SCS-C02 Security Logging and Monitoring Practice Test 9 — 15 Questions

Question 1

A company uses AWS Organizations with multiple accounts. The security team wants to centralize VPC Flow Logs from all accounts into a single S3 bucket in the security account. The flow logs are created in the member accounts and sent to the centralized bucket. However, the security team notices that flow logs from some member accounts are not being delivered. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The S3 bucket policy does not grant write permissions to the member accounts.. VPC Flow Logs are delivered to an S3 bucket using the flow log publisher's IAM role, but the destination bucket must also have a bucket policy that explicitly grants the necessary permissions (e.g., s3:PutObject) to the member accounts' log delivery service. Without this policy, the S3 bucket will reject write requests from member accounts, causing flow logs to fail silently.

Answer

The member accounts need an IAM role with permissions to write to the centralized bucket.

Answer

CloudTrail must be enabled in each member account before VPC Flow Logs can be sent to a centralized bucket.

Answer

VPC Flow Logs cannot be aggregated across multiple AWS accounts.

Question 2

A company's security team is investigating a potential security incident. They have enabled CloudTrail and CloudWatch Logs. They want to receive real-time alerts when an IAM user creates a new access key. Which combination of services should be used to achieve this?

Accepted Answer

CloudTrail with CloudWatch Logs, metric filter, alarm, and SNS topic. CloudTrail logs API calls like CreateAccessKey to CloudWatch Logs. A metric filter on the event name 'CreateAccessKey' triggers a CloudWatch alarm that publishes to an SNS topic, enabling real-time notifications. This is the standard AWS architecture for real-time alerting on specific IAM actions.

Answer

AWS Config rules with an SNS topic

Answer

Amazon GuardDuty with an SNS topic

Answer

CloudTrail with Lambda function invocation

Question 3

A company is using Amazon GuardDuty to monitor for malicious activity. The security team wants to automatically isolate an EC2 instance that is flagged for outbound communication with a known malicious IP address. Which approach is the most efficient and scalable?

Accepted Answer

Use Amazon EventBridge to invoke an AWS Lambda function that modifies the instance's security group.. Amazon EventBridge can directly capture GuardDuty findings as events and trigger an AWS Lambda function to modify the instance's security group, revoking outbound access to the malicious IP. This approach is event-driven, serverless, and scales automatically without polling or manual intervention, making it the most efficient and scalable solution.

Answer

Use a CloudWatch Alarm to directly invoke a Lambda function to isolate the instance.

Answer

Use AWS Config to automatically terminate the instance when a GuardDuty finding is reported.

Answer

Create a CloudWatch alarm on GuardDuty findings and modify the subnet's network ACL to block the traffic.

Question 4

A company uses AWS CloudTrail to log API activity. The security team wants to ensure that any modification to CloudTrail configuration is logged and that the logs are tamper-proof. Which feature should be enabled?

Accepted Answer

CloudTrail Log File Integrity Validation. CloudTrail Log File Integrity Validation (option C) uses a hash chain and digital signatures (SHA-256 hashing with RSA) to verify that log files have not been modified, deleted, or tampered with after delivery to the S3 bucket. This feature creates a digest file that contains the hash of each log file, and the digest files themselves are signed, enabling the security team to detect any unauthorized changes to CloudTrail configuration logs.

Answer

S3 MFA Delete on the CloudTrail S3 bucket

Answer

S3 Versioning on the CloudTrail S3 bucket

Answer

CloudWatch Logs log stream encryption

Question 5

A security engineer is setting up centralized logging for an AWS organization. The engineer wants to collect CloudTrail logs, VPC Flow Logs, and AWS Config configuration items from all member accounts into a single S3 bucket in the management account. The engineer creates a new S3 bucket with a bucket policy that grants the required permissions. However, logs from member accounts are not being delivered. What is the most likely reason?

Accepted Answer

The S3 bucket policy does not grant write permissions to the member accounts' service principals.. The S3 bucket policy must explicitly grant the `s3:PutObject` permission to the CloudTrail, VPC Flow Logs, and AWS Config service principals from the member accounts. Without this, the services in member accounts cannot write logs to the bucket in the management account, even if the bucket exists and other permissions are set.

Answer

VPC Flow Logs cannot be delivered to an S3 bucket in a different account.

Answer

CloudTrail must be enabled in each member account individually.

Answer

AWS Config must be enabled in the management account and configured to aggregate data from member accounts.

Question 6

A company is using Amazon CloudWatch Logs to centralize application logs from EC2 instances. The security team wants to encrypt the log data at rest using a customer-managed KMS key. After enabling encryption on the log group, they notice that new log events are being encrypted, but existing log events are not encrypted. What should the team do to encrypt the existing log events?

Accepted Answer

Export the existing logs to S3, encrypt them with the KMS key, and re-import them into a new log group.. CloudWatch Logs encryption at rest using a customer-managed KMS key applies only to new log events written after encryption is enabled. Existing log events remain unencrypted. To encrypt them, you must export the log group to Amazon S3 (using CreateExportTask), apply server-side encryption with the KMS key (SSE-KMS) to the exported objects, and then re-import them into a new log group. CloudWatch Logs does not support retroactive encryption of existing log events in place.

Answer

Use the AWS CLI to update the log group's encryption configuration to re-encrypt existing data.

Answer

Enable KMS automatic key rotation on the customer-managed key to encrypt existing logs.

Answer

Change the KMS key to an AWS managed key to automatically encrypt existing logs.

Question 7

A security engineer is configuring Amazon GuardDuty for the first time. The engineer wants to receive alerts when GuardDuty generates a finding of severity HIGH or higher. What is the simplest way to achieve this?

Accepted Answer

Create an Amazon EventBridge rule that matches GuardDuty findings and triggers an SNS topic.. Amazon EventBridge can natively capture GuardDuty findings as events and route them to an SNS topic for alerting. This is the simplest approach because it requires no custom code, no log parsing, and no additional infrastructure—just a rule matching the `GuardDuty Finding` event type and a severity filter for HIGH or higher.

Answer

Configure CloudWatch Logs to monitor GuardDuty logs and create a metric filter for high-severity findings.

Answer

Set up an S3 event notification on the GuardDuty findings bucket.

Answer

Configure GuardDuty to send email notifications for all findings.

Question 8

A company uses AWS CloudTrail to log all API calls. The security team wants to ensure that any attempt to disable CloudTrail logging is detected and alerted within minutes. Which solution should they implement?

Accepted Answer

Create a CloudWatch metric filter on CloudTrail logs for StopLogging or DeleteTrail events and set an alarm.. CloudTrail logs API calls like `StopLogging` and `DeleteTrail` to CloudWatch Logs. By creating a metric filter on these specific event names and setting a CloudWatch alarm, the security team can receive near-real-time alerts within minutes of any attempt to disable CloudTrail logging, meeting the detection requirement.

Answer

Use Amazon GuardDuty to monitor for disablement events.

Answer

Create an AWS Config rule to detect when CloudTrail is disabled.

Answer

Configure S3 event notifications on the CloudTrail bucket.

Question 9

A security engineer is troubleshooting an issue where CloudTrail is not delivering logs to an S3 bucket. The bucket policy appears correct. Which TWO additional steps should the engineer take to diagnose the issue? (Choose TWO.)

Accepted Answer

Verify that the S3 bucket exists and is in the correct region.. If the S3 bucket does not exist or is in a different region, CloudTrail cannot deliver log files to it. CloudTrail requires the bucket to be in the same region as the trail (for a single-region trail) or in the designated bucket region for a multi-region trail. Verifying the bucket's existence and region ensures the delivery path is valid. Option E is correct because the CloudTrail configuration in the AWS Management Console displays error messages related to delivery failures, such as bucket policy issues or permission errors. Reviewing this console can provide immediate insight into why logs are not being delivered, without needing to check other logs manually.

Answer

Check CloudWatch Logs for CloudTrail errors.

Answer

Create an IAM role for CloudTrail with S3 write permissions.

Answer

Enable S3 server access logging on the bucket.

Question 10

A company has enabled Amazon GuardDuty in multiple AWS accounts. The security team wants to centralize GuardDuty findings into a single account for analysis. Which THREE steps are required to achieve this? (Choose THREE.)

Accepted Answer

Invite member accounts to join the GuardDuty master account.. In Amazon GuardDuty, to centralize findings from multiple accounts, you must designate a master account and then invite member accounts to join. The invitation process establishes a trusted relationship where the master account can aggregate and analyze findings from all member accounts. Without this step, the master account cannot receive findings from other accounts.

Answer

Configure CloudWatch Logs cross-account subscription to aggregate findings.

Answer

Create an EventBridge rule to forward findings to the master account.

Question 11

A security engineer is configuring VPC Flow Logs to capture network traffic metadata. Which TWO attributes can be captured in VPC Flow Logs? (Choose TWO.)

Accepted Answer

Source IP address. VPC Flow Logs capture metadata about network traffic, including the source IP address (option B) and destination port (option D). The source IP address identifies the origin of the traffic, while the destination port indicates the application or service being targeted. These are standard fields in the flow log record format, as defined by AWS for capturing IP traffic metadata.

Answer

Packet payload

Answer

IAM user ID

Answer

DNS query name

Question 12

Refer to the exhibit. A security engineer created this S3 bucket policy to allow CloudTrail to deliver logs from account 123456789012 to the bucket my-trail-bucket. However, CloudTrail logs are not being delivered. What is the most likely reason?

Accepted Answer

The policy is missing s3:GetBucketAcl permission.. CloudTrail requires both s3:PutObject and s3:GetBucketAcl permissions on the destination S3 bucket to validate that the bucket policy grants the necessary access. Without s3:GetBucketAcl, CloudTrail cannot confirm the bucket's ACL allows log delivery, causing delivery to fail.

Answer

The Principal should be the CloudTrail service principal for the specific region.

Answer

The Action should be s3:PutObjectAcl instead of s3:PutObject.

Answer

The resource ARN does not include the bucket name.

Question 13

Refer to the exhibit. A security engineer is analyzing a VPC Flow Log entry from an EC2 instance with private IP 10.0.1.5. The log shows an outbound connection to IP 203.0.113.5 on port 443 from source port 22. The connection was accepted. What is the most likely scenario?

Accepted Answer

The instance is responding to an inbound SSH connection from the remote IP.. The VPC Flow Log shows an outbound connection from the EC2 instance (10.0.1.5) to remote IP 203.0.113.5 on destination port 443, with source port 22 and an ACCEPT record. Since source port 22 is used by SSH servers, this indicates the instance is sending response packets for an inbound SSH session back to the remote client. The flow log captures the connection as 'outbound' because the packet is leaving the instance's network interface, even though it is a reply to an incoming SSH connection.

Answer

The instance is connecting to a remote server on the internal network.

Answer

The instance is receiving an SSH connection from the remote IP.

Answer

The instance is making an HTTPS request to a web server.

Question 14

Refer to the exhibit. A security engineer is reviewing a CloudTrail event. What security concern does this event raise?

Accepted Answer

The user is opening SSH access to the world.. The CloudTrail event shows an AuthorizeSecurityGroupIngress API call with a CidrIp of 0.0.0.0/0 for port 22 (SSH). This opens SSH access to the entire internet, which is a severe security risk because it exposes the instance to brute-force attacks, unauthorized access, and potential compromise. The correct answer is D because this action directly violates the principle of least privilege and is a common misconfiguration.

Answer

The user is revoking a security group rule.

Answer

The event is not being logged by CloudTrail.

Answer

The user is using the AWS root account.

Question 15

A security team needs to detect unauthorized API calls made from a compromised IAM user. Which AWS service should be used to monitor and alert on specific API activities?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including those from IAM users, and delivers event history for auditing. By enabling CloudTrail trails with management event logging and configuring Amazon CloudWatch alarms or EventBridge rules on specific API actions (e.g., `iam:CreateUser`, `ec2:AuthorizeSecurityGroupIngress`), the security team can detect and alert on unauthorized API activities from a compromised IAM user.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

VPC Flow Logs