SCS-C02 Security Logging and Monitoring Practice Test 9 — 15 Questions

Question 1

A company uses Amazon S3 to store sensitive data. The security team needs to be alerted when an S3 bucket policy is changed to allow public access. Which combination of services should be used to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config with AWS Lambda and Amazon Simple Notification Service (SNS). AWS Config can monitor S3 bucket policies for changes that grant public access using a managed rule like 's3-bucket-public-read-prohibited' or a custom Lambda function. When a noncompliant change is detected, AWS Config can invoke an AWS Lambda function to evaluate the policy and publish a notification to Amazon SNS, alerting the security team. This combination provides real-time, policy-driven monitoring and alerting for public access changes.

Answer

AWS CloudTrail and Amazon Simple Notification Service (SNS)

Answer

S3 server access logs and Amazon Athena

Answer

AWS Trusted Advisor and Amazon Simple Notification Service (SNS)

Question 2

A security engineer is investigating a potential security incident involving an EC2 instance that was used to launch an outbound DDoS attack. The engineer needs to determine the source of the attack and the commands executed on the instance. Which logs should be analyzed?

Accepted Answer

EC2 instance OS logs (e.g., /var/log/secure) and CloudTrail logs for API calls that launched the instance. The EC2 instance's OS logs (e.g., auditd logs, bash history) contain the exact commands executed and user authentication events, which are essential for identifying the source and actions of the attacker. CloudTrail logs for API calls that launched the instance provide the identity of the principal (IAM user/role), source IP, and the time the instance was created, linking the instance to the initiating entity. Together, these logs allow the engineer to trace both the operational commands on the instance and the administrative actions that created it.

Answer

VPC Flow Logs and Network ACL logs

Answer

S3 server access logs and CloudWatch Logs

Answer

AWS CloudTrail and AWS Config history

Question 3

A company wants to detect and alert on suspicious IAM user behavior, such as accessing services that are not typically used. Which AWS service provides prebuilt anomaly detection for IAM users?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is the correct answer because it is a threat detection service that uses machine learning and anomaly detection to identify suspicious IAM user behavior, such as accessing services not typically used. It analyzes AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs to establish baselines and generate findings for unusual API calls or access patterns. This prebuilt capability directly addresses the requirement for detecting atypical IAM activity without manual configuration.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 4

A security engineer is setting up monitoring for AWS API calls. Which TWO AWS services can be used to capture and analyze API activity?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs can capture and analyze API activity by ingesting log data from various AWS services, including AWS CloudTrail. You can configure CloudWatch Logs to monitor API calls in real time, set up metric filters to detect specific patterns, and trigger alarms based on API activity. This makes it a valid service for capturing and analyzing API calls, especially when combined with CloudTrail for detailed event records.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 5

A security engineer is troubleshooting why CloudTrail logs are not being delivered to an S3 bucket. The bucket policy allows CloudTrail to write objects, and the trail is configured to log management events. However, no log files appear in the bucket. What is the MOST likely cause?

Accepted Answer

The S3 bucket uses SSE-KMS encryption and the trail does not have permission to use the KMS key.. When an S3 bucket uses SSE-KMS encryption, CloudTrail requires explicit permission to use the KMS key for encrypting log files. Even if the bucket policy allows CloudTrail to write objects, the trail will fail to deliver logs if the KMS key policy does not grant the `kms:GenerateDataKey` and `kms:Decrypt` actions to the CloudTrail service principal. This is the most likely cause because the bucket policy appears correct, but the KMS key permissions are missing.

Answer

The trail is not logging data events.

Answer

The S3 bucket is in a different AWS account.

Answer

The bucket policy is missing a Deny statement.

Question 6

A company uses AWS Config to track resource changes. They notice that a weekly compliance report shows an S3 bucket as non-compliant with a rule that checks for server-side encryption. However, the bucket has default encryption enabled. What is the MOST likely reason for this discrepancy?

Accepted Answer

The Config rule checks for SSE on objects, not default bucket encryption.. The AWS Config managed rule `s3-bucket-server-side-encryption-enabled` specifically checks whether the bucket policy enforces server-side encryption on objects uploaded to the bucket, not whether the bucket has default encryption configured. Default encryption only applies to objects that do not have an encryption setting at the time of upload, but the rule evaluates the bucket's policy for a condition that requires SSE for all PUT requests. Therefore, a bucket with default encryption enabled but without a policy enforcing SSE will be reported as non-compliant.

Answer

The Config rule was deleted and recreated without re-evaluating existing resources.

Answer

The Config rule is only evaluating resources in a single AWS Region.

Answer

The S3 bucket is not tagged with a required tag for the Config rule.

Question 7

A security team needs to be alerted when an IAM user generates a console login failure. Which combination of AWS services should be used to meet this requirement?

Accepted Answer

CloudTrail, Amazon CloudWatch Logs, and CloudWatch Alarms. CloudTrail captures IAM console login failures as CloudTrail events, which can be streamed to CloudWatch Logs. A CloudWatch Alarm can then be configured to trigger on a metric filter that matches the specific 'ConsoleLogin' event with a 'Failure' status, enabling real-time alerting via Amazon SNS.

Answer

CloudTrail and Amazon S3

Answer

AWS Config and Amazon SNS

Answer

Amazon GuardDuty and AWS Lambda

Question 8

A security engineer needs to ensure that all S3 buckets in an AWS account have server access logging enabled. Which AWS service should be used to continuously monitor for compliance?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of your AWS resource configurations against desired policies. You can create an AWS Config rule, such as the managed rule 's3-bucket-server-access-logging-enabled', which will automatically check all S3 buckets in your account and report any that do not have server access logging enabled, flagging them as noncompliant. This allows for ongoing, automated compliance auditing without manual intervention.

Answer

Amazon GuardDuty

Answer

AWS IAM Access Analyzer

Answer

AWS CloudTrail

Question 9

A company is using Amazon Route 53 and wants to log DNS queries for investigative purposes. The logs must be stored in a centralized S3 bucket in the security account. What is the MOST efficient way to achieve this?

Accepted Answer

Configure Route 53 Resolver query logging to deliver to the central S3 bucket.. Route 53 Resolver query logging natively supports delivering DNS query logs directly to an S3 bucket, including cross-account S3 buckets, without requiring any intermediate services. This is the most efficient method because it eliminates the need for additional compute resources or manual polling, and it directly satisfies the requirement for centralized logging in the security account.

Answer

Enable VPC Flow Logs and analyze DNS traffic.

Answer

Enable CloudWatch Logs for Route 53 and stream to a Lambda function that writes to S3.

Answer

Use a custom Lambda function to poll Route 53 logs and write to S3.

Question 10

A company uses AWS CloudTrail to log all API calls. The security team notices that some PutObject API calls are not appearing in the CloudTrail logs. The S3 bucket in question has server access logging enabled. What is the MOST likely reason for the missing CloudTrail events?

Accepted Answer

CloudTrail was not configured to log data events for S3.. CloudTrail logs are categorized into management events and data events. By default, CloudTrail only logs management events (e.g., CreateBucket, DeleteBucket). Data events, such as S3 object-level operations like PutObject, must be explicitly enabled in the CloudTrail trail configuration. Since the security team sees missing PutObject calls, the most likely cause is that CloudTrail was not configured to log S3 data events.

Answer

Server access logs are interfering with CloudTrail.

Answer

The PutObject calls were made via the AWS Management Console.

Answer

The S3 bucket policy denies CloudTrail from logging.

Question 11

A security engineer needs to detect when an EC2 instance is terminated in an AWS account. The solution must provide near-real-time notification. Which combination of services should be used?

Accepted Answer

AWS CloudTrail and Amazon EventBridge. AWS CloudTrail captures API calls, including TerminateInstances, as management events. Amazon EventBridge can filter these events in near real-time and trigger a notification action (e.g., via SNS or Lambda). This combination provides immediate detection of EC2 termination without polling or delays.

Answer

VPC Flow Logs and Amazon CloudWatch Logs

Answer

AWS Config and Amazon SNS

Answer

Amazon CloudWatch Alarms and Amazon SNS

Question 12

A security engineer is investigating a potential security incident. The engineer has enabled CloudTrail and VPC Flow Logs. Which THREE pieces of information can the engineer obtain from CloudTrail logs that are NOT available in VPC Flow Logs? (Choose three.)

Accepted Answer

The AWS Region where the API call was made.. CloudTrail logs capture management-plane API calls, including the AWS Region where the call was made (via the 'awsRegion' field). VPC Flow Logs only capture network-level metadata (IP addresses, ports, protocols) and have no visibility into the AWS Region of an API call because they operate at Layer 3/4 of the OSI model and do not log control-plane events. Therefore, the Region information is uniquely available in CloudTrail.

Answer

The payload of the API request.

Answer

The destination IP address and port of the network traffic.

Question 13

A company wants to monitor for unauthorized API calls in real-time. The solution must meet the following requirements: - Detect calls that fail authentication (AccessDenied). - Detect calls that use a revoked IAM role. - Provide a centralized view across multiple accounts. Which THREE services should be used together to implement this solution? (Choose three.)

Accepted Answer

AWS Organizations. AWS Organizations is correct because it enables centralized management of multiple AWS accounts, allowing the solution to aggregate CloudTrail logs from all accounts into a single CloudWatch Logs group. This centralization is essential for real-time monitoring of unauthorized API calls across the entire organization, as CloudTrail logs record all API activity including AccessDenied errors and actions taken by revoked IAM roles.

Answer

AWS IAM Access Analyzer

Answer

AWS Config

Question 14

A security engineer needs to detect unauthorized API calls in an AWS account. Which AWS service should be used to record and monitor API activity for auditing?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it is specifically designed to record API activity across AWS services, capturing details such as the identity of the caller, the time of the call, the source IP address, and the request parameters. This audit log is essential for detecting unauthorized API calls, as it provides a complete history of all management and data plane operations for security analysis and compliance.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon GuardDuty

Question 15

A company needs to centralize security logs from multiple AWS accounts and on-premises servers. The logs must be encrypted at rest and stored in a cost-effective manner. Which solution meets these requirements?

Accepted Answer

Use Amazon S3 with server-side encryption (SSE-S3). Amazon S3 with server-side encryption (SSE-S3) meets the requirements because it provides encryption at rest using AES-256, is cost-effective for log storage, and can centralize logs from multiple AWS accounts and on-premises servers via S3 Cross-Account Access and the S3 API. SSE-S3 is fully managed by AWS, requiring no additional key management overhead, and S3's lifecycle policies can transition older logs to lower-cost tiers like S3 Glacier for further cost savings.

Answer

Use Amazon S3 Glacier with Vault Lock

Answer

Use Amazon Kinesis Data Firehose to deliver logs to Amazon Redshift

Answer

Use Amazon CloudWatch Logs with KMS encryption