SCS-C02 CloudWatch Agent Practice Question
A security analyst needs to review all failed SSH login attempts to an EC2 instance. Which combination will provide this information?
⚠ Common exam trap
The key pitfall is interpreting 'failed SSH login attempts' as network-level rejections rather than OS-level authentication failures. VPC Flow Logs show only accepted or rejected network traffic, not login outcomes. The correct approach is to collect system authentication logs via the CloudWatch agent.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Install the CloudWatch agent on the EC2 instance to collect /var/log/secure and stream to CloudWatch Logs.
The CloudWatch agent installed on the EC2 instance can collect OS-level logs such as /var/log/secure (on Linux), which contains detailed records of SSH authentication attempts, including failed logins. By streaming these logs to CloudWatch Logs, the analyst can query and review all failed SSH login attempts at the application layer. Options A, C, and D capture network-level metadata but do not provide information about authentication failures after a successful TCP connection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Config to record EC2 instance configuration and check for security group changes.
Why it's wrong here
AWS Config is designed to record configuration state changes of AWS resources, such as security group rule modifications, instance type changes, or tag updates; it does not collect operating system logs. Failed SSH logins occur entirely within the instance's OS and produce no accompanying AWS resource configuration change. Therefore, using AWS Config to examine security group changes cannot provide any detail about SSH authentication failures or the attackers who attempted them.
- ✓
Install the CloudWatch agent on the EC2 instance to collect /var/log/secure and stream to CloudWatch Logs.
Why this is correct
The CloudWatch agent (or unified agent) runs inside the EC2 instance and can tail local log files such as /var/log/secure on Amazon Linux/RHEL (or /var/log/auth.log on Ubuntu), streaming them to CloudWatch Logs. The sshd daemon writes entries like 'Failed password for ...' to this file for every failed authentication attempt. Reviewing the collected log group in CloudWatch Logs Insights, for example with a query filtering on 'Failed password', directly reveals the failed SSH login attempts and their source IPs.
- ✗
Enable AWS CloudTrail and search for EC2-related events.
Why it's wrong here
CloudTrail records AWS control-plane API calls, such as RunInstances or DescribeInstances, but it has no visibility into the guest OS of an EC2 instance. SSH authentication events, including failed password attempts, never reach the AWS API and therefore cannot appear in CloudTrail event history. Searching EC2-related CloudTrail events would surface only API-level actions, not OS-level login activity.
- ✗
Enable VPC Flow Logs for the subnet and query the logs in CloudWatch Logs Insights for rejected traffic on port 22.
Why it's wrong here
VPC Flow Logs capture only network packet metadata—source/destination IP, port, protocol, and ACCEPT/REJECT status—without inspecting application-layer payloads. A failed SSH login is an authentication failure that occurs after the TCP three-way handshake completes, so the corresponding packets are logged as ACCEPT with port 22, not REJECT. The server's password rejection happens at the SSH layer, which VPC Flow Logs cannot see.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.