SCS-C02 Security Logging and Monitoring Practice Test 8 — 15 Questions

Question 1

A company wants to use AWS CloudTrail to monitor data events for all S3 buckets. Which THREE steps are necessary? (Choose THREE.)

Accepted Answer

Specify an S3 bucket to store the log files. CloudTrail requires a destination S3 bucket to store the log files it generates. Without specifying a bucket, the trail cannot persist logs, and this bucket must have appropriate bucket policies to allow CloudTrail to write logs. This is a mandatory step when creating any trail, whether for management or data events.

Answer

Create a CloudWatch Events rule to forward data events

Answer

Enable CloudTrail Insights to detect unusual data access

Question 2

Refer to the exhibit. A security engineer reviews the CloudTrail trail configuration. What is a security concern?

Accepted Answer

The logs are not encrypted with a customer-managed KMS key. The security concern is that the CloudTrail logs are not encrypted with a customer-managed KMS key. By default, CloudTrail encrypts log files using SSE-S3 (S3-managed keys), which does not provide the customer with control over key rotation, access policies, or the ability to audit key usage. Using a customer-managed KMS key ensures that only authorized principals can decrypt the logs, and it enables fine-grained access control and audit trails via CloudTrail and CloudWatch Logs, which is critical for compliance and security monitoring.

Answer

The trail is not multi-region

Answer

Log file validation is not enabled

Answer

CloudWatch Logs integration is missing

Question 3

A security engineer wants to receive real-time notifications when an AWS API call is made to delete an S3 bucket. Which service should be used to capture and forward these events to an Amazon SNS topic?

Accepted Answer

AWS CloudTrail with CloudWatch Events. AWS CloudTrail captures all API calls made to S3, including DeleteBucket. By sending these CloudTrail events to Amazon CloudWatch Events (now part of Amazon EventBridge), you can create a rule that matches the specific API call and forwards it to an SNS topic for real-time notification. This combination provides the exact event-driven pipeline needed for immediate alerting on S3 bucket deletions.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Answer

AWS Config

Question 4

A company uses AWS CloudTrail to log all API calls. The security team notices that some expected log entries are missing for actions performed by an IAM role assumed by an EC2 instance. The instance has the required permissions. What is the MOST likely cause of the missing log entries?

Accepted Answer

CloudTrail is not logging read-only API calls by default; the trail must be configured to log read events.. CloudTrail logs management events by default, but the trail can be configured to log only write events or only read events. If the trail is set to log only write events, read-only API calls (such as Describe* or Get* actions) made by the IAM role will not be recorded. Since the missing log entries are likely read operations, the lack of read event logging would result in missing entries. Option B correctly identifies this scenario.

Answer

The EC2 instance is in a VPC that has a VPC endpoint for CloudTrail, but the endpoint policy denies logging.

Answer

CloudTrail trail is not configured to log data events for EC2.

Answer

The IAM role used by the EC2 instance has a permissions boundary that excludes cloudtrail:PutLogEvents.

Question 5

A security engineer is designing a monitoring solution for a multi-account AWS environment using AWS Organizations. The solution must provide a centralized view of all API activities and send alerts for suspicious events. Which TWO services together can achieve this? (Choose TWO.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it records all API activity across an AWS environment, and when integrated with AWS Organizations, it can deliver a centralized view of API calls from all accounts into a single CloudTrail trail. Amazon CloudWatch Logs is correct because it can ingest CloudTrail logs from a centralized logging account, allowing the security engineer to create metric filters and alarms that trigger alerts for suspicious events based on specific API patterns.

Answer

Amazon GuardDuty

Answer

AWS Lambda

Answer

AWS Config

Question 6

A security engineer needs to ensure that all API calls made in an AWS account are captured and retained for auditing purposes. The engineer must be able to query the logs for specific user activity over the past 90 days. Which AWS service should the engineer use to meet these requirements?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made in an AWS account, including the identity, source IP, request parameters, and response elements. By default, CloudTrail stores event history for the last 90 days, which can be queried via the Event History console or API, meeting the requirement to query logs for specific user activity over the past 90 days without additional configuration.

Answer

Amazon VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 7

A company is using AWS CloudTrail to monitor API activity in its AWS account. The security team needs to be alerted when unauthorized API calls are made to delete Amazon S3 buckets. Which TWO steps should the security team take to meet this requirement? (Choose TWO.)

Accepted Answer

Configure CloudTrail to deliver logs to Amazon CloudWatch Logs and create a metric filter for the DeleteBucket API call.. Option D is correct because CloudTrail can be configured to deliver management event logs to an Amazon CloudWatch Logs log group, where a metric filter can be created to match the DeleteBucket API call (for example, filtering on eventName = DeleteBucket and errorCode = AccessDenied), and a CloudWatch alarm on that metric can then trigger an SNS notification to alert the security team. Option E is correct because CloudWatch Events (now Amazon EventBridge) can match CloudTrail API activity by event pattern, such as {"eventSource":"s3.amazonaws.com","eventName":"DeleteBucket"}, and route the matching event directly to an Amazon SNS topic to notify the team. Option A is not correct because VPC Flow Logs capture IP traffic metadata at the ENI level, not API calls, so they cannot identify DeleteBucket events. Option B is not correct because a CloudTrail trail does not 'monitor CloudWatch Logs'; the correct direction is CloudTrail delivering logs to CloudWatch Logs, and a trail alone does not generate alerts. Option C is not correct because AWS Config rules evaluate resource configuration compliance and cannot detect or alert on individual DeleteBucket API calls.

Answer

Enable Amazon VPC Flow Logs to capture API calls and use Amazon Athena to query for DeleteBucket events.

Answer

Create an AWS CloudTrail trail that monitors Amazon CloudWatch Logs for DeleteBucket API calls.

Answer

Create an AWS Config rule to detect DeleteBucket API calls and send an SNS notification.

Question 8

Drag and drop the steps to set up AWS Shield Advanced with automatic application layer DDoS mitigation in the correct order.

Accepted Answer

Step 1: Subscribe to AWS Shield Advanced. Step 2: Add protection to AWS resources. Step 3: Integrate with AWS WAF and create a mitigation rule. Step 4: Enable health-based detection.. Shield Advanced requires subscription first, then resource protection, WAF integration, mitigation rule, and health-based detection.

Answer

Step 1: Add protection to AWS resources. Step 2: Subscribe to AWS Shield Advanced. Step 3: Integrate with AWS WAF and create a mitigation rule. Step 4: Enable health-based detection.

Answer

Step 1: Subscribe to AWS Shield Advanced. Step 2: Integrate with AWS WAF and create a mitigation rule. Step 3: Add protection to AWS resources. Step 4: Enable health-based detection.

Answer

Step 1: Subscribe to AWS Shield Advanced. Step 2: Add protection to AWS resources. Step 3: Enable health-based detection. Step 4: Integrate with AWS WAF and create a mitigation rule.

Question 9

Drag and drop the steps to respond to a suspected AWS IAM credential compromise in the correct order.

Accepted Answer

Rotate IAM user access keys, then review CloudTrail logs, then disable the IAM user, then revoke temporary credentials, then notify stakeholders.. Credential compromise response starts with rotation, log review, disabling user, revoking temp creds, and notification.

Answer

Review CloudTrail logs, then rotate IAM user access keys, then disable the IAM user, then revoke temporary credentials, then notify stakeholders.

Answer

Disable the IAM user, then rotate IAM user access keys, then review CloudTrail logs, then revoke temporary credentials, then notify stakeholders.

Answer

Notify stakeholders, then rotate IAM user access keys, then review CloudTrail logs, then disable the IAM user, then revoke temporary credentials.

Question 10

Match each AWS CloudTrail log type to its description.

Accepted Answer

Management events: Records management operations performed on AWS resources, such as creating or deleting VPCs.. CloudTrail has three main log types: Management events (control plane, logged by default), Data events (data plane, optional), and Insight events (anomaly detection, optional). Common confusions include swapping management vs data definitions, or misunderstanding insight events as real-time logs.

Answer

Management events: Records resource operations performed on or within a resource, such as reading or writing S3 objects.

Answer

Insight events: Records all API calls made in your account in real-time.

Question 11

Match each AWS security tool to its purpose.

Accepted Answer

AWS Shield: Protects against DDoS attacks. Correct matches: AWS Shield protects against DDoS, AWS WAF filters web traffic, and GuardDuty provides threat detection. Common confusions include swapping Shield with WAF and Inspector with Macie.

Answer

AWS Inspector: Protects against DDoS attacks

Answer

AWS Macie: Automates vulnerability assessments

Question 12

A security engineer needs to monitor for suspicious API calls in near real-time and trigger an automated response. Which AWS service should be used to capture and analyze these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it captures all API calls made to the AWS environment, including those from the AWS Management Console, SDKs, CLI, and AWS services. By enabling CloudTrail Insights or using CloudWatch Events with CloudTrail logs, you can monitor for suspicious API calls in near real-time and trigger automated responses via Lambda functions or SNS notifications.

Answer

AWS CloudHSM

Answer

Amazon GuardDuty

Answer

AWS Config

Question 13

A company uses AWS Organizations with multiple accounts. The security team wants to centralize security logs (CloudTrail, VPC Flow Logs, AWS Config) from all accounts into a single S3 bucket for analysis. What is the MOST secure way to set up this centralized logging?

Accepted Answer

Create a dedicated S3 bucket in the security account with a bucket policy that grants write access to the logging services of all accounts and enforces encryption in transit and at rest.. It uses a dedicated S3 bucket in a security account (not the management account) with a bucket policy that explicitly grants write access to the logging services (CloudTrail, VPC Flow Logs, AWS Config) from all accounts, while enforcing encryption in transit (aws:SecureTransport) and at rest (default SSE-S3 or SSE-KMS). This follows the security best practice of isolating logs in a separate account and using resource-based policies to restrict access, preventing accidental deletion or modification by other accounts.

Answer

Create a dedicated S3 bucket in the management account, enable S3 default encryption, and configure service delivery for each account.

Answer

Configure each account to deliver logs to the same S3 bucket used for other data.

Answer

Create an S3 bucket in each account and use S3 replication to copy logs to a central bucket.

Question 14

A company is using Amazon CloudWatch Logs to store application logs. The security team needs to retain logs for 7 years to comply with regulatory requirements. The logs are accessed infrequently after the first 90 days. What is the MOST cost-effective way to meet these retention and access requirements?

Accepted Answer

Export logs from CloudWatch Logs to an S3 bucket, then use S3 Lifecycle policies to transition logs to S3 Glacier Deep Archive after 90 days.. Exporting logs from CloudWatch Logs to Amazon S3 and using S3 Lifecycle policies to transition them to S3 Glacier Deep Archive after 90 days is the most cost-effective solution. CloudWatch Logs storage costs are higher than S3, and Glacier Deep Archive offers the lowest storage cost for infrequently accessed data that must be retained for 7 years. This approach meets the retention requirement while minimizing costs for logs that are rarely accessed after the initial 90-day period.

Answer

Stream logs to an S3 bucket using Kinesis, then use S3 Lifecycle policies to transition logs to S3 Standard-IA after 90 days.

Answer

Set a retention policy on the CloudWatch Logs log group to 7 years and use CloudWatch Logs Insights for queries.

Answer

Set a retention policy on the CloudWatch Logs log group to 7 years and use CloudWatch Logs lifecycle policies to transition to Amazon S3 Glacier.

Question 15

A company wants to monitor failed SSH login attempts to its EC2 instances. Which AWS service should be used to collect and analyze these logs?

Accepted Answer

Amazon CloudWatch Logs with the unified CloudWatch agent. Amazon CloudWatch Logs with the unified CloudWatch agent is the correct choice because the agent can be configured to collect and forward system log files, such as /var/log/secure (Amazon Linux) or /var/log/auth.log (Ubuntu), which record SSH authentication attempts including failures. This allows centralized monitoring and analysis of failed SSH logins via CloudWatch Logs Insights or metric filters.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

AWS Config