SCS-C02 Security Logging and Monitoring — Timed 15 Questions

Question 1

A company uses AWS CloudTrail to log management events in all regions. The security team notices that some API calls made by an IAM user are not appearing in the CloudTrail event history. What is the most likely reason?

15 minute time limit — choose an answer to begin.

Accepted Answer

CloudTrail event history only retains events for 90 days; older events are not visible. D is correct because CloudTrail event history only retains the last 90 days of events. If the API calls were made more than 90 days ago, they would no longer appear in the event history, even though the trail itself may still be delivering log files to an S3 bucket for longer-term storage. The security team is likely looking at the event history rather than querying the S3 bucket or using Athena for older events.

Answer

The user used the AWS Management Console, not the CLI

Answer

The trail is configured for a single region only

Answer

The API calls were read-only and excluded by default

Question 2

A company requires real-time analysis of AWS CloudTrail logs to detect unauthorized API calls. The logs are stored in Amazon S3. Which architecture minimizes latency and cost?

Accepted Answer

Send CloudTrail logs to Amazon CloudWatch Logs, then use a subscription filter to Amazon Kinesis Data Firehose delivering to Amazon OpenSearch Service. It provides the lowest-latency path for real-time analysis: CloudTrail logs are delivered to CloudWatch Logs in near real-time, and a subscription filter streams them to Kinesis Data Firehose, which buffers and delivers directly to Amazon OpenSearch Service for immediate indexing and search. This architecture avoids batch processing, minimizes data movement overhead, and uses managed services that scale automatically, keeping both latency and cost low.

Answer

Use AWS Glue to crawl S3 and load into Amazon Redshift for analysis

Answer

Query CloudTrail logs directly using Amazon Athena

Answer

Configure S3 event notifications to invoke an AWS Lambda function that writes to Amazon OpenSearch Service

Question 3

A security engineer needs to be alerted when an IAM user attempts to modify an S3 bucket policy. Which method is the MOST efficient?

Accepted Answer

Create an Amazon CloudWatch Events rule that matches the PutBucketPolicy API call and triggers an SNS notification. Amazon CloudWatch Events (now Amazon EventBridge) can directly capture the PutBucketPolicy API call as a real-time event and trigger an SNS notification without any additional compute or polling. This is the most efficient method as it requires no log parsing, no custom code, and no additional infrastructure, providing immediate alerting with minimal overhead.

Answer

Enable VPC Flow Logs and analyze for S3 API traffic

Answer

Configure an AWS Config rule to detect changes and invoke a Lambda function

Answer

Enable S3 server access logs and parse them for PutBucketPolicy entries

Question 4

A company uses Amazon GuardDuty and wants to suppress low-severity findings that are known false positives. What is the recommended approach?

Accepted Answer

Create a GuardDuty filter to suppress the findings. GuardDuty filters allow you to automatically suppress low-severity findings that are known false positives by setting the filter action to 'ARCHIVE'. This prevents the findings from appearing in the active findings list without disabling detection or deleting data. Filters are the recommended approach because they are purpose-built for this use case and preserve the audit trail.

Answer

Configure a CloudWatch Events rule to ignore the findings

Answer

Manually delete the findings from the GuardDuty console

Answer

Disable the GuardDuty detector for the affected accounts

Question 5

A company stores sensitive data in Amazon S3 and wants to detect and alert on any public read access to objects. Which combination of services provides the most comprehensive solution?

Accepted Answer

Enable S3 server access logging and use Amazon Athena to query logs, with CloudWatch Events to alert on specific patterns. S3 server access logs capture detailed records of all requests made to a bucket, including the requester, bucket name, request time, action, and response status. By using Amazon Athena to query these logs and CloudWatch Events to trigger alerts on patterns indicating public read access (e.g., a specific HTTP method like GET from an anonymous principal), you can detect and alert on unauthorized public reads comprehensively. This combination provides granular, queryable logging with event-driven alerting, covering both current and historical access patterns.

Answer

Enable VPC Flow Logs and analyze for S3 traffic

Answer

Use AWS Config rules to check for public bucket policies and alert via SNS

Answer

Enable S3 event notifications for all object-level events and send to Amazon SNS

Question 6

A security engineer needs to centrally collect and analyze AWS CloudTrail logs from multiple accounts. Which service is designed for this purpose?

Accepted Answer

Use AWS Organizations to create a CloudTrail trail that applies to all accounts. AWS Organizations allows you to create a single CloudTrail trail that applies to all accounts in the organization, centrally collecting management and data events into a single S3 bucket (and optionally CloudWatch Logs). This eliminates the need to manually configure trails in each account and ensures consistent logging across the entire organization, meeting the requirement for central collection and analysis.

Answer

Configure each account to send logs to a central S3 bucket

Answer

Enable Amazon GuardDuty in each account and aggregate findings

Answer

Use Amazon CloudWatch Logs to stream logs from each account to a central account

Question 7

A company uses AWS CloudTrail and wants to ensure that any modification to the trail itself is detected immediately. What should be done?

Accepted Answer

Create a CloudWatch Events rule that matches the StopLogging or UpdateTrail API calls and sends an alert. CloudWatch Events (now part of Amazon EventBridge) can be configured with a rule that matches specific API calls like StopLogging or UpdateTrail via CloudTrail. When such an API call is made, the rule triggers an action such as sending an SNS notification or invoking a Lambda function, enabling immediate detection of trail modifications. This approach directly monitors the control plane operations that alter the trail's configuration.

Answer

Configure Amazon GuardDuty to monitor for trail modifications

Answer

Enable CloudTrail Insights to detect unusual activity

Answer

Enable S3 event notifications on the trail's S3 bucket

Question 8

A security engineer needs to capture all network traffic between EC2 instances in a VPC for forensic analysis. Which TWO services should be used together? (Choose TWO.)

Accepted Answer

Amazon VPC Flow Logs. Amazon VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions. To perform forensic analysis on this raw flow log data, you can use Amazon Athena to query the logs directly from S3 using standard SQL, enabling efficient filtering and pattern detection across large volumes of network traffic.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon GuardDuty

Question 9

A company wants to use AWS CloudTrail to monitor data events for all S3 buckets. Which THREE steps are necessary? (Choose THREE.)

Accepted Answer

Specify an S3 bucket to store the log files. CloudTrail requires a destination S3 bucket to store the log files it generates. Without specifying a bucket, the trail cannot persist logs, and this bucket must have appropriate bucket policies to allow CloudTrail to write logs. This is a mandatory step when creating any trail, whether for management or data events.

Answer

Create a CloudWatch Events rule to forward data events

Answer

Enable CloudTrail Insights to detect unusual data access

Question 10

A security engineer needs to monitor cross-account access to resources. Which THREE AWS services can be used to log or detect such access? (Choose THREE.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it logs all API calls made to the AWS environment, including cross-account access events such as AssumeRole, GetFederationToken, or any action performed by an IAM role from another account. These logs capture the source identity, target resource, and request parameters, enabling security engineers to detect and audit cross-account activity.

Answer

Amazon VPC Flow Logs

Answer

Amazon Inspector

Question 11

Refer to the exhibit. A security engineer reviews a CloudTrail log entry. What is the MOST concerning security issue?

Accepted Answer

The root user is performing actions. The root user has unrestricted access and should be used only for a few account-level tasks. Although CloudTrail audits root user activity, any routine API call by the root user violates the principle of least privilege and indicates a serious security misconfiguration. The most concerning issue is the root user performing actions beyond its limited scope, as it can indicate credential compromise or lack of proper IAM governance.

Answer

The security group rule allows SSH from 0.0.0.0/0

Answer

The API call failed as indicated by null response elements

Answer

The request came from an external IP address

Question 12

Refer to the exhibit. A security engineer reviews the CloudTrail trail configuration. What is a security concern?

Accepted Answer

The logs are not encrypted with a customer-managed KMS key. The security concern is that the CloudTrail logs are not encrypted with a customer-managed KMS key. By default, CloudTrail encrypts log files using SSE-S3 (S3-managed keys), which does not provide the customer with control over key rotation, access policies, or the ability to audit key usage. Using a customer-managed KMS key ensures that only authorized principals can decrypt the logs, and it enables fine-grained access control and audit trails via CloudTrail and CloudWatch Logs, which is critical for compliance and security monitoring.

Answer

The trail is not multi-region

Answer

Log file validation is not enabled

Answer

CloudWatch Logs integration is missing

Question 13

A security engineer wants to receive real-time notifications when an AWS API call is made to delete an S3 bucket. Which service should be used to capture and forward these events to an Amazon SNS topic?

Accepted Answer

AWS CloudTrail with CloudWatch Events. AWS CloudTrail captures all API calls made to S3, including DeleteBucket. By sending these CloudTrail events to Amazon CloudWatch Events (now part of Amazon EventBridge), you can create a rule that matches the specific API call and forwards it to an SNS topic for real-time notification. This combination provides the exact event-driven pipeline needed for immediate alerting on S3 bucket deletions.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Answer

AWS Config

Question 14

A company uses AWS CloudTrail to log all API calls. The security team notices that some expected log entries are missing for actions performed by an IAM role assumed by an EC2 instance. The instance has the required permissions. What is the MOST likely cause of the missing log entries?

Accepted Answer

CloudTrail is not logging read-only API calls by default; the trail must be configured to log read events.. CloudTrail logs management events by default, but the trail can be configured to log only write events or only read events. If the trail is set to log only write events, read-only API calls (such as Describe* or Get* actions) made by the IAM role will not be recorded. Since the missing log entries are likely read operations, the lack of read event logging would result in missing entries. Option B correctly identifies this scenario.

Answer

The EC2 instance is in a VPC that has a VPC endpoint for CloudTrail, but the endpoint policy denies logging.

Answer

CloudTrail trail is not configured to log data events for EC2.

Answer

The IAM role used by the EC2 instance has a permissions boundary that excludes cloudtrail:PutLogEvents.

Question 15

A security engineer is designing a monitoring solution for a multi-account AWS environment using AWS Organizations. The solution must provide a centralized view of all API activities and send alerts for suspicious events. Which TWO services together can achieve this? (Choose TWO.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it records all API activity across an AWS environment, and when integrated with AWS Organizations, it can deliver a centralized view of API calls from all accounts into a single CloudTrail trail. Amazon CloudWatch Logs is correct because it can ingest CloudTrail logs from a centralized logging account, allowing the security engineer to create metric filters and alarms that trigger alerts for suspicious events based on specific API patterns.

Answer

Amazon GuardDuty

Answer

AWS Lambda

Answer

AWS Config