal with a condition on aws:SourceArn.. Option A is correct: KMS encryption with a CMK provides control over encryption keys and auditing via CloudTrail. Option D is correct: S3 bucket policy with a condition for aws:SourceArn ensures only the intended CloudTrail trail can write logs. Option B is wrong because CloudWatch Logs does not have cross-account subscription without additional configuration. Option C is wrong because S3 access logs are not used for encrypting data. Option E is wrong because VPC endpoints are not a substitute for encryption in transit.

Answer

Configure cross-account CloudWatch Logs subscription to aggregate logs centrally.

Answer

Enable S3 server access logs on the central bucket for auditing.

Answer

Use VPC endpoints to ensure logs are transmitted over the AWS network.

Question 13

A security engineer is investigating a possible data exfiltration from an S3 bucket. Which THREE AWS services can be used to detect and alert on suspicious activity? (Choose THREE.)

Accepted Answer

Amazon GuardDuty. Option A is correct: CloudTrail can log S3 API calls. Option C is correct: GuardDuty can detect suspicious S3 activity. Option D is correct: Macie can identify sensitive data and anomalous access patterns. Option B is wrong because CloudWatch Logs is a log destination, not a detection service. Option E is wrong because AWS Config is for configuration compliance, not threat detection.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 14

A company needs to ensure that all API calls made to AWS are logged and that the logs are immutable. Which TWO steps should be taken? (Choose TWO.)

Accepted Answer

Enable AWS CloudTrail in all regions.. Option A is correct: CloudTrail logs all API calls. Option C is correct: S3 Object Lock in Compliance mode prevents deletion. Option B is wrong because CloudTrail log file validation provides integrity but not immutability. Option D is wrong because CloudWatch Logs does not provide immutability. Option E is wrong because S3 versioning allows overwrites and does not prevent deletion.

Answer

Enable CloudTrail log file validation.

Answer

Send CloudTrail logs to CloudWatch Logs with a retention policy.

Answer

Enable S3 versioning on the destination bucket.

Question 15

Refer to the exhibit. A security engineer configured the above bucket policy for CloudTrail log delivery. However, logs are not being delivered. What is the most likely cause?

Accepted Answer

The condition requires 'bucket-owner-full-control' ACL, but CloudTrail does not set this ACL when delivering to the same account.. The bucket policy requires the 'bucket-owner-full-control' canned ACL, but CloudTrail by default uses 'bucket-owner-full-control' only when delivering to a different account. For same-account delivery, the ACL is not set, causing a mismatch. Option A is wrong because the principal is correct. Option B is wrong because the resource ARN is correct. Option D is wrong because the action is correct.

Answer

The Action should be 's3:PutObjectAcl' instead of 's3:PutObject'.

Answer

The Principal is incorrect; it should be the CloudTrail service principal for the region.

Answer

The Resource ARN is missing the account ID in the path.

SCS-C02 Security Logging and Monitoring Practice Test 8 — 15 Questions

Exhibit

SCS-C02 Security Logging and Monitoring Practice Test 8 — 15 Questions

Exhibit