SCS-C02 Security Logging and Monitoring Practice Test 9 — 15 Questions

Question 1

Refer to the exhibit. A security analyst is reviewing a VPC Flow Log entry. The analyst wants to determine if this flow represents a potentially malicious RDP connection. Based on the log, which conclusion is most accurate?

Accepted Answer

The connection is likely an RDP connection disguised to evade detection.. The log shows source port 443 (HTTPS) and destination port 3389 (RDP) from a public IP to a private IP. The use of port 443 as source for RDP is unusual and could indicate an attempt to disguise RDP traffic as HTTPS. Option A is wrong because port 443 is source, not destination. Option B is wrong because the traffic is from public to private, not outbound. Option D is wrong because the log shows ACCEPT, meaning traffic was allowed.

Answer

The connection is normal HTTPS traffic destined for the instance.

Answer

The connection was blocked by the security group.

Answer

The connection represents outbound traffic from the instance.

Question 2

Refer to the exhibit. A security engineer finds this S3 bucket policy on a bucket that should be private. What is the most effective way to detect if this bucket was accessed by unauthorized users?

Accepted Answer

Query AWS CloudTrail for GetObject API calls.. CloudTrail logs S3 API calls, including GetObject, and can be used to identify who accessed the bucket. Option A is wrong because S3 server access logs are not enabled by default. Option B is wrong because VPC Flow Logs do not capture S3 API calls. Option C is wrong because CloudWatch Logs does not capture S3 API calls directly.

Answer

Enable S3 server access logs on the bucket.

Answer

Use CloudWatch Logs to search for GetObject events.

Answer

Analyze VPC Flow Logs for traffic to the bucket.

Question 3

A security engineer needs to capture all API calls made to AWS services for forensic analysis. Which AWS service should be used to store these logs durably and cost-effectively for long-term retention?

Accepted Answer

AWS CloudTrail. Option C is correct because AWS CloudTrail logs all API calls and can be configured to deliver logs to an S3 bucket for durable, cost-effective storage. Option A is wrong because AWS Config records resource configuration changes, not API calls. Option B is wrong because VPC Flow Logs capture network traffic, not API calls. Option D is wrong because Amazon GuardDuty is a threat detection service, not a logging service.

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Answer

AWS Config

Question 4

A company is using AWS CloudTrail to log API calls and wants to ensure that log files are not tampered with after delivery to S3. Which feature should be enabled to validate the integrity of CloudTrail log files?

Accepted Answer

Enable CloudTrail log file validation. Option B is correct because CloudTrail log file validation creates a hash for each log file, allowing you to verify that the log files have not been modified. Option A is wrong because S3 Versioning helps recover from accidental deletion or overwriting, but does not validate integrity. Option C is wrong because S3 Server-Side Encryption encrypts data at rest, but does not provide integrity validation. Option D is wrong because MFA Delete adds an extra layer of protection for deletion, but does not validate integrity.

Answer

Enable MFA Delete on the S3 bucket

Answer

Enable S3 Versioning on the bucket

Answer

Enable S3 bucket default encryption

Question 5

A security team notices that an S3 bucket containing sensitive data has been repeatedly accessed from an IP address outside the company's network. They need to set up a real-time alert when such access occurs. Which combination of services should they use?

Accepted Answer

Amazon GuardDuty and Amazon EventBridge. Option D is correct because Amazon GuardDuty can analyze CloudTrail management events and S3 data events to detect suspicious activity, and it can send alerts to Amazon EventBridge, which can trigger a notification. Option A is wrong because AWS Config evaluates resource configurations, not real-time access patterns. Option B is wrong because VPC Flow Logs would not capture S3 access from outside the VPC. Option C is wrong because CloudWatch Logs Insights is used for querying logs, not for real-time alerting on its own.

Answer

VPC Flow Logs and Amazon QuickSight

Answer

AWS Config and Amazon SNS

Answer

CloudWatch Logs Insights and Amazon SES

Question 6

A company wants to monitor CPU utilization of their EC2 instances and receive an alert when utilization exceeds 80% for 5 consecutive minutes. Which AWS service should be used to set up this metric alarm?

Accepted Answer

Amazon CloudWatch Alarms. Option A is correct because CloudWatch Alarms can monitor any CloudWatch metric and trigger actions when a threshold is breached. Option B is wrong because AWS CloudTrail logs API calls. Option C is wrong because AWS Config monitors configuration changes. Option D is wrong because Amazon Inspector is a vulnerability assessment service.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS CloudTrail

Question 7

A security engineer is reviewing AWS CloudTrail logs and finds that an IAM user 'developer1' deleted an S3 bucket. The engineer needs to determine the source IP address of the delete operation. Which field in the CloudTrail log record contains this information?

Accepted Answer

sourceIPAddress. Option B is correct because the 'sourceIPAddress' field in CloudTrail logs contains the IP address from which the API call was made. Option A is wrong because 'userIdentity' contains details about the IAM user or role, not the IP address. Option C is wrong because 'eventTime' is the timestamp of the event. Option D is wrong because 'requestParameters' contains the parameters of the request, not the IP address.

Answer

userIdentity

Answer

requestParameters

Answer

eventTime

Question 8

A company uses AWS Organizations with multiple accounts. They want to centralize logging of all API calls across all accounts and store them in a single S3 bucket. Which configuration should be used?

Accepted Answer

Create an organization trail in the management account. Option C is correct because CloudTrail supports organization trails that log events for all accounts in the organization and deliver them to a single S3 bucket. Option A is wrong because individual trails per account would require manual aggregation. Option B is wrong because AWS Config does not log API calls. Option D is wrong because VPC Flow Logs capture network traffic, not API calls.

Answer

Use AWS Config to record API calls across all accounts

Answer

Create a separate CloudTrail trail in each account and aggregate logs using Amazon Athena

Answer

Enable VPC Flow Logs in each account and send to a central S3 bucket

Question 9

A security team needs to detect unauthorized attempts to access an S3 bucket that contains sensitive data. Which AWS service can automatically analyze S3 access logs and generate findings for suspicious activity?

Accepted Answer

Amazon GuardDuty. Option B is correct because Amazon GuardDuty can analyze S3 data events (via CloudTrail) and generate findings for suspicious access patterns. Option A is wrong because Amazon Macie is for discovering sensitive data, not analyzing access logs. Option C is wrong because AWS Trusted Advisor provides cost and performance recommendations. Option D is wrong because Amazon Detective investigates security incidents but does not automatically analyze S3 access logs for suspicious activity.

Answer

Amazon Macie

Answer

AWS Trusted Advisor

Answer

Amazon Detective

Question 10

A company is using Amazon RDS for MySQL and needs to monitor database login attempts for security analysis. Which feature should be enabled to capture authentication events?

Accepted Answer

Enable RDS MySQL audit logs. Option D is correct because RDS MySQL supports general logs and audit logs that can capture login attempts. Enabling the '--log_queries_not_using_indexes' parameter logs queries without indexes, not login attempts. Option B is wrong because VPC Flow Logs capture network traffic. Option C is wrong because CloudTrail does not log database-level events.

Answer

Enable VPC Flow Logs for the RDS subnet

Answer

Enable AWS CloudTrail data events for RDS

Answer

Enable the '--log_queries_not_using_indexes' parameter

Question 11

A company uses AWS CloudTrail and wants to ensure that log files are encrypted at rest and that access to the logs is logged. Which combination of S3 features should be enabled on the destination bucket?

Accepted Answer

Default encryption and server access logging. Option A is correct because enabling default encryption (SSE-S3 or SSE-KMS) encrypts logs at rest, and enabling server access logs on the bucket logs access to the bucket. Option B is wrong because MFA Delete is for deletion protection, not encryption. Option C is wrong because S3 Object Lock prevents deletion but does not encrypt. Option D is wrong because S3 Transfer Acceleration is for faster uploads, not security.

Answer

S3 Transfer Acceleration and default encryption

Answer

MFA Delete and versioning

Answer

S3 Object Lock and versioning

Question 12

A security engineer is implementing centralized logging across multiple AWS accounts. Which TWO actions should the engineer take to ensure logs are securely stored and immutable? (Choose TWO.)

Accepted Answer

Use AWS KMS with a customer managed key for encryption. Option A is correct because enabling S3 Object Lock prevents log files from being deleted or overwritten. Option C is correct because using AWS KMS with a customer managed key provides encryption and fine-grained access control. Option B is wrong because CloudTrail log file validation ensures integrity but does not prevent deletion. Option D is wrong because S3 Transfer Acceleration is for speed, not security. Option E is wrong because MFA Delete requires additional authentication but does not provide immutability; Object Lock is more appropriate.

Answer

Enable S3 Transfer Acceleration on the bucket

Answer

Enable CloudTrail log file validation

Answer

Enable MFA Delete on the bucket

Question 13

A company wants to monitor for suspicious IAM activity, such as a user creating access keys without authorization. Which THREE AWS services can be used together to detect and alert on this activity in real-time? (Choose THREE.)

Accepted Answer

Amazon CloudWatch Logs. Options A, D, and E are correct. AWS CloudTrail logs the API call (CreateAccessKey). Amazon CloudWatch Logs can receive CloudTrail logs, and a metric filter can detect the specific event. An alarm can then trigger an SNS notification. Option B is wrong because Amazon Inspector is for vulnerability assessment. Option C is wrong because AWS Trusted Advisor provides recommendations, not real-time alerting.

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 14

A security engineer needs to capture network traffic between EC2 instances in a VPC for analysis. Which TWO services can provide this capability? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs can capture network traffic by using a unified CloudWatch agent or the EC2 instance's operating system to collect and forward log data, such as syslog or custom application logs that include network packet details. VPC Flow Logs capture metadata about IP traffic going to and from network interfaces in a VPC, including source/destination IPs, ports, protocols, and packet counts, but not the full packet payload. Together, these two services enable both detailed OS-level traffic logging (CloudWatch Logs) and network-level flow metadata (VPC Flow Logs) for comprehensive analysis.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon GuardDuty

Question 15

A company is using AWS CloudTrail and wants to detect when an IAM user performs a specific action, such as stopping an EC2 instance. The security engineer needs to set up a real-time notification. Which THREE steps should the engineer take? (Choose THREE.)

Accepted Answer

Create a metric filter in CloudWatch Logs to match the StopInstances event. Options A, B, and C are correct. Create a CloudTrail trail to log events, create a CloudWatch Logs metric filter to detect the specific API call (StopInstances), and create a CloudWatch alarm that triggers an SNS notification. Option D is wrong because Amazon Athena is used for querying data in S3, not for real-time alerting. Option E is wrong because Amazon QuickSight is for visualization, not alerting.

Answer

Use Amazon QuickSight to visualize CloudTrail logs

Answer

Use Amazon Athena to query CloudTrail logs in S3

SCS-C02 Security Logging and Monitoring Practice Test 9 — 15 Questions

Exhibit

SCS-C02 Security Logging and Monitoring Practice Test 9 — 15 Questions

Exhibit