Courseiva

CCNA Security Logging and Monitoring Questions

75 of 92 questions · Page 1/2 · Security Logging and Monitoring · Answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

A security engineer notices that an S3 bucket containing sensitive data has been accessed from an IP address outside the allowed range. CloudTrail logs show the access was made using temporary credentials from an assumed role. What additional logging is needed to trace the access back to the original IAM user who assumed the role?

A.Enable CloudTrail to log data events for the S3 bucket.
B.Enable VPC Flow Logs for the VPC where the request originated.
C.Configure CloudWatch Logs to capture the EC2 instance's system logs.
D.Enable S3 server access logging for the bucket.
E.Enable AWS Config to record S3 bucket policies.
AnswerE

AWS Config does not record API calls; CloudTrail already records the session issuer in management events.

Why this answer

The information needed to trace the access back to the original IAM user who assumed the role is already available in CloudTrail management events, which are enabled by default. The AssumeRole API call is logged as a management event and includes the ARN of the IAM user or role that performed the assumption. Therefore, no additional logging is required to identify the original user.

Options A, B, C, D, and E do not provide this specific information: A and D log the S3 access but show only the assumed role; B and C are unrelated; E records configuration changes but not the specific AssumeRole call.

Exam trap

Candidates may assume that data events (A) or S3 server access logs (D) will capture the original user, but they only log the assumed role's ARN. The key is recognizing that management events already contain the AssumeRole call with the original user identity.

How to eliminate wrong answers

Option A is wrong because CloudTrail data events for S3 would log the API calls made to the bucket (e.g., GetObject, PutObject) but would still show the assumed role's ARN, not the original IAM user who assumed the role. Option B is wrong because VPC Flow Logs capture network traffic metadata (IP addresses, ports, protocols) but do not include IAM user or role information, so they cannot trace back to the original user. Option C is wrong because EC2 instance system logs (e.g., /var/log/messages) capture OS-level events, not AWS IAM role assumption details, and are irrelevant to tracing the original IAM user.

Option D is wrong because S3 server access logs record requests to the bucket (e.g., requester, IP, operation) but the requester field will show the assumed role's ARN, not the original IAM user who assumed the role.

Practice this question →
2
Multi-Selecthard

A security engineer wants to detect and alert on AWS account root user activity. Which THREE services can be used together to achieve this? (Select THREE.)

Select 3 answers
A.AWS Config
B.Amazon CloudWatch Events (EventBridge)
C.AWS CloudTrail
D.Amazon CloudWatch Logs
E.Amazon GuardDuty
AnswersB, C, D

CloudWatch Events can filter and alert on root user events.

Why this answer

Amazon CloudWatch Events (EventBridge) is correct because it can be used to create a rule that matches specific API calls recorded by AWS CloudTrail. When the root user performs an action, CloudTrail logs the event, and EventBridge can trigger a notification (e.g., via SNS or Lambda) based on that event. This combination allows real-time detection and alerting of root user activity.

Exam trap

The trap here is that candidates may think Amazon GuardDuty is the correct choice because it detects threats, but it does not provide a native, customizable alerting mechanism for root user activity; instead, the combination of CloudTrail, EventBridge, and CloudWatch Logs is the standard AWS-recommended approach.

Practice this question →
3
MCQeasy

A security engineer notices that an Amazon S3 bucket has been accessed from an IP address outside the company's allowed range. The engineer needs to identify the IAM user who made the request. Which AWS service should be used to find this information?

A.S3 server access logs
B.AWS CloudTrail
C.VPC Flow Logs
D.Amazon CloudWatch Logs
AnswerB

CloudTrail captures management-plane and (with data events) object-level API calls. Each event includes the IAM user, role, or federated user that made the request, along with source IP, access key, timestamp, and request/response details. For S3, enabling data events on the bucket records GetObject/PutObject with full caller identity, making it the definitive audit source for identifying which IAM principal performed an action.

Why this answer

AWS CloudTrail is the correct service because it records all API calls made to AWS services, including S3 operations, and captures the identity of the IAM user or role that made the request. By examining CloudTrail logs, the security engineer can find the specific IAM user associated with the source IP address that accessed the bucket, as CloudTrail logs include both the user identity and the source IP address for each event.

Exam trap

The trap here is that candidates often confuse S3 server access logs with CloudTrail, assuming that server access logs include IAM user details, when in fact they only log the requester's AWS account ID or anonymous access, not the specific IAM user identity.

How to eliminate wrong answers

Option A is wrong because S3 server access logs provide detailed records of requests made to an S3 bucket, including source IP and object accessed, but they do not include IAM user identity information; they only log the requester's AWS account ID or anonymous access, not the specific IAM user. Option C is wrong because VPC Flow Logs capture information about IP traffic to and from network interfaces within a VPC, but they do not log IAM user identity or API-level details; they only show network-level metadata such as source/destination IP, ports, and protocol. Option D is wrong because Amazon CloudWatch Logs is a service for storing, monitoring, and accessing log files, but it does not generate logs itself; it can be used to store CloudTrail logs or other logs, but it is not the service that records IAM user identity for S3 API calls.

Practice this question →
4
MCQeasy

A security engineer needs to identify which IAM users have been inactive for the past 90 days. Which AWS service should the engineer use?

A.AWS IAM Credential Report
B.Amazon CloudWatch Logs
C.AWS Config
D.AWS CloudTrail
AnswerA

The IAM Credential Report is the purpose-built tool for this task because it generates a CSV containing every IAM user in the account along with password and access key metadata, including the last-used dates. By reviewing the 'password_last_used' and 'access_key_last_used' columns, you can immediately identify users who have never signed in or never used their keys. This report can also be refreshed programmatically via AWS CLI or the IAM console, making it the most direct audit mechanism.

Why this answer

AWS IAM Credential Report is the correct service because it provides a CSV report that lists all IAM users in an account and includes the `password_last_used` and `access_key_last_used_date` fields. By examining these fields, a security engineer can determine which users have not authenticated or used their access keys for more than 90 days, directly meeting the requirement to identify inactive IAM users.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which records API calls) with the IAM Credential Report, assuming CloudTrail can directly identify inactive users, but CloudTrail logs do not aggregate per-user last activity dates and require extensive post-processing to derive inactivity, whereas the Credential Report is the purpose-built, single-source solution for this exact use case.

How to eliminate wrong answers

Option B is wrong because Amazon CloudWatch Logs is used for monitoring, storing, and accessing log files from AWS resources, but it does not natively track IAM user activity or generate reports on user inactivity; it would require custom metric filters and logs from CloudTrail to infer inactivity, which is indirect and not the intended service. Option C is wrong because AWS Config is a service for evaluating resource configurations against desired policies and tracking configuration changes, not for tracking IAM user login activity or credential usage; it lacks the specific fields like `password_last_used` needed for inactivity analysis. Option D is wrong because AWS CloudTrail records API activity for auditing, but it does not provide a consolidated report of all IAM users' last activity dates; extracting inactive users from CloudTrail logs would require complex queries across millions of events and is not the purpose-built solution for this task.

Practice this question →
5
MCQhard

A company uses AWS CloudTrail to log all API activity. They want to ensure that log files are tamper-proof and can be validated for forensic purposes. Which of the following should they enable?

A.AWS KMS server-side encryption on the S3 bucket
B.CloudTrail log file integrity validation
C.S3 bucket versioning
D.S3 Object Lock with governance mode
AnswerB

CloudTrail log file integrity validation creates a SHA-256 hash of each log file, chains that hash to the previous file's hash, and signs the resulting digest with a private key. The public key is distributed by AWS, so you can independently verify both the signature and the hash chain to detect any modification, deletion, or reordering of log files. It is the only option listed that provides cryptographic proof of log integrity.

Why this answer

CloudTrail log file integrity validation uses a SHA-256 hash chain to detect if log files have been modified, deleted, or altered after delivery. When enabled, CloudTrail delivers a digest file that includes the hash of each log file and the hash of the previous digest, creating an immutable chain that can be used to verify log integrity for forensic purposes.

Exam trap

The trap here is that candidates often confuse data protection mechanisms (encryption, versioning, object lock) with integrity validation, which specifically requires cryptographic hash verification to prove that log files have not been tampered with.

How to eliminate wrong answers

Option A is wrong because AWS KMS server-side encryption protects log files at rest from unauthorized access, but does not provide any mechanism to detect tampering or validate the integrity of the log files after they have been written. Option C is wrong because S3 bucket versioning preserves previous versions of objects, which can help recover from accidental deletion or overwrite, but it does not cryptographically verify that log files have not been altered. Option D is wrong because S3 Object Lock with governance mode prevents objects from being deleted or overwritten for a specified retention period, but it does not provide a hash-based integrity check to detect if the content of a log file was modified before being locked.

Practice this question →
6
Multi-Selectmedium

A company is using AWS CloudTrail to monitor API activity in its AWS account. The security team needs to be alerted when unauthorized API calls are made to delete Amazon S3 buckets. Which TWO steps should the security team take to meet this requirement? (Choose TWO.)

Select 2 answers
A.Enable Amazon VPC Flow Logs to capture API calls and use Amazon Athena to query for DeleteBucket events.
B.Create an AWS CloudTrail trail that monitors Amazon CloudWatch Logs for DeleteBucket API calls.
C.Create an AWS Config rule to detect DeleteBucket API calls and send an SNS notification.
D.Configure CloudTrail to deliver logs to Amazon CloudWatch Logs and create a metric filter for the DeleteBucket API call.
E.Create an Amazon CloudWatch Events rule that matches the DeleteBucket API call and triggers an Amazon SNS notification.
AnswersD, E

CloudTrail can deliver to CloudWatch Logs, and a metric filter can trigger an alarm.

Why this answer

CloudTrail can be configured to deliver logs to Amazon CloudWatch Logs, and a metric filter can be created to match the `DeleteBucket` API call. This metric can then trigger an alarm that sends an SNS notification, alerting the security team to unauthorized API calls. Option E is correct because Amazon CloudWatch Events (now Amazon EventBridge) can directly match the `DeleteBucket` API call from CloudTrail and trigger an SNS notification without needing a metric filter or alarm.

Exam trap

The trap here is that candidates may confuse AWS Config (which evaluates resource configurations) with CloudTrail (which records API activity), or think VPC Flow Logs can capture API-level events instead of network flows.

Practice this question →
7
MCQhard

A company has a requirement to retain CloudTrail logs for 7 years to meet regulatory compliance. They want to minimize storage costs while ensuring logs are immutable and cannot be deleted by anyone, including the root user. What should they do?

A.Configure the S3 bucket with MFA Delete enabled.
B.Use CloudTrail log file validation and enable AWS CloudTrail Insights.
C.Store the logs in Amazon S3 Glacier Deep Archive with a vault lock policy.
D.Enable S3 Object Lock in Compliance mode on the destination bucket.
AnswerD

Enabling S3 Object Lock in Compliance mode places a retention lock on objects until a specified date; during that retention period no user, not even the AWS account root user, can delete or overwrite them. Compliance mode is the strongest Object Lock mode because the retention protection cannot be shortened, removed, or bypassed by any principal. When used as the destination for CloudTrail logs, this guarantees the logs are retained for the full seven years and satisfies the stated requirement.

Why this answer

S3 Object Lock in Compliance mode prevents any user, including the root user, from deleting or overwriting objects for the specified retention period. This meets the immutability and retention requirements for CloudTrail logs, and by using S3 lifecycle policies to transition logs to lower-cost storage classes (e.g., S3 Glacier Deep Archive) after the initial retention period, storage costs can be minimized while maintaining compliance.

Exam trap

The trap here is that candidates may confuse S3 Glacier Vault Lock (which applies to Glacier archives, not S3 objects) with S3 Object Lock, or assume MFA Delete provides sufficient immutability, when in fact only S3 Object Lock in Compliance mode guarantees that no user, including root, can delete objects before the retention period ends.

How to eliminate wrong answers

Option A is wrong because MFA Delete only requires multi-factor authentication for delete operations but does not prevent the root user from deleting objects if they have the MFA device; it also does not enforce immutability or a fixed retention period. Option B is wrong because CloudTrail log file validation provides integrity verification (detecting tampering) but does not prevent deletion or enforce retention; AWS CloudTrail Insights is for detecting unusual activity, not for immutability or retention. Option C is wrong because S3 Glacier Deep Archive with a vault lock policy can enforce write-once-read-many (WORM) compliance, but CloudTrail logs are stored in S3 buckets, not directly in Glacier vaults; the vault lock policy applies to archives in Glacier, not to S3 objects, and transitioning logs to Glacier Deep Archive via S3 lifecycle policies does not inherently provide immutability unless combined with S3 Object Lock.

Practice this question →
8
MCQhard

A company runs a multi-account AWS environment using AWS Organizations. The security team needs to implement centralized logging for all AWS CloudTrail events across all accounts. They create a new trail in the management account with the following configuration: trail name 'central-trail', apply to all accounts in the organization, enable data events for all S3 buckets, and store logs in a centralized S3 bucket. After one week, they notice that some accounts are not delivering CloudTrail logs to the central bucket. The security engineer verifies that the trail is still configured to apply to all accounts and that the S3 bucket policy allows cross-account access. What is the MOST likely reason for the missing logs?

A.The member accounts have not enabled CloudTrail Insights
B.The S3 bucket policy does not grant the correct permissions to the member accounts
C.The trail is not configured as a multi-region trail
D.Some accounts were added to the organization after the trail was created, and the trail was not updated to include them
AnswerD

When new accounts join, the trail must be updated or they need to enable the trail manually.

Why this answer

When a trail is created in the management account with 'apply to all accounts in the organization', it automatically includes all current member accounts. However, if new accounts are added to the AWS Organization after the trail is created, the trail does not automatically extend to those new accounts. The trail must be updated (e.g., via the CloudTrail console or API) to include the newly added accounts, or the organization trail feature must be re-enabled.

This is why logs from accounts added after trail creation are missing.

Exam trap

The trap here is that candidates assume 'apply to all accounts' means the trail dynamically includes any account added later, but in reality, the trail only applies to accounts that were members at the time of creation and must be manually updated for new accounts.

How to eliminate wrong answers

Option A is wrong because CloudTrail Insights is an optional feature that analyzes management events for unusual activity; it is not required for log delivery and its absence does not prevent logs from being delivered. Option B is wrong because the security engineer already verified that the S3 bucket policy allows cross-account access, so the policy is not the issue. Option C is wrong because the question does not mention any requirement for multi-region logging; the missing logs are from specific accounts, not from specific regions, and a single-region trail would still deliver logs from the home region of each account.

Practice this question →
9
MCQhard

Refer to the exhibit. A security engineer configured the above bucket policy for CloudTrail log delivery. However, logs are not being delivered. What is the most likely cause?

A.The Action should be 's3:PutObjectAcl' instead of 's3:PutObject'.
B.The Principal is incorrect; it should be the CloudTrail service principal for the region.
C.The condition requires 'bucket-owner-full-control' ACL, but CloudTrail does not set this ACL when delivering to the same account.
D.The Resource ARN is missing the account ID in the path.
AnswerC

CloudTrail sets the ACL only for cross-account delivery; for same account, the ACL is not set, causing the condition to fail.

Why this answer

When CloudTrail delivers logs to an S3 bucket in the same AWS account, it does not set the 'bucket-owner-full-control' canned ACL on the objects. The bucket policy condition requiring 's3:x-amz-acl': 'bucket-owner-full-control' will fail, as CloudTrail uses the default ACL (bucket-owner-full-control is only set for cross-account deliveries). This mismatch prevents log delivery.

Exam trap

The trap here is that candidates assume the 'bucket-owner-full-control' ACL condition is always required for CloudTrail, but it is only needed for cross-account deliveries, not same-account, causing the policy to fail silently.

How to eliminate wrong answers

Option A is wrong because the Action should be 's3:PutObject' to allow CloudTrail to write log objects; 's3:PutObjectAcl' is for modifying ACLs after upload, not the initial write. Option B is wrong because the Principal for CloudTrail delivery is the CloudTrail service principal (e.g., 'cloudtrail.amazonaws.com'), which is correct; the issue is not the principal but the ACL condition. Option D is wrong because the Resource ARN does not require an account ID in the path; the bucket policy uses the bucket ARN and a wildcard for objects (e.g., 'arn:aws:s3:::bucket-name/AWSLogs/*'), which is valid without an account ID in the path.

Practice this question →
10
Multi-Selecthard

A company has a requirement to detect and alert on anomalous IAM user behavior, such as a user logging in from an unusual geographic location. The company uses AWS Organizations and has multiple accounts. Which services should the company use to meet this requirement? (Choose two.)

Select 2 answers
A.Amazon CloudWatch Logs
B.AWS Config
C.Amazon GuardDuty
D.IAM Access Analyzer
E.AWS CloudTrail
AnswersC, E

Amazon GuardDuty is a managed threat detection service that continuously analyzes CloudTrail event logs, VPC Flow Logs, and DNS query logs using machine learning models and integrated threat intelligence to identify anomalous IAM behavior. It establishes a baseline of normal user activity and generates findings when it detects deviations, such as a logon from a known malicious IP, an unusual geolocation sign-in, or API calls made from a compromised credential. GuardDuty is purpose-built to alert on these anomalies and can automatically send findings to Amazon EventBridge for response.

Why this answer

Amazon GuardDuty (C) is correct because it uses machine learning to detect anomalous IAM user behavior, such as logins from unusual geographic locations, across multiple accounts when integrated with AWS Organizations. AWS CloudTrail (E) is correct because it records all IAM user sign-in events and API calls, providing the raw data that GuardDuty analyzes. CloudTrail is essential for capturing the logs that enable GuardDuty to detect anomalies.

IAM Access Analyzer (D) is incorrect because it focuses on resource policies and unintended external access, not user behavior anomalies like unusual login locations.

Exam trap

The trap is that candidates often choose only GuardDuty or mistakenly include IAM Access Analyzer. The correct pair is GuardDuty for detection and CloudTrail for logging the events that GuardDuty analyzes. CloudTrail alone does not detect anomalies, but it is necessary for providing the data.

Practice this question →
11
Multi-Selecthard

A company wants to ensure that all API calls in their AWS account are logged and immutable. Which TWO actions should be taken? (Choose TWO.)

Select 2 answers
A.Enable MFA delete on the S3 bucket
B.Use AWS Config rules to monitor CloudTrail configuration
C.Enable S3 Object Lock on the CloudTrail S3 bucket
D.Encrypt the S3 bucket with AWS KMS
E.Enable AWS CloudTrail for all regions
AnswersC, E

Object Lock prevents log deletion or modification.

Why this answer

Enabling S3 Object Lock on the CloudTrail S3 bucket ensures that log files are immutable and cannot be overwritten or deleted by any user, including root. This is achieved through a write-once-read-many (WORM) model, which is essential for maintaining a tamper-proof audit trail of all API calls.

Exam trap

The trap here is that candidates often confuse encryption (Option D) with immutability, or they think MFA delete (Option A) provides sufficient protection, but neither prevents overwrites or ensures a WORM state, which is the core requirement for immutable logging.

Practice this question →
12
MCQmedium

A security engineer is troubleshooting why CloudTrail logs are not being delivered to an S3 bucket. The bucket policy allows CloudTrail to write objects, and the trail is configured to log management events. However, no log files appear in the bucket. What is the MOST likely cause?

A.The trail is not logging data events.
B.The S3 bucket uses SSE-KMS encryption and the trail does not have permission to use the KMS key.
C.The S3 bucket is in a different AWS account.
D.The bucket policy is missing a Deny statement.
AnswerB

When an S3 bucket uses SSE-KMS encryption, CloudTrail must have permission to call the KMS key to encrypt each delivered log file. Specifically, CloudTrail needs kms:Decrypt and kms:GenerateDataKey actions in the key policy. If those permissions are missing, CloudTrail cannot write the encrypted log objects and stops delivering logs, producing a delivery failure shown on the trail configuration page.

Why this answer

When an S3 bucket uses SSE-KMS encryption, CloudTrail requires explicit permission to use the KMS key for encrypting log files. Even if the bucket policy allows CloudTrail to write objects, the trail will fail to deliver logs if the KMS key policy does not grant the `kms:GenerateDataKey` and `kms:Decrypt` actions to the CloudTrail service principal. This is the most likely cause because the bucket policy appears correct, but the KMS key permissions are missing.

Exam trap

The trap here is that candidates assume a correct bucket policy is sufficient, overlooking that SSE-KMS encryption introduces a separate permission layer via the KMS key policy, which must explicitly authorize the CloudTrail service principal.

How to eliminate wrong answers

Option A is wrong because CloudTrail logs management events by default and does not require data events to be enabled for log delivery to an S3 bucket; data events are an additional configuration for tracking object-level operations. Option C is wrong because CloudTrail can deliver logs to an S3 bucket in a different AWS account, provided the bucket policy grants cross-account access to the CloudTrail service principal. Option D is wrong because a Deny statement is not required for CloudTrail to write logs; the bucket policy only needs an Allow statement for the CloudTrail service principal, and a missing Deny statement would not prevent delivery.

Practice this question →
13
MCQmedium

A company uses AWS CloudTrail to log all API calls. The security team needs to be alerted when an IAM user creates a new access key. Which approach is most efficient?

A.Enable AWS Config managed rule to detect access key creation and trigger an SNS notification.
B.Create a CloudWatch Events rule that matches the CreateAccessKey event and targets an SNS topic.
C.Use CloudWatch Logs Insights to run a query every minute on CloudTrail logs and send results to SNS.
D.Configure CloudTrail to send logs to an S3 bucket and enable S3 event notifications to an SNS topic.
AnswerB

CloudWatch Events can filter specific API calls in real-time and trigger actions like SNS notifications.

Why this answer

CloudWatch Events (now part of Amazon EventBridge) can directly match the CreateAccessKey API call from AWS CloudTrail in real time and trigger an SNS notification. This approach is the most efficient as it requires no polling, no additional infrastructure, and provides immediate alerting with minimal latency.

Exam trap

The trap here is that candidates may confuse AWS Config's resource compliance monitoring with real-time event detection, or assume that S3 event notifications are suitable for low-latency security alerts, when in fact EventBridge rules are purpose-built for this use case.

How to eliminate wrong answers

Option A is wrong because AWS Config managed rules evaluate resource configurations periodically or on configuration changes, but they are not designed to detect API events like CreateAccessKey in real time; they would require a custom rule and still introduce delay. Option C is wrong because running a CloudWatch Logs Insights query every minute is inefficient, introduces up to a minute of latency, and incurs unnecessary costs for repeated scanning of log data. Option D is wrong because CloudTrail logs delivered to S3 have a delivery latency of up to 15 minutes, and S3 event notifications are not designed for real-time security alerting on API calls; this approach adds significant delay and complexity.

Practice this question →
14
Multi-Selecteasy

Which TWO AWS services provide native integration with Amazon CloudWatch Logs for real-time monitoring of application logs? (Choose TWO.)

Select 2 answers
A.Amazon S3
B.Amazon Route 53
C.Amazon EC2
D.AWS Lambda
E.AWS CloudTrail
AnswersC, D

EC2 can use the CloudWatch agent to send logs.

Why this answer

Amazon EC2 is correct because it can be configured to send application logs to CloudWatch Logs via the CloudWatch Logs agent or unified CloudWatch agent, enabling real-time monitoring, search, and alerting on log data. AWS Lambda is correct because it natively integrates with CloudWatch Logs: every Lambda function execution automatically streams its logs to a CloudWatch Logs group, providing real-time visibility into function output and errors.

Exam trap

The SCS-C02 exam often tests the distinction between services that natively produce or stream application logs to CloudWatch Logs versus services that can only send logs via additional configuration or are limited to audit/API logs, leading candidates to mistakenly select CloudTrail or S3 as native integrations.

Practice this question →
15
Multi-Selecthard

A security team wants to implement a centralized logging solution for multiple AWS accounts. The team needs to collect VPC Flow Logs, CloudTrail logs, and DNS query logs from all accounts. Which THREE services should the team use to aggregate these logs? (Choose THREE.)

Select 3 answers
A.AWS CloudHSM
B.AWS Config
C.Amazon Route 53 Resolver query logging
D.AWS CloudTrail
E.VPC Flow Logs
AnswersC, D, E

Resolver query logs can be published to a central S3 bucket for DNS query logs.

Why this answer

Amazon Route 53 Resolver query logging (Option C) is correct because it enables centralized collection of DNS query logs from VPCs across multiple AWS accounts. By configuring Route 53 Resolver query logging to send logs to a central Amazon S3 bucket or CloudWatch Logs group, the security team can aggregate DNS query logs from all accounts, meeting the requirement for centralized DNS logging.

Exam trap

The trap here is that candidates may confuse AWS CloudHSM or AWS Config as logging services, but neither is designed for log collection or aggregation; CloudHSM is for key management and Config is for configuration auditing, not for aggregating VPC Flow Logs, CloudTrail logs, or DNS query logs.

Practice this question →
16
MCQhard

A security team uses Amazon Macie to discover sensitive data in S3. They have configured Macie to run automated sensitive data discovery jobs. After reviewing the findings, they notice that some S3 objects containing personally identifiable information (PII) are not being flagged. What is the most likely cause?

A.The Macie service-linked role does not have permissions to read the objects.
B.The S3 bucket is in a different AWS Region than the Macie job.
C.The S3 objects are encrypted with SSE-S3.
D.The PII is in a format that Macie's managed data identifiers do not recognize, and no custom data identifier is configured.
AnswerD

This is correct because Macie relies on managed data identifiers that recognize common PII patterns, such as US Social Security numbers and credit card numbers. If the PII is in a proprietary or less common format that these built-in identifiers do not match, Macie will not flag it. Since no custom data identifier was created to define that specific format, Macie has no way to detect the sensitive data, so the data goes undiscovered.

Why this answer

Macie uses managed data identifiers to detect PII based on predefined patterns. If the PII in the S3 objects is in a format that does not match any of these managed identifiers (e.g., a non-standard date format or a custom ID number), and no custom data identifier has been configured to recognize that specific pattern, Macie will not flag the objects. This is the most likely cause given that the security team has already configured automated discovery jobs and other common issues like permissions or encryption are not preventing scanning.

Exam trap

The trap here is that candidates often assume encryption (SSE-S3) or cross-region issues block Macie, but Macie is designed to handle both seamlessly, and the real limitation is the scope of its pattern-matching identifiers.

How to eliminate wrong answers

Option A is wrong because the Macie service-linked role (AWSServiceRoleForAmazonMacie) is automatically created and granted the necessary permissions (e.g., s3:GetObject, s3:ListBucket) to read objects in S3 buckets that are in scope for the discovery job; if the role lacked permissions, Macie would report an access error, not silently skip objects. Option B is wrong because Macie supports cross-region analysis: a single Macie job can analyze S3 buckets in any AWS Region, as long as the bucket is in the same AWS partition and the Macie service is enabled in the job's home Region. Option C is wrong because Macie can scan objects encrypted with SSE-S3 (Amazon S3-managed keys) without any additional configuration; SSE-S3 encryption does not block Macie's read access because Macie uses the service-linked role to decrypt the objects via S3's server-side decryption.

Practice this question →
17
Multi-Selectmedium

A company is using Amazon GuardDuty to detect threats. The security team wants to receive alerts for specific findings. Which TWO AWS services can be used to forward GuardDuty findings to a custom application for analysis? (Choose two.)

Select 2 answers
A.Amazon CloudWatch Events (Amazon EventBridge)
B.Amazon Kinesis Data Streams
C.Amazon Simple Queue Service (SQS)
D.AWS Lambda
E.Amazon S3
AnswersA, E

GuardDuty publishes findings to EventBridge, which can then route to various targets.

Why this answer

Amazon GuardDuty can publish findings to Amazon CloudWatch Events (now part of Amazon EventBridge) as events. These events can then be routed to a custom application via targets like AWS Lambda, SQS, or Kinesis, enabling real-time analysis and alerting. This is the primary, native integration for forwarding GuardDuty findings to downstream systems.

Exam trap

The trap here is that candidates confuse the service that receives the finding (EventBridge) with the service that processes or stores it (Lambda, SQS, Kinesis), forgetting that EventBridge is the required intermediary for forwarding GuardDuty findings to any custom application.

Practice this question →
18
MCQmedium

A company uses AWS Organizations to manage multiple accounts. The security team wants to enable CloudTrail for all accounts and centrally store logs. What is the most efficient way to achieve this?

A.Use an S3 bucket policy to allow cross-account log delivery
B.Create a CloudTrail trail in the management account and apply it to all accounts in the organization
C.Use AWS Lambda to create trails in each account
D.Ask each account admin to create their own CloudTrail trail and deliver to a central S3 bucket
AnswerB

Organization trails log all accounts centrally.

Why this answer

AWS Organizations allows you to create a single CloudTrail trail in the management account that automatically applies to all member accounts within the organization. This is the most efficient method as it eliminates the need for manual per-account configuration or custom automation, and it ensures consistent logging across the entire organization with centralized log delivery to a single S3 bucket.

Exam trap

The trap here is that candidates often assume cross-account S3 bucket policies (Option A) are sufficient, overlooking the native organization-wide trail capability that automates trail creation and management across all accounts.

How to eliminate wrong answers

Option A is wrong because while an S3 bucket policy can allow cross-account log delivery, it does not automate the creation of CloudTrail trails in each account; each account would still need to manually create its own trail, which is inefficient and error-prone. Option C is wrong because using AWS Lambda to create trails in each account introduces unnecessary complexity, potential latency, and maintenance overhead compared to the native organization-wide trail feature. Option D is wrong because asking each account admin to create their own trail is not only inefficient but also risks inconsistent configurations, missing logs, and increased administrative burden.

Practice this question →
19
MCQhard

A company uses Amazon RDS for MySQL and needs to monitor database activity for suspicious queries, such as unauthorized access attempts or SQL injection. The security team wants to centralize the logs from multiple RDS instances and analyze them in near real-time. Which solution should be implemented?

A.Enable RDS Enhanced Monitoring and stream the metrics to Amazon CloudWatch.
B.Enable VPC Flow Logs for the RDS instances and analyze the logs using Amazon Athena.
C.Enable AWS CloudTrail for RDS API calls and use Amazon GuardDuty to analyze the logs.
D.Enable database audit logs on each RDS instance, stream them to Amazon CloudWatch Logs, and use CloudWatch Logs Insights to query the logs.
AnswerD

Audit logs capture SQL queries; CloudWatch Logs provides centralized storage and analysis.

Why this answer

RDS for MySQL audit logs capture detailed database-level activity, including login attempts, query execution, and SQL injection patterns. Streaming these logs to CloudWatch Logs enables near real-time analysis using CloudWatch Logs Insights, which supports querying and alerting on suspicious queries across multiple RDS instances from a centralized location.

Exam trap

The trap here is confusing database-level audit logs (which capture SQL queries and authentication events) with infrastructure-level logs like Enhanced Monitoring or VPC Flow Logs, leading candidates to choose options that monitor performance or network traffic instead of actual database activity.

How to eliminate wrong answers

Option A is wrong because RDS Enhanced Monitoring provides OS-level metrics (CPU, memory, disk I/O) but does not capture database query content or authentication events needed to detect suspicious queries or SQL injection. Option B is wrong because VPC Flow Logs record network traffic metadata (IP addresses, ports, protocols) but do not include database query text or user authentication details; they cannot identify SQL injection or unauthorized access attempts at the database level. Option C is wrong because AWS CloudTrail logs RDS API calls (e.g., CreateDBInstance, ModifyDBInstance) but does not capture database engine-level activity such as SQL queries or login attempts; GuardDuty analyzes CloudTrail, VPC Flow Logs, and DNS logs for threats but cannot inspect database query content.

Practice this question →
20
MCQmedium

A company uses AWS CloudTrail to log API activity across multiple accounts. The security team wants to ensure that any S3 bucket created with public read access is detected within minutes. Which solution is MOST efficient?

A.Create an Amazon EventBridge rule that matches CloudTrail CreateBucket API calls and triggers a Lambda function that inspects the bucket's public access settings and alerts if public.
B.Use AWS Config rules to check S3 bucket public access settings and trigger an AWS Lambda function to send alerts.
C.Use S3 server access logs and run a daily script to parse the logs for PutBucketAcl actions.
D.Enable CloudTrail log file validation and use Athena to query logs hourly for CreateBucket events with public ACLs.
AnswerA

An EventBridge rule can pattern-match CloudTrail API events as they are emitted, meaning a CreateBucket call with a public access configuration triggers the Lambda function within seconds of the API completing. The Lambda can then use GetPublicAccessBlock, GetBucketPolicyStatus, or GetBucketAcl to determine whether the bucket is actually public and immediately alert a security team, making this the only option that combines near-real-time detection with direct inspection of the resulting bucket configuration.

Why this answer

It uses an Amazon EventBridge rule to capture the CloudTrail `CreateBucket` API call in near real-time, then triggers a Lambda function to immediately inspect the bucket's public access settings. This approach detects public buckets within minutes without polling or batch processing, making it the most efficient solution for the stated requirement.

Exam trap

The trap here is that candidates often choose AWS Config rules (Option B) because they associate Config with compliance checks, but they overlook the latency of Config evaluations versus the near-real-time capability of EventBridge for API-driven detection.

How to eliminate wrong answers

Option B is wrong because AWS Config rules evaluate resource configurations on a periodic basis (e.g., every 10 minutes or hourly) or on configuration changes, but they do not guarantee detection within minutes of the bucket creation; the evaluation delay can exceed the required time window. Option C is wrong because S3 server access logs are delivered on a best-effort basis, often with delays of several hours, and a daily script would not meet the 'within minutes' requirement. Option D is wrong because CloudTrail log file validation only ensures integrity, not real-time detection, and using Athena to query logs hourly introduces at least a one-hour delay, failing the 'within minutes' requirement.

Practice this question →
21
MCQhard

A company uses AWS CloudTrail to log all API calls across multiple accounts in AWS Organizations. The security team notices that management events are being logged, but data events for Amazon S3 are not appearing in the CloudTrail logs for any account. The team needs to enable data event logging for S3 across all accounts. Currently, the organization trail is configured in the management account, and all member accounts have default CloudTrail configurations. What is the MOST efficient way to enable S3 data event logging for all current and future accounts in the organization?

A.Ask each member account to create a new trail in their own account with S3 data events enabled.
B.Update the existing organization trail's event selectors in the management account to include S3 data events for all accounts.
C.Enable S3 server access logging on all S3 buckets across the organization and aggregate logs in a central S3 bucket.
D.Create a new organization trail in the management account with S3 data events enabled, and share it with member accounts.
AnswerB

In the management account, edit the existing organization trail and update its event selectors to include S3 data events, choosing 'All S3 buckets' for object-level operations such as GetObject, PutObject, and DeleteObject. CloudTrail propagates this configuration to every member account, so all current and future accounts are captured automatically without per-account changes. This is the intended, least-effort method and keeps delivery centralized in the original destination bucket.

Why this answer

An organization trail in the management account can have its event selectors updated to include S3 data events for all accounts in the organization. This change automatically applies to all existing and future member accounts, as organization trails are replicated to all accounts by AWS CloudTrail. No additional configuration is needed in member accounts, making it the most efficient approach.

Exam trap

The trap here is that candidates may think they need to create a new organization trail or involve member accounts, but the most efficient solution is to update the existing organization trail's event selectors, which automatically applies to all current and future accounts.

How to eliminate wrong answers

Option A is wrong because asking each member account to create a separate trail is inefficient and does not scale for future accounts; it also duplicates effort and log storage. Option C is wrong because S3 server access logging logs object-level access requests (e.g., GET, PUT) but is not CloudTrail data event logging; it does not integrate with CloudTrail's event history or organization-wide trails. Option D is wrong because you cannot 'share' a trail with member accounts; organization trails are created in the management account and automatically applied to all accounts in the organization—creating a new trail is unnecessary when the existing organization trail can be updated.

Practice this question →
22
MCQhard

A company uses Amazon Route 53 for DNS and wants to log all DNS queries made from its VPC. The logs must be stored in Amazon S3 for compliance purposes. Which solution meets these requirements?

A.Enable Route 53 Resolver query logging and publish to an S3 bucket.
B.Install a CloudWatch Logs agent on each EC2 instance and configure it to send DNS logs to CloudWatch Logs.
C.Enable AWS CloudTrail for DNS API calls and deliver to an S3 bucket.
D.Enable VPC Flow Logs and publish to an S3 bucket.
AnswerA

Route 53 Resolver query logging captures DNS queries made by resources in your VPC and can deliver logs to S3.

Why this answer

Route 53 Resolver query logging is the native AWS feature designed to capture DNS queries that originate from resources within a VPC. By enabling this feature and specifying an S3 bucket as the destination, you can log all DNS queries made by EC2 instances, Lambda functions, and other VPC resources without needing any additional agents or configuration. This directly meets the requirement for storing DNS query logs in S3 for compliance.

Exam trap

The trap here is confusing data-plane DNS query logs (Route 53 Resolver query logging) with control-plane API logs (CloudTrail) or network flow logs (VPC Flow Logs), leading candidates to select options that log the wrong type of information for the stated requirement.

How to eliminate wrong answers

Option B is wrong because installing a CloudWatch Logs agent on each EC2 instance captures only the DNS queries made by that specific instance's operating system, not all DNS queries from the VPC (e.g., queries from other services or from the Route 53 Resolver itself), and it requires manual agent management. Option C is wrong because AWS CloudTrail logs API calls made to Route 53 (e.g., creating hosted zones), not the DNS query traffic itself; DNS queries are data-plane operations, not control-plane API calls. Option D is wrong because VPC Flow Logs capture metadata about network traffic (IP addresses, ports, protocols) but do not log the content or queries of DNS traffic; they cannot provide the actual DNS query names or types.

Practice this question →
23
MCQmedium

A security engineer is designing a monitoring solution for an AWS Lambda function that processes sensitive data. The function occasionally fails due to timeouts. The engineer needs to be alerted immediately when the function fails and also wants to analyze the error logs. Which combination of services should the engineer use?

A.Amazon CloudWatch Logs and Amazon Kinesis Data Firehose
B.Amazon CloudWatch Logs and CloudWatch Alarms with Amazon SNS
C.AWS CloudTrail and Amazon SNS
D.AWS Config and Amazon SNS
AnswerB

CloudWatch Logs stores logs, and CloudWatch Alarms trigger SNS notifications on errors.

Why this answer

Amazon CloudWatch Logs captures the Lambda function's execution logs, including timeout errors, and CloudWatch Alarms can monitor specific metrics like `Errors` or `Throttles` for the function. When the alarm state is triggered (e.g., `ALARM`), it publishes a notification to an Amazon SNS topic, which can send immediate alerts via email, SMS, or other endpoints. This combination provides both real-time alerting and log analysis for troubleshooting.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which logs API activity) with CloudWatch Logs (which captures application logs), leading them to choose Option C, even though CloudTrail cannot capture runtime errors like timeouts.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Firehose is designed for streaming data ingestion into storage or analytics services, not for real-time alerting; it lacks the ability to trigger immediate notifications based on Lambda function failures. Option C is wrong because AWS CloudTrail records API calls (e.g., Invoke, UpdateFunctionConfiguration) but does not capture function execution logs or runtime errors like timeouts; it is not suitable for analyzing application-level error logs. Option D is wrong because AWS Config tracks resource configuration changes and compliance, not function execution errors or logs; it cannot alert on runtime failures like timeouts.

Practice this question →
24
MCQmedium

Refer to the exhibit. A security engineer finds this CloudTrail log entry. What is the most significant security concern indicated by this event?

A.The security group rule allows SSH access from any IP address (0.0.0.0/0).
B.The event is a normal administrative action and poses no security concern.
C.The user did not have MFA enabled when assuming the AdminRole.
D.The source IP address (203.0.113.5) is from an unusual location.
AnswerA

This exposes the instance to the internet on port 22.

Why this answer

The CloudTrail log entry shows an `AuthorizeSecurityGroupIngress` API call that adds a rule allowing SSH (port 22) from 0.0.0.0/0. This is a critical security concern because it exposes the EC2 instance to SSH access from any IP address on the internet, creating a high risk of brute-force attacks, unauthorized access, and potential compromise. Security best practices mandate restricting SSH access to specific trusted IP ranges, not the entire internet.

Exam trap

The trap here is that candidates may focus on the source IP address or MFA status, but the core security concern is the overly permissive security group rule that grants unrestricted SSH access to the internet.

How to eliminate wrong answers

Option B is wrong because the event is not a normal administrative action; it explicitly opens SSH to the world, which is a significant security risk and should be flagged as a concern. Option C is wrong because the CloudTrail log does not indicate whether MFA was enabled or not; the event shows the user assumed the AdminRole, but MFA status is not recorded in this log entry, so it cannot be concluded as a security concern from this event alone. Option D is wrong because the source IP address 203.0.113.5 is a documentation/test IP range (RFC 5737) and is not necessarily unusual; more importantly, the security concern is the open SSH rule, not the source IP of the API call.

Practice this question →
25
MCQmedium

A company uses AWS CloudTrail to log management events. The security team wants to be alerted when an IAM user creates a new access key. Which solution would meet this requirement with the least operational overhead?

A.Create a CloudWatch Logs metric filter on the CloudTrail log group for CreateAccessKey events and set an alarm.
B.Create an Amazon EventBridge rule that matches the CreateAccessKey event and triggers an Amazon SNS notification.
C.Write a Python script that uses the CloudTrail LookupEvents API and run it on a scheduled basis using Amazon EventBridge Scheduler.
D.Develop a custom AWS Lambda function that queries CloudTrail logs in S3 every hour.
AnswerB

EventBridge is the least-overhead, near-real-time option because CloudTrail automatically delivers all management events to the default EventBridge bus without extra configuration. A rule with an event pattern that matches eventSource="iam.amazonaws.com" and eventName="CreateAccessKey" triggers an SNS topic immediately when the API call occurs, enabling instantaneous security notifications. This is fully event-driven and serverless: there is no polling, no custom code, no log parsing, and no separate metric filter to maintain, which makes it the architecturally cleanest solution.

Why this answer

Amazon EventBridge can directly capture CloudTrail API calls (like CreateAccessKey) as events and route them to an SNS topic for notification, requiring no custom code or polling. This serverless, event-driven approach minimizes operational overhead by eliminating the need to manage log groups, metric filters, or scheduled scripts.

Exam trap

The trap here is that candidates often assume CloudWatch Logs metric filters are the standard way to monitor CloudTrail events, but EventBridge is the native, lower-overhead service for reacting to specific API calls in real time without needing to ship logs to CloudWatch Logs first.

How to eliminate wrong answers

Option A is wrong because CloudTrail logs management events to CloudTrail itself, not to a CloudWatch Logs log group by default; you would need to explicitly configure CloudTrail to deliver events to CloudWatch Logs, and then create a metric filter and alarm, which adds unnecessary complexity. Option C is wrong because writing a Python script to call the CloudTrail LookupEvents API on a schedule introduces polling overhead, latency, and maintenance burden compared to the real-time, push-based EventBridge approach. Option D is wrong because developing a custom Lambda function to query CloudTrail logs in S3 every hour is overly complex, introduces at least one hour of delay, and requires managing S3 bucket notifications or scheduled invocations, all of which are unnecessary when EventBridge can react instantly.

Practice this question →
26
Multi-Selectmedium

A security team wants to detect and alert on potential security threats such as compromised instances or malicious activity within their AWS environment. Which TWO AWS services should be used together to provide comprehensive threat detection?

Select 2 answers
A.AWS Security Hub
B.AWS CloudTrail
C.Amazon Inspector
D.AWS Config
E.Amazon GuardDuty
AnswersA, E

Aggregates and prioritizes security findings.

Why this answer

Amazon GuardDuty (Option E) is a threat detection service that continuously monitors for malicious activity and unauthorized behavior using machine learning, anomaly detection, and integrated threat intelligence feeds. AWS Security Hub (Option A) aggregates findings from GuardDuty and other services, applies automated compliance checks, and enables centralized alerting and response. Together, they provide comprehensive threat detection by combining GuardDuty's raw threat detection with Security Hub's aggregation and orchestration capabilities.

Exam trap

The trap here is that candidates often confuse logging services (CloudTrail, Config) or vulnerability scanners (Inspector) with active threat detection, but GuardDuty and Security Hub are the only pair that provide continuous, intelligent threat monitoring and centralized alerting.

Practice this question →
27
MCQmedium

A company is using Amazon Route 53 and wants to log DNS queries for investigative purposes. The logs must be stored in a centralized S3 bucket in the security account. What is the MOST efficient way to achieve this?

A.Enable VPC Flow Logs and analyze DNS traffic.
B.Enable CloudWatch Logs for Route 53 and stream to a Lambda function that writes to S3.
C.Configure Route 53 Resolver query logging to deliver to the central S3 bucket.
D.Use a custom Lambda function to poll Route 53 logs and write to S3.
AnswerC

Route 53 Resolver query logging is the native capability that records the full DNS query and response data for queries handled by Route 53 Resolver, including those from VPCs, inbound, and outbound endpoints. It can directly write logs to a central S3 bucket, and using a cross-account bucket policy, you can allow Route 53 in your account to deliver into the consolidated logging bucket. This approach avoids any intermediate compute, scales automatically, and is the most straightforward secure delivery mechanism.

Why this answer

Route 53 Resolver query logging natively supports delivering DNS query logs directly to an S3 bucket, including cross-account S3 buckets, without requiring any intermediate services. This is the most efficient method because it eliminates the need for additional compute resources or manual polling, and it directly satisfies the requirement for centralized logging in the security account.

Exam trap

The trap here is that candidates may confuse VPC Flow Logs (which capture network flows) with DNS query logs, or assume that CloudWatch Logs or Lambda are required for S3 delivery, when Route 53 Resolver query logging can directly write to S3 with minimal configuration.

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs capture network traffic metadata (IP addresses, ports, protocols) but do not log DNS query details such as domain names or query types. Option B is wrong because Route 53 does not natively send logs to CloudWatch Logs; you would need to configure query logging to CloudWatch Logs first, then use a subscription filter to stream to Lambda, which adds unnecessary complexity and cost compared to direct S3 delivery. Option D is wrong because there is no native 'Route 53 logs' API to poll; Route 53 Resolver query logging can be configured to deliver directly to S3, making a custom polling Lambda redundant and inefficient.

Practice this question →
28
Matchingmedium

Match each AWS security tool to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Automated vulnerability assessment

Threat detection service

Centralized security findings aggregation

Investigation and analysis of security issues

Resource configuration monitoring and compliance

Why these pairings

Correct matches: AWS Shield protects against DDoS, AWS WAF filters web traffic, and GuardDuty provides threat detection. Common confusions include swapping Shield with WAF and Inspector with Macie.

Practice this question →
29
MCQhard

A company has a multi-account AWS environment using AWS Organizations. The security team wants to ensure that all API activity across all accounts is logged and immutable. CloudTrail is enabled in all accounts, but the logs are stored in individual account buckets. The team wants to centralize logs and prevent any account from disabling logging. What should they do?

A.Create a new CloudTrail trail for each account and configure S3 bucket policies to allow cross-account access.
B.Enable S3 MFA Delete on each account's log bucket and require MFA for IAM users.
C.Use CloudWatch Logs to aggregate logs and set a retention policy of 10 years.
D.Apply an SCP to deny cloudtrail:StopLogging and cloudtrail:DeleteTrail, and create an organization trail that delivers logs to a central S3 bucket with a bucket policy that prevents deletion.
AnswerD

Applying an SCP to the organization root or to all member accounts that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail ensures that even an IAM admin or the root user in a member account cannot disable or delete the trail. An organization trail automatically delivers CloudTrail logs from every account to a designated central S3 bucket, and the bucket policy can explicitly Deny actions such as s3:DeleteBucket, s3:DeleteBucketPolicy, and s3:DeleteObject for all principals, making the log data tamper-proof. This combination provides a centralized, immutable audit record while removing the ability of individual account administrators to interfere with logging. It directly satisfies the requirement to prevent disabling and to protect the integrity of the logs.

Why this answer

It uses an SCP to prevent disabling CloudTrail (denying cloudtrail:StopLogging and cloudtrail:DeleteTrail) and creates an organization trail that delivers logs to a central S3 bucket. The central bucket policy prevents deletion of logs, ensuring immutability and centralized logging across all accounts in the AWS Organization.

Exam trap

The trap here is that candidates often confuse S3 MFA Delete or cross-account bucket policies as sufficient for immutability and centralization, but they fail to address the core requirement of preventing accounts from disabling CloudTrail itself, which requires an SCP or organization trail.

How to eliminate wrong answers

Option A is wrong because creating separate trails per account does not centralize logs into a single location, and cross-account S3 bucket policies alone do not prevent individual accounts from disabling their own CloudTrail. Option B is wrong because enabling S3 MFA Delete on each account's log bucket only protects against accidental deletion of objects, but does not prevent an account from stopping or deleting the CloudTrail trail itself, nor does it centralize logs. Option C is wrong because CloudWatch Logs aggregation does not provide immutability; logs can be deleted or altered in CloudWatch Logs, and a retention policy of 10 years does not prevent deletion of the log group or stream.

Practice this question →
30
MCQhard

A company is using Amazon GuardDuty to detect threats in its AWS environment. The security team notices that GuardDuty is generating a high number of 'UnauthorizedAccess:IAMUser/MaliciousIPCaller' findings for an IAM user that is used by a legacy application. The security team has verified that the IP addresses flagged are not malicious but are legitimate IPs used by the application's third-party service. The company wants to suppress these findings without disabling GuardDuty entirely. Which solution is the MOST effective and secure?

A.Disable the specific finding type in GuardDuty settings.
B.Create a GuardDuty suppression rule that automatically archives findings for that IAM user.
C.Create a VPC flow log filter to exclude traffic from those IP addresses.
D.Modify the IAM user's permissions to restrict the IP addresses it can use.
AnswerB

Suppression rules allow you to filter out known false positives based on specific criteria.

Why this answer

GuardDuty suppression rules allow you to automatically archive findings that match specific criteria, such as a particular finding type and IAM user ARN. This suppresses false positives for that user without affecting other findings. Option B is correct because it uses this built-in feature.

Option A is incorrect because disabling the finding type would suppress all such findings for all users, which is too broad. Option C is incorrect because VPC flow log filters control logging, not GuardDuty findings. Option D is incorrect because modifying IAM permissions does not influence GuardDuty detection or suppression.

Practice this question →
31
MCQmedium

A security engineer is investigating a potential security incident. CloudTrail logs show that an IAM user 'admin' deleted an S3 bucket at 2023-01-15T10:30:00Z. The engineer needs to find the source IP address and user agent of the request. Which CloudTrail log field contains this information?

A.eventID
B.requestParameters
C.userAgent and sourceIPAddress
D.resources
AnswerC

These fields contain the required information.

Why this answer

CloudTrail logs capture the `userAgent` and `sourceIPAddress` fields directly in the log event record. These fields are part of the CloudTrail `Event` record structure, specifically under the `userIdentity` and `sourceIPAddress` top-level attributes, and they provide the exact source IP address and user agent string (e.g., AWS CLI, SDK, console browser) for the API call that deleted the S3 bucket.

Exam trap

The trap here is that candidates often confuse `requestParameters` with containing all request metadata, but it only holds the API call's input parameters, not the network-level origin details like source IP or user agent.

How to eliminate wrong answers

Option A is wrong because `eventID` is a unique identifier for the CloudTrail event, used for deduplication and correlation, but it does not contain the source IP or user agent. Option B is wrong because `requestParameters` contains the API request parameters (e.g., bucket name, region) but not the network-level metadata like source IP or user agent. Option D is wrong because `resources` lists the AWS resources involved in the event (e.g., the S3 bucket ARN) but does not include the source IP or user agent.

Practice this question →
32
Multi-Selectmedium

A company is implementing a security monitoring solution for its AWS environment. Which TWO services can be used to detect and alert on suspicious API activity? (Choose TWO.)

Select 2 answers
A.Amazon GuardDuty
B.AWS CloudTrail
C.Amazon Inspector
D.AWS Config
E.VPC Flow Logs
AnswersA, B

GuardDuty analyzes CloudTrail events and other data sources to detect suspicious API activity.

Why this answer

Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior, including suspicious API activity. It analyzes AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs to generate security findings and alerts. GuardDuty uses machine learning and anomaly detection to identify patterns such as unusual API calls, credential compromise, or reconnaissance attempts, making it a correct choice for detecting and alerting on suspicious API activity.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which logs API activity) with a service that also detects and alerts on suspicious activity, but CloudTrail itself does not analyze or alert—it only records events; GuardDuty is needed for detection and alerting.

Practice this question →
33
MCQeasy

A security engineer needs to monitor for unauthorized changes to security group rules in an AWS account. Which AWS service can evaluate security group rules against a desired configuration and alert on changes?

A.AWS Security Hub
B.AWS Config
C.Amazon GuardDuty
D.AWS CloudTrail
AnswerB

AWS Config is the correct choice because it continuously records configuration changes to your security groups, including additions or deletions of ingress and egress rules. By using managed or custom Config rules, you can define a desired security group configuration (for example, disallowing SSH access from 0.0.0.0/0) and AWS Config will evaluate each change against that baseline, generating compliance alerts and invoking remediation via EventBridge or Lambda when a noncompliant change occurs.

Why this answer

AWS Config is correct because it provides a managed rule called 'restricted-ssh' or custom rules using AWS Config managed rules or Lambda functions to evaluate security group rules against a desired configuration. When a security group rule is added, removed, or modified, AWS Config detects the configuration change, evaluates it against the defined rules, and can trigger an Amazon SNS notification to alert the security engineer. This makes AWS Config the appropriate service for continuous monitoring and alerting on unauthorized changes to security group rules.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which logs API calls) with AWS Config (which evaluates the resulting configuration state), leading them to choose CloudTrail because they think logging API calls is sufficient for monitoring unauthorized changes, but CloudTrail does not evaluate the configuration against a desired state or provide alerting on noncompliant rules.

How to eliminate wrong answers

Option A is wrong because AWS Security Hub aggregates security findings from multiple services (like AWS Config, GuardDuty, and Inspector) and provides a comprehensive security posture view, but it does not directly evaluate security group rules against a desired configuration or generate alerts for unauthorized changes on its own. Option C is wrong because Amazon GuardDuty is a threat detection service that analyzes VPC Flow Logs, DNS logs, and CloudTrail events for malicious activity, not for monitoring configuration changes to security group rules. Option D is wrong because AWS CloudTrail records API calls (including those that modify security groups) for auditing and forensic analysis, but it does not evaluate the resulting configuration against a desired state or provide alerting on unauthorized changes—it only logs the actions taken.

Practice this question →
34
MCQmedium

A company uses Amazon GuardDuty for threat detection. The security team wants to automatically isolate an EC2 instance that is communicating with a known malicious IP address. Which combination of services should be used?

A.GuardDuty -> AWS Config -> Lambda -> modify security group
B.GuardDuty -> CloudWatch Alarm -> Lambda -> modify security group
C.GuardDuty -> EventBridge -> Lambda -> modify security group
D.GuardDuty -> AWS Shield -> modify security group
E.GuardDuty -> AWS Systems Manager -> modify security group
AnswerC

EventBridge can receive GuardDuty findings and trigger Lambda.

Why this answer

Amazon GuardDuty generates findings that can be sent to Amazon EventBridge as events. EventBridge can then trigger an AWS Lambda function that modifies the security group associated with the EC2 instance to deny traffic to/from the malicious IP address. This architecture provides a serverless, event-driven response mechanism without polling or additional services.

Exam trap

The trap here is that candidates confuse CloudWatch Alarms with EventBridge, not realizing that GuardDuty findings are event-driven and require a rule-based event bus (EventBridge) rather than a metric-based alarm (CloudWatch Alarm) to trigger remediation.

How to eliminate wrong answers

Option A is wrong because AWS Config is a configuration compliance and resource inventory service, not an event-driven trigger for real-time threat response; it cannot directly forward GuardDuty findings to Lambda. Option B is wrong because CloudWatch Alarms are designed for metric-based thresholds (e.g., CPU utilization), not for receiving structured JSON findings from GuardDuty; GuardDuty does not natively publish to CloudWatch Alarms. Option D is wrong because AWS Shield is a DDoS protection service and does not process GuardDuty findings or modify security groups.

Option E is wrong because AWS Systems Manager is an operations management service for patching and automation, not designed to consume GuardDuty findings in real time for security group modifications.

Practice this question →
35
MCQeasy

A company wants to detect and alert on changes to IAM roles and policies in their AWS account. Which combination of AWS services should they use?

A.Amazon GuardDuty and AWS Shield
B.Amazon CloudWatch Logs and AWS Lambda
C.AWS CloudTrail and Amazon EventBridge (CloudWatch Events)
D.AWS Config and Amazon Inspector
AnswerC

AWS CloudTrail is the correct service to record all IAM API activity—such as CreateRole, UpdateAssumeRolePolicy, AttachRolePolicy, and DeleteRole—by generating event logs with details like the requesting principal, source IP, and timestamp. Amazon EventBridge (formerly CloudWatch Events) can be configured with rule patterns that match specific IAM events, then trigger actions like sending notifications to Amazon SNS or invoking a Lambda function. This combination enables near-real-time, event-driven alerting on exactly the IAM role changes that the company cares about, with no need for polling or custom log parsing.

Why this answer

AWS CloudTrail records all API calls, including changes to IAM roles and policies, and delivers log files to an S3 bucket or CloudWatch Logs. Amazon EventBridge (formerly CloudWatch Events) can then be used to create rules that match specific CloudTrail events (e.g., PutRolePolicy, CreateRole) and trigger alerts via SNS, Lambda, or other targets. This combination provides real-time detection and notification of IAM modifications.

Exam trap

The trap here is that candidates often confuse AWS Config (which evaluates resource compliance) with real-time event-driven alerting, or they mistakenly think GuardDuty’s threat detection includes IAM policy change alerts, when in fact CloudTrail + EventBridge is the correct pattern for custom event-based monitoring.

How to eliminate wrong answers

Option A is wrong because Amazon GuardDuty is a threat detection service that monitors for malicious activity using VPC Flow Logs, DNS logs, and CloudTrail events, but it does not directly alert on IAM policy changes; AWS Shield is a DDoS protection service and irrelevant here. Option B is wrong because CloudWatch Logs can store log data but cannot independently detect or alert on IAM changes without a rule engine like EventBridge; Lambda alone cannot trigger on CloudTrail events without an event source such as EventBridge or S3 notifications. Option D is wrong because AWS Config evaluates resource compliance against rules and can detect drift in IAM policies, but it does not provide real-time event-driven alerts; Amazon Inspector is a vulnerability assessment service for EC2 instances and container workloads, not for IAM change detection.

Practice this question →
36
MCQmedium

Refer to the exhibit. A security engineer created this S3 bucket policy to allow CloudTrail to deliver logs. However, log delivery is failing. What is the most likely cause?

A.The bucket is not in the same region as the trail
B.The bucket policy does not specify a condition
C.The bucket is encrypted with SSE-KMS
D.The bucket policy does not allow s3:GetBucketAcl
AnswerD

CloudTrail needs GetBucketAcl to verify bucket ownership.

Why this answer

CloudTrail requires the S3 bucket policy to grant the `s3:GetBucketAcl` permission to the CloudTrail service principal (`cloudtrail.amazonaws.com`) so that it can verify the bucket's ACL before delivering logs. Without this permission, CloudTrail cannot confirm it has write access, causing log delivery to fail. The missing `s3:GetBucketAcl` action is the most likely cause because the policy must explicitly allow both `s3:PutObject` and `s3:GetBucketAcl` for the service to function.

Exam trap

The trap here is that candidates often focus on encryption (SSE-KMS) or region mismatches as common failure points, but AWS specifically tests the requirement for `s3:GetBucketAcl` in CloudTrail bucket policies, which is a less intuitive but mandatory permission for the service to validate access.

How to eliminate wrong answers

Option A is wrong because CloudTrail can deliver logs to a bucket in a different region as long as the bucket policy allows cross-region access and the trail is configured accordingly; region mismatch does not inherently cause failure. Option B is wrong because conditions are optional in S3 bucket policies for CloudTrail; the policy can work without a condition block if the principal and actions are correctly specified. Option C is wrong because SSE-KMS encryption is supported by CloudTrail, provided the bucket policy includes the necessary `kms:Decrypt` and `kms:GenerateDataKey` permissions for the CloudTrail principal; encryption alone does not block log delivery.

Practice this question →
37
MCQmedium

A company is using AWS Organizations with multiple accounts. The security team needs to centrally monitor all root user API activity across all accounts and receive alerts within minutes. What is the MOST efficient solution?

A.Create an organization trail in CloudTrail that logs all accounts. Use CloudWatch Logs metric filters and alarms to detect root login events.
B.Enable CloudTrail in each account and aggregate logs to a centralized S3 bucket. Use Athena queries to detect root activity and send alerts via SNS.
C.Use AWS Lambda functions in each account to poll CloudTrail logs and send root activity to a central SQS queue.
D.Enable AWS Config rules in each account to detect root user activity and send notifications to a central SNS topic.
AnswerA

An organization trail logs all accounts centrally. CloudWatch Logs metric filters can detect root activity and trigger alarms in near real-time.

Why this answer

An organization trail in AWS CloudTrail logs API activity for all accounts in AWS Organizations from a single point, eliminating the need to manage per-account trails. By sending these logs to CloudWatch Logs, you can create metric filters to detect root user login events (e.g., the 'RootLogin' event) and configure CloudWatch Alarms to trigger SNS notifications within minutes, meeting the requirement for centralized monitoring and rapid alerts.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing per-account setups (B, C, D) instead of leveraging the native AWS Organizations integration with CloudTrail, which provides a single, centralized trail for all accounts.

How to eliminate wrong answers

Option B is wrong because while aggregating logs to a centralized S3 bucket is possible, using Athena queries to detect root activity is not efficient for real-time alerts within minutes; Athena is designed for ad-hoc querying of historical data, not for streaming or low-latency alerting. Option C is wrong because using Lambda functions in each account to poll CloudTrail logs introduces unnecessary complexity, latency, and cost; CloudTrail can deliver logs directly to CloudWatch Logs without polling, and a centralized solution is more efficient. Option D is wrong because AWS Config rules are designed for evaluating resource configurations against desired policies, not for monitoring API activity like root user logins; Config does not natively capture CloudTrail events and cannot provide real-time alerts for root API activity.

Practice this question →
38
MCQhard

A company uses AWS CloudTrail to log all API activity and delivers logs to an S3 bucket with server-side encryption (SSE-S3). The security team needs to ensure that only authorized personnel can access the logs and that any unauthorized access attempts are logged and alerted. Additionally, the team wants to prevent the logs from being deleted for at least one year. Which combination of actions should be taken?

A.Enable S3 Object Lock with a retention period of one year; enable S3 server access logs; use a bucket policy with a condition that allows access only from authorized IAM roles or users.
B.Enable S3 default encryption (SSE-S3) on the bucket; enable S3 server access logs; attach an IAM policy that allows only authorized users to access the bucket.
C.Enable MFA Delete on the bucket; enable CloudTrail log file validation; use bucket ACLs to restrict access.
D.Enable S3 Inventory to track objects; enable CloudTrail to log S3 API calls; use a bucket policy with a deny effect for unauthorized users.
AnswerA

Object Lock prevents deletion; server access logs record all requests; bucket policy with conditions restricts access.

Why this answer

S3 Object Lock with a retention period of one year enforces a write-once-read-many (WORM) model, preventing any deletion or overwrite of log objects for that duration. S3 server access logs capture detailed records of all requests made to the bucket, including unauthorized access attempts, which can be used for alerting. The bucket policy with a condition restricting access to authorized IAM roles or users ensures that only permitted principals can access the logs, meeting the security team's requirements for access control, logging of unauthorized attempts, and deletion prevention.

Exam trap

The trap here is that candidates often confuse S3 default encryption with data retention controls, or assume that CloudTrail logging of S3 API calls is sufficient to capture unauthorized access attempts, when in fact S3 server access logs are needed for request-level logging of denied operations.

How to eliminate wrong answers

Option B is wrong because enabling S3 default encryption (SSE-S3) only encrypts data at rest but does not prevent deletion of logs; it lacks a retention mechanism like Object Lock. Option C is wrong because MFA Delete protects against accidental deletion but does not enforce a minimum retention period (it can be bypassed by an authorized user with MFA), and bucket ACLs are deprecated and less granular than bucket policies for access control. Option D is wrong because S3 Inventory only provides a list of objects and their metadata, not real-time logging of access attempts; CloudTrail logs S3 API calls but does not log unauthorized access attempts at the S3 request level (e.g., denied GET requests), and a bucket policy with a deny effect for unauthorized users does not inherently log those attempts or prevent deletion.

Practice this question →
39
MCQeasy

A security team needs to detect unauthorized attempts to access an S3 bucket that contains sensitive data. Which AWS service can automatically analyze S3 access logs and generate findings for suspicious activity?

A.Amazon Macie
B.Amazon GuardDuty
C.AWS Trusted Advisor
D.Amazon Detective
AnswerB

GuardDuty analyzes S3 data events for suspicious activity.

Why this answer

Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads. It can analyze VPC Flow Logs, AWS CloudTrail event logs, and DNS logs, and when S3 access logging is enabled, GuardDuty can ingest those logs to detect suspicious S3 access patterns, such as anomalous data exfiltration or access from unusual geographies. GuardDuty then generates security findings that can be automated for remediation.

Exam trap

The trap here is that candidates often confuse Amazon Macie's data classification and sensitive data discovery capabilities with GuardDuty's threat detection, mistakenly thinking Macie can analyze access logs for unauthorized activity, when in fact Macie focuses on data content and access control policies, not real-time log-based threat detection.

How to eliminate wrong answers

Option A is wrong because Amazon Macie is a data security and data privacy service that uses machine learning to discover, classify, and protect sensitive data in S3, but it does not automatically analyze S3 access logs for unauthorized access attempts or generate findings for suspicious activity; it focuses on data classification and access control monitoring via its own findings, not log-based threat detection. Option C is wrong because AWS Trusted Advisor is an advisory service that inspects your AWS environment and makes recommendations for cost optimization, performance, security, and fault tolerance, but it does not perform real-time log analysis or generate findings for suspicious S3 access activity. Option D is wrong because Amazon Detective is a security investigation service that helps analyze and visualize security data to identify the root cause of findings, but it does not automatically analyze S3 access logs to generate findings for suspicious activity; it relies on existing findings from services like GuardDuty to perform its analysis.

Practice this question →
40
MCQhard

A company uses AWS Organizations to manage multiple accounts. The security team needs to implement a centralized logging solution where all VPC Flow Logs from all accounts are sent to a central S3 bucket in the security account. The flow logs must be encrypted with a customer-managed KMS key (CMK) that is owned by the security account. The security engineer has enabled VPC Flow Logs in each account and configured the destination to be the central S3 bucket. However, the flow logs are not being delivered. The engineer checks the S3 bucket policy and confirms that it grants the required permissions to the Flow Logs service principal. What is the MOST likely cause of the failure?

A.The VPC Flow Logs service does not support cross-account delivery.
B.The KMS key policy does not grant the Flow Logs service principal permission to use the key.
C.CloudTrail must be enabled in the source account for Flow Logs to work.
D.The S3 bucket policy is missing a condition for source account.
AnswerB

The key policy must allow the service principal to encrypt.

Why this answer

The KMS key policy must grant the VPC Flow Logs service principal (flow-logs.amazonaws.com) permission to use the customer-managed key for encryption. The engineer verified the S3 bucket policy, so the missing KMS key policy is the most likely cause. Option A is incorrect because VPC Flow Logs can deliver to cross-account S3 buckets.

Option C is incorrect because CloudTrail is not required for Flow Logs. Option D is incorrect because the S3 bucket policy already grants permissions to the Flow Logs service principal.

Practice this question →
41
MCQeasy

A security engineer needs to centralize logs from multiple AWS accounts into a single S3 bucket. Which solution is most secure?

A.Deliver logs to separate buckets per account and use S3 replication to copy them to a central bucket.
B.Use a single S3 bucket in the management account and have each account write logs directly without additional permissions.
C.Configure each account's CloudTrail to deliver to a centralized S3 bucket in a logging account, with a bucket policy allowing CloudTrail from source accounts.
D.Stream logs to Amazon Kinesis Data Firehose in each account and consolidate into a single S3 bucket via cross-account delivery.
AnswerC

This is correct because CloudTrail can be configured as a single trail (or one per source account) to deliver to a centralized S3 bucket in a dedicated logging account. The logging account's S3 bucket policy must explicitly authorize cloudtrail.amazonaws.com for each source account, usually with a source account and source ARN condition, so CloudTrail can write objects to a per-source prefix. This creates an immutable, central log store that source-account administrators cannot modify or delete, and it is a standard, well-supported pattern for centralized logging.

Why this answer

It uses a centralized S3 bucket in a dedicated logging account with a bucket policy that explicitly grants CloudTrail from source accounts the s3:PutObject permission. This ensures logs are written directly to a single location without intermediate replication or cross-account delivery that could introduce latency or complexity. The bucket policy can restrict access to only CloudTrail service principals and specific source account ARNs, maintaining a secure, auditable log trail.

Exam trap

The trap here is that candidates assume S3 replication (Option A) is the simplest centralized solution, but they overlook that CloudTrail can deliver directly to a cross-account bucket with a properly scoped bucket policy, which is more secure and avoids the overhead of replication or streaming services.

How to eliminate wrong answers

Option A is wrong because S3 replication introduces a time delay and requires the source bucket to have versioning enabled, which adds complexity and potential for log loss if replication fails; it also duplicates storage costs and does not prevent the source account from modifying logs before replication. Option B is wrong because having each account write logs directly to a bucket in the management account without additional permissions is insecure—CloudTrail requires explicit cross-account permissions via a bucket policy, and without them, the write will fail; this option also violates the principle of least privilege by allowing all accounts to write to a single bucket without restriction. Option D is wrong because streaming logs through Kinesis Data Firehose introduces an additional service that can fail or throttle, adds latency, and requires managing cross-account delivery policies for Firehose, which is more complex and less secure than direct CloudTrail delivery to S3 with a bucket policy.

Practice this question →
42
MCQhard

Refer to the exhibit. A security engineer is reviewing an IAM policy attached to a user. The policy is intended to allow the user to get and put objects in the S3 bucket 'example-bucket' only from the IP range 203.0.113.0/24. However, the user reports that they are unable to put objects from an IP within that range. What is the most likely cause of this issue?

A.The condition key should be 'aws:sourceIp' (lowercase 's').
B.The policy should use the 'NotIpAddress' condition operator instead of 'IpAddress'.
C.The resource ARN should be 'arn:aws:s3:::example-bucket' without the '/*' suffix.
D.The policy lacks a separate statement to allow 's3:ListBucket' on the bucket resource.
AnswerD

For console access, ListBucket is required; without it, the user cannot see the bucket but can still perform PutObject via API. However, the question implies inability to put objects, which could be due to missing ListBucket in some SDK scenarios.

Why this answer

The policy only grants s3:GetObject and s3:PutObject actions on the bucket's objects (arn:aws:s3:::example-bucket/*), but does not include a separate statement allowing s3:ListBucket on the bucket resource (arn:aws:s3:::example-bucket). Without s3:ListBucket, the user cannot list the bucket's contents, which is often required by the AWS CLI or SDK to resolve object keys before performing put operations. The IP condition is correctly applied, so the issue is the missing list permission.

Exam trap

The trap here is that candidates focus on the IP condition syntax or resource ARN format and overlook the common requirement for an explicit s3:ListBucket permission when performing object operations via the AWS CLI or SDK.

How to eliminate wrong answers

Option A is wrong because 'aws:sourceIp' is the correct case-sensitive condition key; AWS condition keys are case-sensitive and 'aws:sourceIp' is valid. Option B is wrong because using 'NotIpAddress' would deny access from the specified range and allow all others, which is the opposite of the intended effect. Option C is wrong because the resource ARN 'arn:aws:s3:::example-bucket/*' is correct for object-level actions (GetObject, PutObject); the bucket-level ARN without '/*' is used for bucket-level actions like ListBucket, not for object operations.

Practice this question →
43
MCQmedium

A company uses AWS Organizations with multiple accounts. The security team wants to centralize security logs (CloudTrail, VPC Flow Logs, AWS Config) from all accounts into a single S3 bucket for analysis. What is the MOST secure way to set up this centralized logging?

A.Create a dedicated S3 bucket in the management account, enable S3 default encryption, and configure service delivery for each account.
B.Create a dedicated S3 bucket in the security account with a bucket policy that grants write access to the logging services of all accounts and enforces encryption in transit and at rest.
C.Configure each account to deliver logs to the same S3 bucket used for other data.
D.Create an S3 bucket in each account and use S3 replication to copy logs to a central bucket.
AnswerB

This approach aligns with AWS best practices by placing logs in a dedicated security account that is isolated from production workloads and the management account. The bucket policy grants write access only to the logging services of all accounts, using service principals like logging.s3.amazonaws.com, while condition keys such as aws:SecureTransport force TLS and a deny statement without s3:x-amz-server-side-encryption ensures all objects are encrypted at rest. This centralizes auditability, enforces least privilege, and provides a single source of truth for compliance and incident investigation.

Why this answer

It uses a dedicated S3 bucket in a security account (not the management account) with a bucket policy that explicitly grants write access to the logging services (CloudTrail, VPC Flow Logs, AWS Config) from all accounts, while enforcing encryption in transit (aws:SecureTransport) and at rest (default SSE-S3 or SSE-KMS). This follows the security best practice of isolating logs in a separate account and using resource-based policies to restrict access, preventing accidental deletion or modification by other accounts.

Exam trap

The trap here is that candidates often assume the management account is the safest place for centralized logs, but AWS best practices recommend using a dedicated security account to isolate logs and avoid compromising the management account's administrative boundaries.

How to eliminate wrong answers

Option A is wrong because placing the S3 bucket in the management account violates the principle of least privilege and separation of duties; the management account should not be used for operational workloads, and service delivery configuration alone does not enforce encryption in transit or restrict access to only logging services. Option C is wrong because using the same S3 bucket for other data increases the attack surface and risk of unauthorized access or log tampering, and it does not enforce encryption or proper access controls for logging services. Option D is wrong because S3 replication introduces complexity, potential latency, and does not enforce encryption in transit or at rest at the source; it also requires additional permissions and does not centralize logs directly from the logging services.

Practice this question →
44
MCQhard

A company has a multi-account AWS environment using AWS Organizations. The security team wants to centralize all CloudTrail logs from all accounts into a single S3 bucket in the management account. The bucket policy allows cross-account access. However, logs from member accounts are not being delivered. What is the most likely cause?

A.CloudTrail cannot deliver logs to a bucket in a different account.
B.The S3 bucket is not configured with a CloudTrail prefix.
C.CloudTrail is not enabled in the member accounts.
D.The S3 bucket policy does not grant `s3:PutObject` permission to the member accounts.
AnswerD

Without this permission, CloudTrail cannot write logs to the bucket.

Why this answer

The S3 bucket policy must explicitly grant the `s3:PutObject` permission to the IAM roles or users from the member accounts that CloudTrail uses to deliver logs. Without this permission, CloudTrail in the member accounts cannot write log files to the central bucket, even if the bucket is configured for cross-account access. The bucket policy must also include a condition that the object ownership is set to the bucket owner (via `s3:x-amz-acl: bucket-owner-full-control`) to ensure the management account retains control.

Exam trap

The trap here is that candidates often assume CloudTrail cannot deliver across accounts (Option A) or that a missing prefix (Option B) is the issue, when in fact the root cause is almost always an insufficiently permissive S3 bucket policy that does not grant `s3:PutObject` to the member accounts' CloudTrail roles.

How to eliminate wrong answers

Option A is wrong because CloudTrail can deliver logs to an S3 bucket in a different account when the bucket policy grants the necessary cross-account permissions; this is a standard multi-account logging pattern. Option B is wrong because a CloudTrail prefix is optional and used for organizing logs within a bucket, not for enabling cross-account log delivery; its absence does not prevent log delivery. Option C is wrong because the question states that logs from member accounts are not being delivered, which implies CloudTrail is enabled in those accounts but the delivery is failing due to a permissions issue, not because CloudTrail is disabled.

Practice this question →
45
MCQhard

A company is using Amazon GuardDuty to detect threats. The security team notices that GuardDuty findings are not triggering the intended automated response via a CloudWatch Events rule. What is the most likely reason?

A.The CloudWatch Events rule's event pattern does not match the GuardDuty finding event structure.
B.The GuardDuty detector is in a different region than the CloudWatch Events rule.
C.The Lambda function invoked by CloudWatch Events does not have an IAM role assigned.
D.VPC Flow Logs are not enabled.
AnswerA

GuardDuty emits findings to CloudWatch Events as structured events, and the rule's pattern must exactly match their JSON schema. Specifically, the pattern must use "source": ["aws.guardduty"] and "detail-type": ["GuardDuty Finding"]; otherwise the rule is never triggered. If the pattern mismatches, the Lambda function will not be invoked, even though the finding is visible in the GuardDuty console. This is the most common cause of a silent rule failure.

Why this answer

GuardDuty findings are sent to CloudWatch Events as events with a specific structure, including fields like 'detail-type' set to 'GuardDuty Finding' and 'source' set to 'aws.guardduty'. If the CloudWatch Events rule's event pattern does not match this exact structure—for example, if it filters on the wrong 'source' or 'detail-type'—the rule will not trigger the intended automated response. This is the most common reason for the described failure.

Exam trap

The trap here is that candidates often assume the issue is with permissions (Lambda role) or prerequisites (VPC Flow Logs), but the core problem is almost always a mismatch in the event pattern structure, which is a fundamental CloudWatch Events concept.

How to eliminate wrong answers

Option B is wrong because CloudWatch Events rules can be configured to receive events from any region by using a cross-region event bus or by setting up the rule in the same region as the GuardDuty detector; the detector and rule do not need to be in the same region for the rule to match events, but the default behavior is that events are regional unless explicitly configured otherwise. Option C is wrong because the Lambda function's IAM role is only relevant for execution permissions after the rule triggers; if the rule does not match the event, the Lambda function is never invoked, so its role is irrelevant to the triggering issue. Option D is wrong because VPC Flow Logs are not required for GuardDuty to generate findings or for CloudWatch Events to receive them; GuardDuty uses multiple data sources (DNS logs, VPC Flow Logs, CloudTrail logs) but the absence of VPC Flow Logs does not prevent findings from being sent to CloudWatch Events.

Practice this question →
46
MCQeasy

A DevOps engineer needs to monitor failed SSH login attempts to Amazon EC2 instances. Which AWS service should the engineer use to collect and analyze the login events?

A.AWS Config
B.Amazon CloudWatch Logs
C.AWS CloudTrail
D.VPC Flow Logs
AnswerB

Amazon CloudWatch Logs is the correct choice because the CloudWatch agent (or the legacy Logs agent) can be installed on an EC2 instance to tail local system logs, including /var/log/auth.log on Amazon Linux or /var/log/secure on RHEL/CentOS. Once collected, you can define a metric filter to match patterns such as 'Failed password' or 'Connection refused' that sshd emits on failed attempts, and then trigger alarms based on those metrics. This directly captures the OS-level authentication events needed to monitor failed SSH logins.

Why this answer

Amazon CloudWatch Logs is the correct service because it can ingest, monitor, and analyze log data from EC2 instances, including SSH authentication logs (e.g., /var/log/secure or /var/log/auth.log). By installing the CloudWatch Logs agent on the EC2 instance, the engineer can stream these log events to CloudWatch Logs, where they can be searched, visualized, and used to trigger alarms on failed SSH attempts. AWS Config tracks resource configuration changes, not OS-level login events; CloudTrail records AWS API calls, not guest OS logs; and VPC Flow Logs capture network traffic metadata, not application or authentication logs.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which logs AWS API calls) with OS-level auditing, mistakenly thinking CloudTrail captures guest OS login events, when in fact CloudTrail only records control-plane actions and never sees inside the instance's operating system.

How to eliminate wrong answers

Option A is wrong because AWS Config is a service for evaluating and recording changes to AWS resource configurations (e.g., security group rules, instance types), not for collecting or analyzing OS-level login events like SSH attempts. Option C is wrong because AWS CloudTrail logs API calls made to the AWS control plane (e.g., RunInstances, DescribeInstances), not guest OS activities such as SSH logins, which occur within the instance's operating system. Option D is wrong because VPC Flow Logs capture metadata about IP traffic flowing to and from network interfaces (e.g., source/destination IP, ports, protocol), but they do not log application-layer events like SSH authentication successes or failures.

Practice this question →
47
MCQeasy

A security engineer needs to monitor for suspicious API calls in near real-time and trigger an automated response. Which AWS service should be used to capture and analyze these API calls?

A.AWS CloudHSM
B.Amazon GuardDuty
C.AWS CloudTrail
D.AWS Config
AnswerC

AWS CloudTrail records API calls for audit and can be integrated with CloudWatch Logs for near real-time monitoring.

Why this answer

AWS CloudTrail is the correct service because it captures all API calls made to the AWS environment, including those from the AWS Management Console, SDKs, CLI, and AWS services. By enabling CloudTrail Insights or using CloudWatch Events with CloudTrail logs, you can monitor for suspicious API calls in near real-time and trigger automated responses via Lambda functions or SNS notifications.

Exam trap

The trap here is that candidates confuse GuardDuty's threat detection capabilities with the actual capture of API calls, forgetting that GuardDuty consumes CloudTrail logs rather than generating them, so the service that captures the calls is CloudTrail, not GuardDuty.

How to eliminate wrong answers

Option A is wrong because AWS CloudHSM provides hardware security modules for cryptographic key storage and operations, not for monitoring or analyzing API calls. Option B is wrong because Amazon GuardDuty is a threat detection service that analyzes VPC Flow Logs, DNS logs, and CloudTrail events for malicious activity, but it does not natively capture API calls itself—it relies on CloudTrail as a data source, and the question asks for the service that captures and analyzes the calls, not just analyzes them. Option D is wrong because AWS Config evaluates resource configurations against desired policies and tracks configuration changes, but it does not capture or analyze API calls; it focuses on resource state, not the API actions that led to that state.

Practice this question →
48
MCQmedium

Refer to the exhibit. A security engineer configured this S3 bucket policy for CloudTrail, but CloudTrail logs are not being delivered. What is the MOST likely missing permission?

A.Missing s3:GetBucketAcl permission.
B.The condition StringEquals should be StringLike.
C.Missing s3:PutObject permission for the bucket.
D.The bucket ARN is incorrect.
AnswerC

CloudTrail also requires s3:PutObject on the bucket ARN to write log files, not just the prefix.

Why this answer

CloudTrail requires that the S3 bucket policy grants the s3:PutObject permission to the CloudTrail service principal to write log files. The exhibit shows a bucket policy that grants s3:GetBucketAcl but is missing a statement that allows s3:PutObject on the bucket (or on the appropriate log prefix). Without s3:PutObject, CloudTrail cannot deliver log files to the bucket.

Therefore, the most likely missing permission is s3:PutObject for the bucket, making option C correct.

Practice this question →
49
MCQeasy

A company wants to centralize logs from multiple AWS accounts into a single S3 bucket for analysis. The accounts are part of an AWS Organizations organization. Which set of steps will accomplish this?

A.Create an organization trail in the management account with logging enabled for all accounts.
B.Use AWS Config to aggregate logs from all accounts into a central S3 bucket.
C.Create a CloudTrail trail in each account and configure each to write to the same S3 bucket.
D.Set up Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket.
AnswerA

CloudTrail organization trails are created in the management account and automatically apply to every account in AWS Organizations, delivering all account logs to a single S3 bucket without per-account configuration. This is the native mechanism for centralizing management-event logging across an organization, and the management account owns and controls the trail. Because the trail is organization-wide, you get consistent logging coverage and centralized governance.

Why this answer

AWS Organizations allows you to create an organization trail from the management account. When you enable logging for all accounts in the organization, CloudTrail automatically creates a trail that applies to every account in the organization, delivering log files from all accounts to a single S3 bucket without needing per-account configuration.

Exam trap

The trap here is that candidates often assume each account must individually configure CloudTrail to write to a shared bucket, overlooking the organization trail feature that automates multi-account log centralization through AWS Organizations.

How to eliminate wrong answers

Option B is wrong because AWS Config aggregates configuration items and compliance snapshots, not CloudTrail logs; it is designed for resource configuration tracking, not centralized log delivery. Option C is wrong because while each account can write to the same S3 bucket, this approach requires manual setup per account, does not leverage Organizations for automatic multi-account management, and can lead to permission conflicts or log delivery failures without proper bucket policies. Option D is wrong because Amazon Kinesis Data Firehose is a streaming data delivery service, not a native CloudTrail log destination; CloudTrail cannot directly send logs to Firehose without additional configuration, and this approach does not provide the centralized, automatic trail management that an organization trail offers.

Practice this question →
50
Multi-Selectmedium

Which TWO actions should a security engineer take to ensure that Amazon GuardDuty can effectively monitor for suspicious activity in a VPC? (Choose two.)

Select 2 answers
A.Enable DNS query logging and publish to CloudWatch Logs.
B.Enable VPC Flow Logs and publish to CloudWatch Logs.
C.Enable CloudTrail data events for S3.
D.Enable S3 server access logs.
E.Enable AWS Config configuration history.
AnswersA, B

GuardDuty uses DNS logs for domain-based threat detection.

Why this answer

Amazon GuardDuty relies on DNS query logs to detect suspicious domain name resolution patterns, such as DNS tunneling or communication with known malicious domains. By enabling DNS query logging and publishing to CloudWatch Logs, GuardDuty can ingest this data as a source for its threat detection algorithms. Without DNS logs, GuardDuty cannot analyze DNS-based attack vectors within the VPC.

Exam trap

The trap here is that candidates often think enabling CloudTrail or S3 logs is sufficient for VPC monitoring, but GuardDuty specifically requires VPC Flow Logs and DNS query logs as its primary network-based data sources for detecting suspicious VPC activity.

Practice this question →
51
MCQhard

A company is using Amazon CloudWatch Logs to store application logs. The security team needs to retain logs for 7 years to comply with regulatory requirements. The logs are accessed infrequently after the first 90 days. What is the MOST cost-effective way to meet these retention and access requirements?

A.Export logs from CloudWatch Logs to an S3 bucket, then use S3 Lifecycle policies to transition logs to S3 Glacier Deep Archive after 90 days.
B.Stream logs to an S3 bucket using Kinesis, then use S3 Lifecycle policies to transition logs to S3 Standard-IA after 90 days.
C.Set a retention policy on the CloudWatch Logs log group to 7 years and use CloudWatch Logs Insights for queries.
D.Set a retention policy on the CloudWatch Logs log group to 7 years and use CloudWatch Logs lifecycle policies to transition to Amazon S3 Glacier.
AnswerA

Exporting log data from CloudWatch Logs to S3 via the CreateExportTask API is the native, recommended path for long-term archival. Once in S3, a lifecycle rule can transition objects from S3 Standard to S3 Glacier Deep Archive after 90 days, minimizing storage costs for data that is rarely, if ever, accessed while meeting the 7-year compliance requirement. This approach also lets you set a short retention on the original log group to avoid ongoing CloudWatch Logs storage fees after export completes.

Why this answer

Exporting logs from CloudWatch Logs to Amazon S3 and using S3 Lifecycle policies to transition them to S3 Glacier Deep Archive after 90 days is the most cost-effective solution. CloudWatch Logs storage costs are higher than S3, and Glacier Deep Archive offers the lowest storage cost for infrequently accessed data that must be retained for 7 years. This approach meets the retention requirement while minimizing costs for logs that are rarely accessed after the initial 90-day period.

Exam trap

The trap here is that candidates may incorrectly assume CloudWatch Logs can directly transition logs to Glacier via lifecycle policies, but CloudWatch Logs does not support lifecycle transitions to S3 storage classes; logs must first be exported to S3.

How to eliminate wrong answers

Option B is wrong because S3 Standard-IA is more expensive than Glacier Deep Archive for long-term archival storage, and streaming logs via Kinesis adds unnecessary cost and complexity when a direct export from CloudWatch Logs to S3 is available. Option C is wrong because retaining logs in CloudWatch Logs for 7 years is significantly more expensive than storing them in S3 Glacier Deep Archive, and CloudWatch Logs Insights queries incur additional costs for data scanning. Option D is wrong because CloudWatch Logs does not have lifecycle policies to transition logs directly to Amazon S3 Glacier; the correct mechanism is to export logs to S3 first and then use S3 Lifecycle policies to transition to Glacier storage classes.

Practice this question →
52
MCQeasy

A company wants to monitor failed SSH login attempts to its EC2 instances. Which AWS service should be used to collect and analyze these logs?

A.VPC Flow Logs
B.Amazon CloudWatch Logs with the unified CloudWatch agent
C.AWS CloudTrail
D.AWS Config
AnswerB

The CloudWatch agent can collect OS logs and deliver them to CloudWatch Logs for analysis.

Why this answer

Amazon CloudWatch Logs with the unified CloudWatch agent is the correct choice because the agent can be configured to collect and forward system log files, such as /var/log/secure (Amazon Linux) or /var/log/auth.log (Ubuntu), which record SSH authentication attempts including failures. This allows centralized monitoring and analysis of failed SSH logins via CloudWatch Logs Insights or metric filters.

Exam trap

The trap here is that candidates confuse VPC Flow Logs (network-level) with OS-level logs, or assume CloudTrail captures all activity including guest OS events, when in fact CloudTrail only records AWS API calls, not in-OS authentication logs.

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs capture metadata about network traffic (IP addresses, ports, protocols) but do not log application-level events like SSH authentication failures. Option C is wrong because AWS CloudTrail records API calls made to the AWS control plane (e.g., EC2 RunInstances) but does not capture guest OS-level logs such as SSH login attempts. Option D is wrong because AWS Config tracks resource configuration changes and compliance, not operating system log events.

Practice this question →
53
MCQmedium

Refer to the exhibit. A CloudWatch Logs metric filter is configured. Which log event will trigger the filter to create a metric?

A."2023-01-01 12:00:00 ERROR Connection refused"
B."ERROR: Connection refused"
C."2023-01-01 12:00:00 WARNING Disk full"
D."2023-01-01 12:00:00 INFO Starting process"
AnswerB

This log event starts with 'ERROR:', which matches the metric filter pattern exactly, triggering the metric.

Why this answer

The metric filter pattern is configured to match log events that begin with the string 'ERROR:'. Option B starts with 'ERROR:', so it triggers the metric filter. Options A, C, and D start with a timestamp and do not match the pattern.

Exam trap

The trap is that the filter pattern may appear to require multiple tokens or a specific format, but in reality it can be a simple string match. Many candidates overthink the pattern syntax and fail to recognize that a single term can be a valid filter pattern.

Practice this question →
54
MCQeasy

A company wants to centrally collect CloudTrail logs from multiple AWS accounts and enable real-time analysis. Which combination of services should be used?

A.CloudTrail, Amazon Kinesis Data Firehose, and Amazon Athena.
B.CloudTrail, Amazon S3, S3 Event Notifications, and AWS Lambda.
C.CloudTrail, Amazon CloudWatch Logs, and cross-account log subscription.
D.CloudTrail, Amazon S3, and Amazon Simple Queue Service (SQS).
AnswerB

This design works because CloudTrail delivers compressed log files as S3 objects, and S3 Event Notifications invoke Lambda for each new object. Lambda then unpacks the gzipped CloudTrail JSON, filters for key API activity, and writes normalized events to CloudWatch Logs or fires alerts, giving near-real-time analysis without managing servers or a streaming buffer. It is serverless, cost-effective, and tightly integrated with S3, making it the natural choice for a central log collection and analysis pipeline.

Why this answer

It enables centralized collection of CloudTrail logs from multiple accounts by delivering logs to a central S3 bucket, then using S3 Event Notifications to trigger a Lambda function for real-time analysis. This pattern allows near-instant processing of log events as they arrive, meeting the requirement for real-time analysis without polling or batching delays.

Exam trap

The trap here is that candidates often assume Kinesis Data Firehose or CloudWatch Logs are required for real-time analysis, but S3 Event Notifications with Lambda provide a simpler, cost-effective, and fully serverless solution for near-real-time processing of CloudTrail logs.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Firehose is designed for streaming data ingestion into destinations like S3 or Redshift, but it does not natively support cross-account CloudTrail log delivery or real-time analysis via Athena (which queries data at rest, not in real-time). Option C is wrong because cross-account log subscription to CloudWatch Logs requires CloudTrail to deliver logs to CloudWatch Logs, which incurs additional costs and does not inherently provide real-time analysis; it also lacks the event-driven trigger for immediate processing. Option D is wrong because Amazon SQS is a message queue service that would require additional components to process logs in real-time, and CloudTrail cannot directly deliver logs to SQS; this setup adds latency and complexity without a built-in processing trigger.

Practice this question →
55
MCQeasy

A company is using Amazon CloudWatch Logs to store application logs. The security team needs to ensure that logs are encrypted at rest using a customer-managed KMS key (CMK). What configuration is required?

A.Add a KMS key policy that allows CloudWatch Logs to use the key.
B.Associate the CMK with the CloudWatch Logs log group by specifying the key ARN in the log group's encryption configuration.
C.Enable default encryption on the S3 bucket used for log export with a CMK.
D.Configure the S3 bucket policy to require SSE-KMS for log delivery.
AnswerB

To encrypt a CloudWatch Logs log group with a customer-managed CMK, you must use the AssociateKmsKey operation (or the console's encryption settings) and pass the key ARN for the log group. Once associated, CloudWatch Logs uses that CMK to encrypt all log data written to the log group. This is the action that actually fulfills the requirement; no other configuration changes the encryption of the log group's stored data.

Why this answer

CloudWatch Logs supports server-side encryption with a customer-managed KMS key (CMK) by associating the key ARN with the log group. This is done via the CloudWatch Logs console, AWS CLI, or SDK using the `associate-kms-key` operation, which encrypts all log data at rest within that log group. The KMS key policy must also grant the CloudWatch Logs service principal (`logs.region.amazonaws.com`) permission to use the key, but the core configuration step is associating the key with the log group.

Exam trap

The trap here is that candidates confuse the necessary KMS key policy (Option A) with the actual configuration step of associating the key with the log group, or they mistakenly think that encrypting the S3 export destination (Options C or D) encrypts the logs within CloudWatch Logs itself.

How to eliminate wrong answers

Option A is wrong because while a KMS key policy that allows CloudWatch Logs to use the key is necessary, it is not sufficient on its own; the key must also be explicitly associated with the log group via encryption configuration. Option C is wrong because enabling default encryption on an S3 bucket with a CMK only affects objects stored in that bucket, not the CloudWatch Logs log group itself; log export to S3 is a separate feature and does not encrypt logs at rest within CloudWatch. Option D is wrong because configuring an S3 bucket policy to require SSE-KMS for log delivery only applies to logs exported to S3, not to the encryption of logs stored natively in CloudWatch Logs.

Practice this question →
56
MCQmedium

A security engineer notices that an S3 bucket containing sensitive logs is publicly accessible. Which service should be used to automatically remediate this by applying a bucket policy?

A.AWS Config
B.Amazon GuardDuty
C.AWS Trusted Advisor
D.AWS CloudTrail
AnswerA

AWS Config can evaluate rules and trigger automatic remediation actions.

Why this answer

AWS Config is the correct service because it can continuously monitor S3 bucket configurations and automatically remediate non-compliant resources using AWS Config Rules and AWS Systems Manager Automation documents. When a rule detects that an S3 bucket is publicly accessible, it can trigger an automatic remediation action, such as applying a bucket policy that denies all public access, without manual intervention.

Exam trap

The trap here is that candidates often confuse AWS Config's monitoring and remediation capabilities with GuardDuty's threat detection or Trusted Advisor's advisory checks, failing to recognize that only AWS Config supports automated, rule-based remediation actions.

How to eliminate wrong answers

Option B is wrong because Amazon GuardDuty is a threat detection service that analyzes VPC flow logs, DNS logs, and CloudTrail events to identify malicious activity, but it cannot automatically remediate S3 bucket policies. Option C is wrong because AWS Trusted Advisor provides best-practice recommendations and security checks, including S3 bucket permissions, but it does not have native automated remediation capabilities; it only generates alerts. Option D is wrong because AWS CloudTrail is a logging service that records API calls for auditing and does not have the ability to apply or modify bucket policies automatically.

Practice this question →
57
MCQeasy

A company wants to ensure that all API calls made to their AWS account are logged and immutable. They have enabled AWS CloudTrail and are delivering logs to an S3 bucket. The security team requires that logs cannot be deleted or modified by anyone, including the root user. What should they do?

A.Enable S3 Object Lock with Compliance retention mode on the bucket.
B.Enable MFA Delete on the S3 bucket.
C.Enable S3 Versioning on the bucket.
D.Add a bucket policy that denies s3:DeleteObject for all principals.
AnswerA

Compliance mode prevents any deletion even by root.

Why this answer

S3 Object Lock with retention mode Compliance prevents any user, including root, from deleting or overwriting objects. Option B is wrong because MFA Delete prevents deletion but requires additional authentication and can be disabled by root if they have MFA. Option C is wrong because versioning alone does not prevent deletion of versions; objects can still be deleted, though old versions are retained.

Option D is wrong because bucket policies can be changed by root, so a deny policy is not immutable.

Practice this question →
58
Multi-Selecthard

A security engineer is designing a centralized logging solution for 10 AWS accounts. Which THREE AWS services should be used to aggregate, store, and analyze logs?

Select 3 answers
A.Amazon Kinesis Data Streams
B.AWS Organizations
C.Amazon Athena
D.Amazon CloudWatch Logs
E.Amazon S3
AnswersB, C, E

Organizations helps manage multiple accounts centrally.

Why this answer

AWS Organizations is correct because it provides a centralized management structure for multiple AWS accounts, enabling you to automatically enforce policies and aggregate logs from all member accounts into a central S3 bucket. Amazon S3 is the recommended service for storing large volumes of logs durably and cost-effectively. Amazon Athena enables you to run ad-hoc SQL queries directly on the logs stored in S3, providing a serverless analytics solution for log analysis without the need for complex ETL or infrastructure management.

Together, these three services form a complete solution: Organizations for aggregation, S3 for storage, and Athena for analysis.

Exam trap

The trap here is that candidates often select Amazon Kinesis Data Streams or Amazon CloudWatch Logs as the primary aggregation and storage service, overlooking that AWS Organizations is required to centrally manage log delivery from multiple accounts, and that S3 plus Athena provides the most scalable and cost-effective solution for long-term storage and ad-hoc analysis.

Practice this question →
59
MCQmedium

An organization wants to detect and alert on any IAM user that creates a new access key without using multi-factor authentication (MFA). What is the MOST efficient way to achieve this?

A.Create a CloudWatch Events rule that triggers on CreateAccessKey events, and check if the user's MFA status is inactive.
B.Analyze S3 server access logs to detect access key creation.
C.Enable AWS Config managed rule for IAM user MFA, which monitors if users have MFA enabled.
D.Use IAM Access Analyzer to monitor for unused access keys.
AnswerA

CloudTrail logs the event and CloudWatch Events can evaluate conditions in real time.

Why this answer

CloudWatch Events (now Amazon EventBridge) can capture the CreateAccessKey API call in real time, and a Lambda target can check the IAM user's MFA status via the GetLoginProfile or ListMFADevices API. This provides immediate detection and alerting without polling or log analysis, making it the most efficient approach for this specific requirement.

Exam trap

The trap here is that candidates confuse the AWS Config rule for 'IAM user MFA' (which only checks if MFA is enabled on the user account) with the ability to detect MFA usage during a specific API call, leading them to select Option C.

How to eliminate wrong answers

Option B is wrong because S3 server access logs are not designed to capture IAM API events like CreateAccessKey; they log object-level access to S3 buckets, not IAM user actions. Option C is wrong because the AWS Config managed rule for IAM user MFA only checks whether MFA is enabled on the user account at the time of evaluation, not whether MFA was used during a specific access key creation event. Option D is wrong because IAM Access Analyzer focuses on analyzing resource policies for unintended access, not on monitoring access key creation events or MFA usage.

Practice this question →
60
MCQeasy

A company wants to centrally collect and analyze logs from multiple AWS accounts. Which AWS service should be used to aggregate logs from various sources for monitoring and alerting?

A.Amazon S3
B.AWS Config
C.AWS CloudTrail
D.Amazon CloudWatch Logs
AnswerD

CloudWatch Logs can aggregate logs from multiple sources and accounts.

Why this answer

Amazon CloudWatch Logs is the correct service because it provides a centralized platform for collecting, monitoring, and analyzing log data from multiple AWS accounts and on-premises sources. It supports cross-account log aggregation via subscription filters and cross-account destinations, enabling real-time monitoring and alerting through CloudWatch Logs Insights and metric filters. This makes it the appropriate choice for the stated requirement of central log aggregation for monitoring and alerting.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which records API calls) with a log aggregation service, but CloudTrail is a log source, not a centralized aggregation and analysis platform like CloudWatch Logs.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service, not a log aggregation and analysis service; while logs can be stored in S3, it lacks native real-time monitoring, alerting, and query capabilities required for centralized analysis. Option B is wrong because AWS Config is a service for evaluating and auditing resource configurations against desired policies, not for collecting and analyzing logs from multiple sources. Option C is wrong because AWS CloudTrail is specifically designed to record API activity within an AWS account, but it does not aggregate logs from other services or accounts for centralized monitoring and alerting; it is a source of logs, not an aggregation platform.

Practice this question →
61
MCQeasy

A security engineer needs to monitor for unauthorized changes to security group rules in an AWS account. The engineer wants to receive real-time notifications when a security group rule is added, modified, or removed. Which AWS service should the engineer use to capture these API calls?

A.Amazon GuardDuty
B.AWS CloudTrail
C.VPC Flow Logs
D.AWS Config
AnswerB

CloudTrail records all API calls, including security group modifications.

Why this answer

AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including EC2 APIs such as AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, AuthorizeSecurityGroupEgress, RevokeSecurityGroupEgress, CreateSecurityGroup, and DeleteSecurityGroup. By enabling CloudTrail trail with management events and optionally data events for EC2, the security engineer can capture these API calls in near real-time and stream them to Amazon CloudWatch Logs or Amazon EventBridge to trigger notifications for unauthorized changes to security group rules.

Exam trap

The trap here is that candidates often confuse AWS Config's ability to detect configuration changes (like security group rule drift) with the real-time API call capture requirement, but AWS Config relies on CloudTrail for change notifications and has inherent latency, whereas CloudTrail directly captures the API call at the moment it occurs.

How to eliminate wrong answers

Option A is wrong because Amazon GuardDuty is a threat detection service that analyzes VPC Flow Logs, DNS logs, and CloudTrail management events for malicious activity, but it does not directly capture or provide real-time notifications for specific API calls like security group rule changes. Option C is wrong because VPC Flow Logs capture metadata about network traffic (IP addresses, ports, protocols) at the network interface level, not API calls that modify security group rules. Option D is wrong because AWS Config is a configuration auditing and compliance service that evaluates resource configurations against rules and can detect drift, but it operates on a periodic or event-driven basis (typically minutes delay) and does not capture API calls in real-time; it relies on CloudTrail for change notifications.

Practice this question →
62
MCQeasy

A security engineer needs to ensure that all API calls made in an AWS account are captured and retained for auditing purposes. The engineer must be able to query the logs for specific user activity over the past 90 days. Which AWS service should the engineer use to meet these requirements?

A.AWS CloudTrail
B.Amazon VPC Flow Logs
C.Amazon CloudWatch Logs
D.AWS Config
AnswerA

AWS CloudTrail is the native API auditing service: it records user activity and API calls across the account as CloudTrail events, capturing the identity, source IP, timestamp, request parameters, and response elements. These events can be delivered to Amazon S3 for long-term retention and queried with Athena, or sent to CloudWatch Logs for alerting. To fully meet an "all API calls" requirement, both management and data events must be enabled across all regions.

Why this answer

AWS CloudTrail is the correct service because it records all API calls made in an AWS account, including the identity, source IP, request parameters, and response elements. By default, CloudTrail stores event history for the last 90 days, which can be queried via the Event History console or API, meeting the requirement to query logs for specific user activity over the past 90 days without additional configuration.

Exam trap

The trap here is that candidates may confuse CloudTrail's default 90-day Event History with the need to create a trail and store logs in S3, but the question explicitly states 'captured and retained for auditing purposes' and 'query the logs for specific user activity over the past 90 days,' which is exactly what the built-in Event History provides without additional configuration.

How to eliminate wrong answers

Option B is wrong because Amazon VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol) at the network interface level, not API calls or user activity, so they cannot be used to audit API-level actions. Option C is wrong because Amazon CloudWatch Logs is a service for storing, monitoring, and accessing log files from various sources (e.g., applications, AWS services), but it does not natively capture all AWS API calls; CloudTrail logs must be explicitly sent to CloudWatch Logs for that purpose, and the requirement is for a service that directly captures and retains API calls, not a downstream log destination. Option D is wrong because AWS Config evaluates and records resource configuration changes and compliance, not API calls; it tracks the state of resources over time but does not capture the API requests that caused those changes.

Practice this question →
63
MCQhard

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The security team needs to monitor for unauthorized changes to security groups. They have enabled AWS Config with the security-group-change detection rule. However, they notice that changes are being detected but not all changes trigger a notification. The team wants to ensure that every security group modification (create, delete, or rule change) sends an alert to the security operations center via Amazon SNS. The current setup: AWS Config rules evaluate resources periodically, and SNS notifications are sent only when the rule compliance status changes. What should the team do to achieve real-time alerts for all security group changes?

A.Deploy Amazon GuardDuty and enable the Security Group Monitoring feature.
B.Configure an Amazon EventBridge rule that matches API calls via CloudTrail for security group modifications and sends notifications to an SNS topic.
C.Increase the frequency of AWS Config rule evaluations to every minute to reduce detection latency.
D.Enable VPC Flow Logs and set up a metric filter for security group-related traffic anomalies.
AnswerB

CloudTrail logs all API calls, including security group modifications, in real time. An EventBridge rule can match these events and trigger an SNS notification, ensuring immediate alerts for every change.

Why this answer

CloudTrail logs all API calls, including security group modifications, in real time. By creating an Amazon EventBridge rule that matches SecurityGroup events and targets an SNS topic, the team can receive immediate notifications. Option A is incorrect because GuardDuty focuses on threat detection (e.g., suspicious API activity), not on monitoring all security group configuration changes.

Option C is incorrect because even with frequent evaluations, AWS Config rules evaluate configuration snapshots periodically and do not provide real-time alerting for each change. Option D is incorrect because VPC Flow Logs monitor network traffic, not security group modifications.

Practice this question →
64
Multi-Selecteasy

A company needs to monitor for unauthorized changes to its Amazon S3 bucket policies. Which TWO services can be used together to achieve this? (Choose two.)

Select 2 answers
A.Amazon Route 53
B.AWS CloudTrail
C.VPC Flow Logs
D.AWS Config
E.Amazon SNS
AnswersD, E

Tracks configuration changes to S3 bucket policies.

Why this answer

AWS Config is correct because it provides continuous monitoring and evaluation of your AWS resource configurations, including S3 bucket policies. You can create AWS Config rules (e.g., s3-bucket-policy-grantee-check) to detect changes to bucket policies and trigger compliance evaluations. When a policy change is detected, AWS Config can invoke an SNS topic to send notifications, enabling real-time alerting for unauthorized modifications.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which logs API calls) with AWS Config (which monitors configuration state), leading them to select CloudTrail instead of Config, even though CloudTrail alone cannot trigger notifications for unauthorized changes without additional services like EventBridge or SNS.

Practice this question →
65
MCQmedium

A company has a requirement to retain CloudTrail logs for 7 years for compliance. The logs are stored in an S3 bucket. The security team needs to ensure that logs are not deleted before the retention period ends, even by users with full S3 permissions. Which action should be taken?

A.Enable MFA Delete on the bucket and require MFA for all delete operations.
B.Enable S3 Object Lock in Compliance mode on the bucket with a retention period of 7 years.
C.Enable S3 Versioning and set a lifecycle policy to expire noncurrent versions after 7 years.
D.Create a bucket policy that denies s3:DeleteObject for all users.
AnswerB

Compliance mode prevents any deletion, even by root.

Why this answer

S3 Object Lock in Compliance mode prevents any user, including the root user, from overwriting or deleting objects until the retention period expires. This meets the requirement to retain CloudTrail logs for 7 years, even against users with full S3 permissions, because Compliance mode cannot be bypassed or removed by any user.

Exam trap

The trap here is that candidates often choose MFA Delete (Option A) because it adds security, but they overlook that MFA Delete does not prevent deletion by authorized users who have MFA devices, whereas Object Lock in Compliance mode provides true immutability against all users.

How to eliminate wrong answers

Option A is wrong because MFA Delete only adds an extra authentication factor for delete operations but does not prevent deletion by users who have MFA credentials, so it cannot guarantee retention against all users. Option C is wrong because versioning with a lifecycle policy only expires noncurrent versions after 7 years, but current versions can still be deleted immediately by users with s3:DeleteObject permission, and lifecycle policies do not prevent direct deletion. Option D is wrong because a bucket policy that denies s3:DeleteObject for all users can be overridden by an explicit allow in an IAM policy or by the root user, and it does not protect against accidental or malicious deletion by users with full permissions who can modify the policy itself.

Practice this question →
66
MCQeasy

A company wants to centralize security logs from multiple AWS accounts into a single S3 bucket. The logging accounts (e.g., security, production) each have their own CloudTrail trails. Which configuration is required to allow cross-account log delivery?

A.Create an IAM role in the destination account with write permissions and allow CloudTrail in source accounts to assume that role.
B.Use a customer-managed KMS key in the destination account and share it with the source accounts.
C.Create an S3 bucket policy in the destination account that allows the CloudTrail service principal to write objects.
D.Configure S3 bucket ACLs to grant write access to the source account IDs.
AnswerC

A bucket policy in the destination account is the only mechanism CloudTrail uses to authorize cross-account log delivery, so the policy must allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform s3:PutObject and s3:GetBucketAcl on the bucket. For additional security, restrict the policy with aws:SourceAccount or aws:SourceArn to a specific source account, and when SSE-KMS is enabled, also include kms:GenerateDataKey and kms:Decrypt in the policy.

Why this answer

CloudTrail cross-account log delivery requires the destination S3 bucket to have a bucket policy that explicitly grants the CloudTrail service principal (`cloudtrail.amazonaws.com`) permission to write objects (e.g., `s3:PutObject`). This allows CloudTrail in any source account to deliver logs directly to the bucket without needing IAM roles or shared credentials, as the service principal authenticates on behalf of the source account.

Exam trap

The trap here is that candidates often assume cross-account access requires an IAM role (Option A) or shared encryption keys (Option B), but AWS services like CloudTrail use service principals and bucket policies for cross-account log delivery, not IAM roles or ACLs.

How to eliminate wrong answers

Option A is wrong because CloudTrail does not assume an IAM role in the destination account; it uses the source account's CloudTrail service principal to write logs, and the bucket policy must grant access to that principal, not an IAM role. Option B is wrong because while a customer-managed KMS key can be used for encryption, it is not required for cross-account log delivery; the core requirement is the bucket policy, and sharing a KMS key alone does not enable CloudTrail to write logs. Option D is wrong because S3 bucket ACLs are not supported for granting cross-account write access to the CloudTrail service principal; bucket ACLs are legacy and cannot grant permissions to AWS service principals, only to AWS accounts or canonical user IDs.

Practice this question →
67
MCQhard

A company uses Amazon S3 to store sensitive data. The security team needs to be alerted when an S3 bucket policy is changed to allow public access. Which combination of services should be used to meet this requirement?

A.AWS CloudTrail and Amazon Simple Notification Service (SNS)
B.S3 server access logs and Amazon Athena
C.AWS Trusted Advisor and Amazon Simple Notification Service (SNS)
D.AWS Config with AWS Lambda and Amazon Simple Notification Service (SNS)
AnswerD

AWS Config can continuously record configuration changes to an S3 bucket policy and evaluate those changes against a managed or custom rule. When a PutBucketPolicy event occurs, AWS Config marks the configuration item as changed and invokes a custom Lambda function, which can in turn publish a message to an SNS topic to notify security teams. This design provides real-time detection and alerting because the Lambda function is triggered by the configuration change, not by a periodic scan.

Why this answer

AWS Config can monitor S3 bucket policies for changes that grant public access using a managed rule like 's3-bucket-public-read-prohibited' or a custom Lambda function. When a noncompliant change is detected, AWS Config can invoke an AWS Lambda function to evaluate the policy and publish a notification to Amazon SNS, alerting the security team. This combination provides real-time, policy-driven monitoring and alerting for public access changes.

Exam trap

The trap here is that candidates often choose AWS CloudTrail (Option A) because it logs API calls like PutBucketPolicy, but they overlook that CloudTrail alone cannot evaluate the policy content for public access or trigger alerts without additional services like EventBridge and Lambda, whereas AWS Config is purpose-built for continuous compliance monitoring and alerting.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail logs API calls but does not evaluate bucket policies for public access or trigger alerts directly; it would require additional services like Amazon EventBridge and Lambda to filter and act on specific events, making it less direct than AWS Config. Option B is wrong because S3 server access logs record object-level requests (e.g., GET, PUT) and are not designed to monitor or alert on bucket policy changes; Athena is used for querying logs, not for real-time alerting. Option C is wrong because AWS Trusted Advisor checks for publicly accessible S3 buckets but only provides periodic checks (not real-time) and does not trigger alerts via SNS automatically for policy changes; it requires manual review or custom automation.

Practice this question →
68
MCQhard

A company has a CloudTrail trail that logs management events for all regions in the management account. They want to also log data events for all S3 buckets in the organization. Which configuration change will meet this requirement with the LEAST operational overhead?

A.Use Amazon EventBridge to capture S3 events and forward them to CloudTrail.
B.Enable S3 server access logs for all buckets and aggregate them using Athena.
C.Create a new trail in each member account to log S3 data events and deliver to a central S3 bucket.
D.Modify the existing trail to add an event selector for S3 data events with a scope of all buckets.
AnswerD

Organization trails can log data events for all S3 buckets across the organization with a single configuration.

Why this answer

CloudTrail trails can be configured with an event selector that includes data events for S3, and setting the scope to 'all buckets' logs data events for every S3 bucket in the account without needing separate configurations. This approach reuses the existing management trail, minimizing operational overhead by avoiding additional trails, services, or aggregation steps.

Exam trap

The trap here is that candidates may think data events require separate trails or external services like EventBridge, but CloudTrail's built-in event selector for S3 data events with an 'all buckets' scope directly meets the requirement with minimal overhead.

How to eliminate wrong answers

Option A is wrong because Amazon EventBridge captures S3 events (e.g., object-level notifications) but does not natively forward them to CloudTrail; CloudTrail ingests S3 data events directly via its own event selectors, not through EventBridge, and using EventBridge would add unnecessary complexity and cost. Option B is wrong because S3 server access logs provide detailed access records but are not CloudTrail data events; they require separate setup per bucket, aggregation via Athena, and do not integrate with CloudTrail's centralized logging, increasing operational overhead. Option C is wrong because creating a new trail in each member account duplicates effort and requires managing multiple trails, whereas CloudTrail can log S3 data events across all accounts in an organization from the management account using a single trail with the appropriate event selector.

Practice this question →
69
MCQmedium

A company uses Amazon GuardDuty in a single AWS account to detect threats. The security team receives an alert that a specific EC2 instance is communicating with a known command and control (C2) server. The security engineer needs to immediately isolate the instance while preserving the root cause evidence. The engineer has access to the AWS Management Console. Which action should the engineer take FIRST?

A.Terminate the instance immediately to stop the communication.
B.Take a snapshot of the EBS volume and then isolate the instance by modifying the security group.
C.Modify the security group to block all outbound traffic.
D.Install the CloudWatch Logs agent on the instance to capture logs.
AnswerB

Snapshot preserves evidence, then isolation stops communication.

Why this answer

The correct first action is to take a snapshot of the EBS volume to preserve root cause evidence, then modify the security group to block all outbound traffic, isolating the instance. Option A is incorrect because terminating the instance destroys volatile evidence and may not capture the current state. Option C is incorrect because modifying the security group without first taking a snapshot could lose critical evidence before isolation.

Option D is incorrect because installing the CloudWatch agent takes time and does not immediately stop communication or isolate the instance.

Practice this question →
70
Multi-Selectmedium

A security engineer is implementing centralized logging across multiple AWS accounts. Which TWO actions should the engineer take to ensure logs are securely stored and immutable? (Choose TWO.)

Select 2 answers
A.Enable S3 Transfer Acceleration on the bucket
B.Use AWS KMS with a customer managed key for encryption
C.Enable S3 Object Lock on the destination bucket
D.Enable CloudTrail log file validation
E.Enable MFA Delete on the bucket
AnswersB, C

KMS provides encryption and access control.

Why this answer

Using AWS KMS with a customer managed key (CMK) for encryption ensures that the security engineer has full control over the encryption keys, including key rotation, access policies, and the ability to disable or revoke the key. This prevents unauthorized decryption of logs, even by AWS, and is a critical component of securing log data at rest. Option C is correct because enabling S3 Object Lock on the destination bucket enforces a write-once-read-many (WORM) model, preventing logs from being deleted or overwritten for a specified retention period, which ensures immutability and compliance with regulatory requirements.

Exam trap

The trap here is that candidates often confuse CloudTrail log file validation (which only detects tampering) with immutability (which prevents tampering), or they mistakenly think MFA Delete provides the same WORM protection as S3 Object Lock.

Practice this question →
71
Multi-Selecteasy

A security engineer needs to ensure that all changes to IAM policies in an AWS account are logged and that the logs are immutable and cannot be deleted by any user, including the root user. Which actions should the engineer take? (Choose two.)

Select 2 answers
A.Enable default encryption with AWS KMS on the bucket.
B.Enable AWS CloudTrail to log IAM events.
C.Enable S3 Versioning on the bucket.
D.Enable multi-factor authentication (MFA) delete on the S3 bucket.
E.Enable S3 Object Lock in compliance mode on the bucket.
AnswersB, E

CloudTrail records all IAM API calls.

Why this answer

AWS CloudTrail is the service specifically designed to log all API activity, including IAM policy changes. By enabling CloudTrail with management event logging, all IAM CreatePolicy, PutPolicy, DeletePolicy, and similar actions are recorded in a log file delivered to an S3 bucket. This provides an authoritative audit trail of who made the change, when, and from which source IP.

Option E is correct because S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting objects for the specified retention period. This ensures the log files are immutable and cannot be tampered with or deleted, fulfilling the requirement that logs cannot be deleted by any user.

Exam trap

The trap here is that candidates often confuse S3 Versioning (which provides object recovery but not immutability) with S3 Object Lock (which provides true WORM immutability), and they may also overlook that MFA Delete still allows deletion by an authorized user with MFA, not preventing root from ultimately deleting logs.

Practice this question →
72
MCQmedium

Refer to the exhibit. An AWS Config rule 's3-bucket-ssl-requests-only' evaluates whether S3 buckets deny HTTP requests. The exhibit shows the evaluation result and the bucket policy. Why is the bucket marked as NON_COMPLIANT despite having a Deny policy for HTTP requests?

A.The bucket policy is missing the 'aws:SecureTransport': 'false' condition for the bucket resource (without /*).
B.The policy uses 'Deny' but the rule expects an 'Allow' statement for HTTPS only.
C.The bucket policy only denies HTTP requests to objects, not to the bucket itself.
D.The annotation says 'Bucket does not have a policy that denies HTTP requests.' but the policy does have one, so this is a false positive.
AnswerA

The rule may check that the bucket itself (not just objects) denies HTTP requests. The policy only covers objects. Adding a statement for the bucket ARN 'arn:aws:s3:::my-bucket' would fix the compliance.

Why this answer

The Config rule likely evaluates the bucket-level policy. The current policy only denies HTTP requests to objects (/*), not to the bucket itself. To be compliant, the bucket must also have a Deny for the bucket resource ARN without the /*.

Practice this question →
73
MCQhard

A security team wants to centrally collect and analyze VPC Flow Logs from multiple AWS accounts for security monitoring. Which solution is MOST scalable and cost-effective?

A.Aggregate logs in an EC2 instance running an ELK stack.
B.Use Amazon Kinesis Data Firehose to stream logs to an S3 bucket and process with AWS Lambda.
C.Configure VPC Flow Logs to send to a centralized CloudWatch Logs account using cross-account subscriptions.
D.Use AWS Organizations to centralize logging by delivering VPC Flow Logs to a centralized S3 bucket and query with Amazon Athena.
AnswerD

This approach is scalable, cost-effective, and uses managed services.

Why this answer

Using AWS Organizations to centrally deliver VPC Flow Logs to a centralized S3 bucket, then querying with Amazon Athena, is both scalable and cost-effective. S3 provides durable, low-cost storage for large volumes of log data, and Athena allows serverless, pay-per-query analysis without provisioning infrastructure. This approach avoids the operational overhead of managing EC2 instances or streaming pipelines, and scales seamlessly as log volume grows.

Exam trap

The trap here is that candidates often overcomplicate the solution by choosing a streaming or real-time processing service (like Kinesis or CloudWatch Logs) when the requirement is for cost-effective batch analysis, not real-time alerting.

How to eliminate wrong answers

Option A is wrong because running an ELK stack on an EC2 instance introduces significant operational overhead, requires manual scaling, and incurs costs for compute and storage even when idle, making it less scalable and cost-effective than serverless alternatives. Option B is wrong because Amazon Kinesis Data Firehose to S3 with Lambda processing adds unnecessary complexity and cost for a use case that can be served by direct S3 delivery and Athena queries, and Firehose is optimized for streaming ingestion, not batch log analysis. Option C is wrong because cross-account CloudWatch Logs subscriptions require managing subscription filters and IAM roles across accounts, and CloudWatch Logs costs are higher per GB ingested and stored compared to S3, making it less cost-effective for high-volume VPC Flow Logs.

Practice this question →
74
MCQeasy

A security engineer needs to capture all API calls made to AWS services for forensic analysis. Which AWS service should be used to store these logs durably and cost-effectively for long-term retention?

A.VPC Flow Logs
B.Amazon GuardDuty
C.AWS Config
D.AWS CloudTrail
AnswerD

AWS CloudTrail logs all API calls and can deliver logs to S3.

Why this answer

AWS CloudTrail is the correct service because it captures all API calls made to AWS services, including the identity of the caller, time of the call, source IP address, and request parameters. It stores these logs durably in Amazon S3, which provides cost-effective long-term retention for forensic analysis. CloudTrail is specifically designed for auditing and monitoring API activity across an AWS environment.

Exam trap

The trap here is that candidates often confuse AWS Config (which tracks resource configuration changes) with CloudTrail (which tracks API calls), leading them to select Config when the question explicitly asks for capturing API calls.

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs capture network traffic metadata (IP addresses, ports, protocols) at the VPC level, not API calls to AWS services. Option B is wrong because Amazon GuardDuty is a threat detection service that analyzes logs (including CloudTrail, VPC Flow Logs, and DNS logs) for malicious activity, but it does not natively store or capture raw API call logs for long-term retention. Option C is wrong because AWS Config records resource configuration changes and evaluates compliance rules, but it does not capture API calls; it focuses on resource state history, not the API actions that caused changes.

Practice this question →
75
MCQhard

A company has enabled AWS CloudTrail in all accounts and regions, with log file validation enabled. The security team needs to verify that a specific log file has not been modified since it was delivered. Which action should be taken?

A.Query the log files using Amazon CloudWatch Logs Insights.
B.Enable S3 server-side encryption with AWS KMS (SSE-KMS) on the CloudTrail bucket.
C.Enable S3 Object Lock on the bucket to prevent modifications.
D.Use the AWS CLI `validate-logs` command with the digest file from the S3 bucket.
AnswerD

The `aws cloudtrail validate-logs` command implements CloudTrail's integrity validation by reading the digest files delivered to the S3 bucket. Each digest file contains the SHA-256 hash of the log files and a digital signature generated with AWS's private key; the CLI retrieves the corresponding public key from AWS, verifies the signature, and then recomputes the hash of each log file to compare against the digest. This process cryptographically confirms that log files were not altered or removed during delivery, providing a tamper-evident chain from the moment CloudTrail wrote the file.

Why this answer

CloudTrail log file validation creates a hash of each log file and stores it in a digest file. To verify that a specific log file has not been altered since delivery, you must use the AWS CLI `validate-logs` command, which compares the hash in the digest file against the current hash of the log file. This command also validates the digital signature of the digest file itself, ensuring end-to-end integrity.

Exam trap

The trap here is that candidates confuse data integrity verification (hash comparison) with data protection mechanisms like encryption or object lock, which prevent or obscure modification but do not prove that a file has remained unchanged since its creation.

How to eliminate wrong answers

Option A is wrong because CloudWatch Logs Insights is used for querying and analyzing log data, not for cryptographic integrity verification of individual log files. Option B is wrong because SSE-KMS encrypts data at rest but does not provide any mechanism to detect or prevent modification of log files after delivery. Option C is wrong because S3 Object Lock prevents deletion or overwrite of objects during a retention period, but it does not verify the integrity of already-delivered log files or detect modifications made before the lock was applied.

Practice this question →
Page 1 of 2 · 92 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Security Logging and Monitoring questions.

Start 20-question session