SCS-C02 Security Logging and Monitoring Practice Test 8 — 15 Questions

Question 1

A security engineer is investigating a potential security incident. Which TWO AWS services can be used to analyze historical network traffic patterns? (Choose TWO.)

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) for network interfaces in a VPC. They are stored in Amazon CloudWatch Logs or Amazon S3, enabling historical analysis of network traffic patterns. Athena can query VPC Flow Logs stored in S3 using SQL, making it a powerful tool for analyzing historical traffic patterns at scale.

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 2

Refer to the exhibit. An IAM policy is attached to a user. The user reports that they cannot upload objects to the S3 bucket 'example-bucket' using the AWS CLI from a remote location. What is the MOST likely cause?

Accepted Answer

The CLI is using HTTP instead of HTTPS.. The IAM policy shown in the exhibit includes a `Deny` effect for `s3:PutObject` when the request does not use `aws:SecureTransport` (i.e., HTTPS). If the AWS CLI is configured to use HTTP instead of HTTPS, the condition `aws:SecureTransport=false` is met, and the explicit deny blocks the upload. The user reports the issue from a remote location, which often involves misconfigured endpoints or proxies that force HTTP.

Answer

The bucket policy denies access.

Answer

The bucket requires server-side encryption.

Answer

The user is not authorized to upload to the bucket.

Answer

The user does not have s3:PutObject permission.

Question 3

A company has a multi-account AWS environment with 50 accounts. The security team uses AWS CloudTrail to log management events in each account and delivers logs to a centralized S3 bucket in the security account. Recently, the team noticed that some CloudTrail logs are missing from the central bucket for a few accounts. The logs appear to be delivered intermittently. The security engineer checks the CloudTrail configuration in one of the affected accounts and sees that the trail is configured to deliver to the central bucket. The bucket policy in the security account allows CloudTrail to write from all accounts. The engineer also checks the CloudTrail console and sees that the trail status is 'Logging'. What is the MOST likely cause of the intermittent log delivery?

Accepted Answer

The CloudTrail trail is using Kinesis Data Firehose for delivery, which has a throughput limit.. The most likely cause is that the CloudTrail trail is configured to deliver logs via Kinesis Data Firehose, which has a throughput limit. If the volume of log data exceeds the Firehose stream's capacity, some logs may fail to be delivered, resulting in intermittent missing logs. Option A is incorrect because S3 default encryption (SSE-S3) does not interfere with CloudTrail writes; CloudTrail can write to encrypted buckets. Option B is incorrect because a lifecycle policy deletes objects after they are stored, not during delivery, so it would not cause intermittent missing logs. Option D is incorrect because CloudTrail does not use SQS for log delivery; it delivers directly to S3 or via Firehose.

Answer

The S3 bucket has default encryption enabled, which interferes with CloudTrail writes.

Answer

The S3 bucket has a Lifecycle policy that deletes objects prematurely.

Answer

The CloudTrail trail in each account is not associated with an SQS queue, causing delivery failures.

Question 4

A company has an S3 bucket that stores sensitive data. The bucket policy allows access only from a specific VPC endpoint. The security team notices that an object was accessed from an IP address outside the allowed VPC. CloudTrail logs show that the access was made using temporary credentials from an assumed role. The role was assumed by an EC2 instance in the allowed VPC. What is the MOST likely reason the access was allowed despite the bucket policy restriction?

Accepted Answer

The bucket policy allows access from the VPC endpoint, and the request was made through that endpoint.. The bucket policy uses the aws:SourceVpce condition to restrict access to a specific VPC endpoint. When the EC2 instance in the allowed VPC makes a request, it goes through the VPC endpoint, satisfying the condition. Even though the source IP address appears to be outside the VPC (the VPC endpoint's public IP), the policy evaluates based on the VPC endpoint, not the source IP. Therefore, the request was allowed. Option A is incorrect because encryption in transit is not related to the access restriction. Option C is incorrect because there is no evidence of a syntax error. Option D is incorrect because IAM permissions cannot override a bucket policy that explicitly denies access; the bucket policy allowed the access because the condition was met.

Answer

The bucket policy does not require encryption in transit.

Answer

The bucket policy has a syntax error that makes it ineffective.

Answer

The IAM role used by the EC2 instance has permissions that override the bucket policy.

Question 5

A security engineer is investigating a potential security incident. Which TWO AWS services can be used to analyze historical network traffic patterns? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable CloudTrail in account B and check the S3 event history for the bucket.. To identify cross-account access to an S3 bucket, enable CloudTrail in the account that owns the bucket (account B) and configure a trail with data events for S3 object-level operations. This captures the IAM user ARN from account A in the CloudTrail event. S3 server access logging (Option A) can also provide similar details, but CloudTrail is the recommended approach for auditing API calls. Ensure data events are enabled for the bucket.

Answer

Enable S3 server access logging on the bucket in account B and check the logs.

Answer

Enable CloudTrail in account A and check the S3 event history.

Answer

Enable CloudWatch Logs in account A and check the S3 access logs.

Question 6

A security engineer is configuring an Amazon S3 bucket to store CloudTrail logs. The engineer must ensure that the logs are encrypted at rest using an AWS KMS customer managed key (CMK) and that only the CloudTrail service has permission to decrypt the logs. Which bucket policy statement should the engineer add?

Accepted Answer

{"Effect":"Allow","Principal":{"Service":"cloudtrail.amazonaws.com"},"Action":"kms:Decrypt","Resource":"*"}. The question asks for a bucket policy statement, but bucket policies cannot grant KMS actions like kms:Decrypt. KMS permissions must be granted via a key policy. Therefore, none of the provided options are valid bucket policy statements. The correct approach is to attach a key policy to the KMS key allowing the CloudTrail service principal to perform kms:Decrypt (for log delivery) and kms:Encrypt (for log encryption) as needed. Although option B represents the correct key policy for decryption, it is not a bucket policy, so no option is correct in the context of bucket policies.

Answer

{"Effect":"Allow","Principal":{"Service":"cloudtrail.amazonaws.com"},"Action":"kms:Encrypt","Resource":"*"}

Answer

{"Effect":"Allow","Principal":"*","Action":"kms:Decrypt","Resource":"*"}

Answer

{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":"kms:Decrypt","Resource":"*"}

Question 7

A security engineer is investigating a potential compromise. The engineer notices that an EC2 instance is sending outbound traffic to an unknown IP address on port 443. The engineer needs to determine if the instance is communicating with a known command and control (C2) server. Which AWS service can the engineer use to check the reputation of the destination IP address?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior, including communication with known command and control (C2) servers. It uses threat intelligence feeds, such as those from AWS and third-party partners, to check the reputation of destination IP addresses and alert on suspicious outbound traffic. In this scenario, GuardDuty can directly identify if the EC2 instance is communicating with a known C2 server by analyzing VPC Flow Logs, DNS logs, and other data sources.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

AWS Trusted Advisor

Question 8

A security engineer is designing a logging solution for an application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The engineer needs to capture and store the following logs for analysis: (1) HTTP request logs from the ALB, (2) operating system logs from the EC2 instances, and (3) network traffic logs for the VPC. Which combination of AWS services should the engineer use? (Choose three.)

Accepted Answer

Enable access logging on the ALB and store logs in an S3 bucket.. ALB access logging captures detailed HTTP request data (method, URI, status code, user agent, etc.) and can be directly configured to store logs in an S3 bucket without additional agents or infrastructure. This satisfies the requirement for HTTP request logs from the ALB.

Answer

Enable S3 server access logging for the application's S3 buckets.

Answer

Enable AWS CloudTrail to capture API calls.

Question 9

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The security team has implemented a centralized logging solution using Amazon S3 for ALB access logs and AWS CloudTrail logs. Recently, the team noticed that some ALB access logs are missing for certain time periods. The ALB is configured to deliver logs every 5 minutes to an S3 bucket with a bucket policy that grants the ALB service principal write access. The CloudTrail logs show no errors related to the ALB or S3. The S3 bucket is in the same region as the ALB. What is the most likely cause of the missing logs?

Accepted Answer

The bucket policy does not allow the ALB to write logs.. The most likely cause of missing ALB access logs is a misconfigured bucket policy. Although the stem states the bucket policy grants the ALB service principal write access, the policy may be missing specific actions (e.g., s3:PutObject) or may have incorrect conditions that prevent log delivery. CloudTrail logs may not record S3 bucket policy evaluation failures unless they are explicit deny. Option A is incorrect because enabling versioning does not cause delivery failures. Option C is incorrect because the ALB is configured to deliver logs every 5 minutes. Option D is incorrect because the bucket is explicitly stated to be in the same region as the ALB.

Answer

The S3 bucket has versioning enabled, which causes log delivery failures.

Answer

The ALB is not configured to send logs to the S3 bucket.

Answer

The S3 bucket is in a different AWS region than the ALB.

Question 10

A financial services company uses AWS CloudTrail to log all API calls in their account. They store the logs in an S3 bucket with server-side encryption using AWS KMS (SSE-KMS). The security team needs to ensure that only authorized users can decrypt and read the logs. They have created a KMS key with a key policy that grants decrypt permissions to the security team's IAM roles. However, when a security engineer tries to download a log file from the S3 bucket using the AWS CLI, they receive an 'AccessDenied' error. The engineer has s3:GetObject permission on the bucket. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant the engineer's role permission to decrypt.. The engineer has s3:GetObject permission on the bucket, so S3 permissions are not the issue. However, the log files are encrypted with SSE-KMS, so downloading them requires both s3:GetObject and kms:Decrypt permissions. The error 'AccessDenied' in this context is likely due to missing kms:Decrypt permission in the KMS key policy. Options A, B, and C are incorrect because: A - CloudTrail can be configured with SSE-KMS and the error occurs at read time; B - S3 bucket policy does not involve KMS decrypt permissions; C - The engineer has s3:GetObject, so bucket policy allows reads.

Answer

The CloudTrail trail is not configured to use SSE-KMS.

Answer

The S3 bucket has a bucket policy that denies access to the engineer's IAM role.

Answer

The S3 bucket policy does not allow the engineer to read objects.

Question 11

A company uses Amazon GuardDuty to monitor for malicious activity in their AWS account. The security team receives a GuardDuty finding that indicates an EC2 instance is communicating with a known cryptocurrency mining pool. The team needs to investigate the finding and determine which security group rules allowed the outbound traffic. The EC2 instance is in a VPC with a single security group attached. Which AWS service should the security team use to review the outbound traffic details?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture network traffic metadata, including outbound connections to external IPs. Option A is wrong because CloudTrail records API calls, not network traffic. Option C is wrong because AWS Config tracks resource configuration changes, not network traffic. Option D is wrong because GuardDuty provides findings based on threats but does not store detailed traffic logs.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon GuardDuty

Question 12

A company has a requirement to retain CloudTrail logs for 7 years for compliance. They currently store logs in an S3 bucket with standard storage. The security team wants to minimize storage costs while meeting the retention requirement. The logs must be available for retrieval within 24 hours of a request. Which storage class should the team use for the logs after the first 30 days?

Accepted Answer

S3 Glacier Deep Archive. (S3 Glacier Deep Archive) is correct because it offers the lowest storage cost for long-term archival data, with retrieval times of up to 12 hours, which meets the 24-hour retrieval requirement. Option A (S3 Glacier Flexible Retrieval) is more expensive and provides faster retrieval than needed. Option B (S3 One Zone-IA) lacks the durability required for compliance data. Option C (S3 Standard-IA) is more expensive than Deep Archive and not optimized for long-term archival.

Answer

S3 Glacier Flexible Retrieval

Answer

S3 One Zone-IA

Answer

S3 Standard-IA

Question 13

A security engineer is troubleshooting an issue where CloudTrail logs for a single AWS account are not being delivered to the centralized S3 bucket in the logging account. The engineer has verified that the CloudTrail trail is enabled, the S3 bucket policy allows CloudTrail to write, and the bucket exists. However, no log files have been delivered for the past 6 hours. The engineer checks the CloudTrail console and sees that the trail status shows 'Logging' but the latest log file time is from 8 hours ago. The engineer suspects a permission issue but cannot find any explicit deny in the bucket policy. What is the MOST likely cause of this issue?

Accepted Answer

The KMS key policy used by the S3 bucket does not grant CloudTrail permission to use the key.. The issue is most likely that the KMS key used for server-side encryption of the S3 bucket does not grant CloudTrail the necessary permissions. Even if the bucket policy allows CloudTrail to write, if the S3 bucket uses SSE-KMS encryption, the KMS key policy must include a statement granting kms:Decrypt and kms:GenerateDataKey permissions to the CloudTrail service principal. Without this, CloudTrail cannot encrypt the log files, causing delivery to fail silently. Option D correctly identifies this as the cause. Option A is incorrect because the trail is configured for cross-account delivery (logging account). Option B is incorrect because CloudTrail does not need S3 full access; write access to the bucket is sufficient. Option C is incorrect because cross-region delivery is not required; CloudTrail can deliver to buckets in any region.

Answer

The CloudTrail trail is not configured to deliver to a cross-account bucket.

Answer

The CloudTrail trail is configured with a role that does not have S3 full access.

Answer

The S3 bucket is in a different region than the CloudTrail trail.

Question 14

A company has a multi-account AWS environment managed by AWS Organizations. The security team wants to enable a centralized logging solution where all VPC flow logs, CloudTrail logs, and AWS Config configuration items are sent to a single S3 bucket in the security account. The team has already created the S3 bucket with appropriate bucket policies to allow cross-account writes. However, logs are not appearing from all accounts. What is the MOST likely reason for this issue?

Accepted Answer

The member accounts do not have the required IAM roles to allow the logging services to write to the central bucket.. The most likely reason logs are not appearing from all accounts is that the member accounts lack the required IAM roles (service-linked roles) that allow the logging services (CloudTrail, Config, VPC Flow Logs) to assume permissions to write to the central S3 bucket. Even with a correct bucket policy, the logging services in each member account need an appropriate IAM role (e.g., AWSServiceRoleForCloudTrail, AWSServiceRoleForConfig) to be present and properly configured. Without these roles, the services cannot perform the cross-account write. Option C is correct because these roles must exist in each member account. Options A, B, and D are incorrect: A - The security account does not need to be the master account; any designated account can serve as the central logging account. B - The bucket policy should grant permissions to the logging service principal (e.g., config.amazonaws.com, cloudtrail.amazonaws.com), not the root user of member accounts. D - While KMS key policies can cause issues, the question states the S3 bucket is already configured with appropriate bucket policies, and the most common cause of missing logs is missing IAM roles, not KMS encryption.

Answer

The security account is not the master account of the AWS Organization.

Answer

The S3 bucket policy does not grant write access to the root user of each member account.

Answer

The S3 bucket is encrypted with SSE-KMS and the KMS key policy does not allow cross-account access.

Question 15

A security engineer is configuring CloudTrail to log all management events across all regions. The engineer wants to ensure that log files are delivered to an S3 bucket owned by a separate AWS account for centralized auditing. Which additional configuration is required to allow the S3 bucket in the other account to receive these logs?

Accepted Answer

Add a bucket policy to the destination S3 bucket that allows CloudTrail to write objects.. CloudTrail delivers log files to an S3 bucket in a separate account by writing objects across accounts. The destination bucket must have a bucket policy that explicitly grants CloudTrail (the service principal `cloudtrail.amazonaws.com`) permission to write objects (e.g., `s3:PutObject`). Without this policy, CloudTrail cannot deliver logs to the cross-account bucket, even if the source account has proper CloudTrail configuration.

Answer

Create an S3 bucket policy on the source account's bucket to allow cross-account access.

Answer

Enable S3 server-side encryption with KMS on the destination bucket.

Answer

Create an IAM role in the source account and attach a trust policy for CloudTrail.