CCNA Security Logging and Monitoring Questions

Option A is correct: CloudTrail can log S3 API calls. Option C is correct: GuardDuty can detect suspicious S3 activity. Option D is correct: Macie can identify sensitive data and anomalous access patterns.

Option B is wrong because CloudWatch Logs is a log destination, not a detection service. Option E is wrong because AWS Config is for configuration compliance, not threat detection.

Option C is correct because AWS Config has managed rules like 's3-bucket-policy-not-more-permissive' that can evaluate bucket policies. Option A is incorrect because CloudTrail logs API calls but does not evaluate policies. Option B is incorrect because GuardDuty detects threats but not policy compliance.

Option D is incorrect because CloudWatch Logs Insights can query logs but is not proactive detection.

Option A and Option D are correct. VPC Flow Logs capture IP traffic information, and Amazon Athena can query VPC Flow Logs stored in S3. Option B is wrong because CloudTrail records API calls, not network traffic.

Option C is wrong because GuardDuty is for real-time threat detection. Option E is wrong because CloudWatch Logs can store flow logs but is not primarily for analysis.

S3 Events can trigger a Lambda function to send a notification via SNS when an object delete action occurs. Option C is correct because it integrates S3 events with Lambda and SNS for real-time alerting. Option A is wrong because CloudWatch Logs does not directly monitor S3 object deletions.

Option B is wrong because CloudTrail Insights detects unusual API activity, not specific delete events in S3. Option D is wrong because Config rules evaluate resource configurations, not real-time events.

Option B is correct because the trail needs to log data events for IAM to capture calls like GetUser, ListAccessKeys, etc. Option A is wrong because it logs management events (control plane), not data events. Option C is wrong because it only captures S3 data events.

Option D is wrong because CloudTrail does not support VPC Flow Logs integration.

Option A is correct because CloudWatch Logs can collect log files from EC2 instances via the CloudWatch agent and can be used to search for failed SSH attempts. Option B is wrong because AWS Config tracks resource configuration changes, not OS-level logs. Option C is wrong because CloudTrail logs API calls, not OS login events.

Option D is wrong because VPC Flow Logs capture network traffic, not OS authentication events.

Option B is correct because AWS CloudTrail records API calls and can deliver events to CloudWatch Logs for near real-time analysis. Option A is wrong because AWS Config monitors resource configurations, not API calls. Option C is wrong because Amazon GuardDuty is a threat detection service that uses various data sources, but it does not directly capture API calls for custom analysis.

Option D is wrong because AWS CloudHSM is a hardware security module, not a logging service.

Option A is correct because CloudWatch Logs agent can capture /var/log/secure (or auth.log) and send to CloudWatch Logs, which can then trigger a metric filter and alarm. Option B is wrong because CloudTrail does not capture OS-level logs. Option C is wrong because VPC Flow Logs capture network traffic, not SSH login attempts.

Option D is wrong because S3 event notifications are for object-level events.

Options A and B are correct. Amazon S3 can be used as a central log destination, and Amazon Athena can query logs directly in S3. Option C is wrong because Amazon Inspector is for vulnerability assessment, not log analysis.

Option D is wrong because AWS Config is for resource configuration tracking. Option E is wrong because AWS Shield is for DDoS protection.

VPC Flow Logs can filter by acceptance status. The 'accept' field in the flow log record indicates whether traffic was accepted or rejected. Setting a filter to capture only 'ACCEPT' records meets the requirement.

Option A is wrong because security groups accept all traffic allowed by rules. Option C is wrong because network ACLs also accept traffic. Option D is wrong because changing the format does not filter.

Option D is correct because log file validation creates a hash of each log file and stores it in a digest file, allowing verification that no logs were modified or deleted. Option A is wrong because validation does not encrypt logs. Option B is wrong because it does not prevent deletion; it detects tampering.

Option C is wrong because it does not provide real-time monitoring.

Option A is correct because CloudWatch Events (EventBridge) can match the TerminateInstances event in real-time and trigger an SNS notification. Option B is wrong because a metric filter and alarm have some latency. Option C is wrong because Config evaluates changes periodically.

Option D is wrong because GuardDuty does not monitor EC2 termination.

Option B is correct. The bucket policy must also grant the GetBucketAcl permission for CloudTrail to verify bucket ownership. Without s3:GetBucketAcl, CloudTrail cannot validate the bucket and will not deliver logs.

Option A is wrong because the Principal is correct. Option C is wrong because the action is PutObject, not GetObject. Option D is wrong because the resource pattern includes the prefix.

Option A is correct because Amazon RDS Enhanced Monitoring provides OS-level metrics, not database activity. Option B is correct because AWS CloudTrail logs API calls to RDS, not SQL queries. Option D is correct because AWS Config tracks configuration changes.

Option C is the correct answer because database activity streams capture detailed SQL-level activity.

The CreateAccessKey API call is the correct event for creating an access key. Option B is wrong because UpdateAccessKey modifies an existing key. Option C is wrong because UploadSigningCertificate is for uploads, not access keys.

Option D is wrong because EnableMFADevice is for MFA devices.

Option B is correct because GuardDuty can analyze VPC Flow Logs for network activity. Option C is correct because GuardDuty can analyze DNS logs for suspicious domain queries. Option A is incorrect because CloudTrail management events are already analyzed by GuardDuty, but enabling data events is not necessary.

Option D is incorrect because GuardDuty does not analyze Config history. Option E is incorrect because GuardDuty does not analyze S3 access logs directly.

Option B is correct because CloudWatch Events (now Amazon EventBridge) can match patterns in CloudTrail events and trigger notifications. Option A is incorrect because AWS Config evaluates resource configurations, not API calls. Option C is incorrect because AWS Trusted Advisor provides recommendations, not real-time alerts.

Option D is incorrect because Amazon GuardDuty focuses on threat detection, not specific API call patterns.

Option C is correct because CloudTrail itself logs the StopLogging or DeleteTrail API calls. Those logs can be streamed to CloudWatch Logs, where a metric filter can detect the event and trigger an alarm that sends an SNS notification. Option A is wrong because Config rules evaluate resource configurations, not API calls.

Option B is wrong because GuardDuty does not monitor CloudTrail API calls. Option D is wrong because S3 events are for object-level operations, not CloudTrail API calls.

Option B is correct because AWS CloudTrail records all API calls with details like source IP address and user agent. Option A is incorrect because Amazon Inspector is for vulnerability assessment. Option C is incorrect because AWS CloudHSM is for hardware security modules.

Option D is incorrect because AWS Artifact is for compliance reports.

Options A and D are correct. CloudTrail logs API calls and can deliver them to CloudWatch Logs for querying. Option B is wrong because VPC Flow Logs capture network traffic, not API calls.

Option C is wrong because CloudWatch Logs Insights can query logs but needs CloudTrail as the source. Option E is wrong because S3 Server Access Logs are for S3 access only, not all API calls.

Option B is correct because a CloudWatch Events (EventBridge) rule can match the StopLogging or UpdateTrail API calls from CloudTrail and trigger an SNS notification. Option A is wrong because AWS Config can evaluate whether CloudTrail is enabled, but may not detect a disablement in real-time; it is more for compliance. Option C is wrong because VPC Flow Logs do not capture API calls.

Option D is wrong because Amazon GuardDuty does not monitor CloudTrail configuration changes.

Option B is correct because CloudTrail log file integrity validation uses SHA-256 hashing and digital signatures to verify that log files have not been altered. Option A is incorrect because server-side encryption (SSE-S3) only encrypts data at rest, not integrity. Option C is incorrect because S3 Versioning helps preserve object versions but does not validate integrity.

Option D is incorrect because S3 Object Lock prevents deletion but not modification detection.

Option A is correct because exporting logs to S3 and using S3 Lifecycle policies to transition to Glacier Deep Archive provides long-term retention at low cost. Option B is wrong because CloudWatch Logs does not support lifecycle policies to Glacier, only to S3. Option C is wrong because CloudWatch Logs Insights is not designed for long-term archival storage.

Option D is wrong because S3 Standard-IA is not cost-effective for 7 years of infrequently accessed data; Glacier Deep Archive is cheaper.

Option A, Option C, and Option D are correct. CloudTrail must be enabled in each account, logs must be delivered to a central S3 bucket, and the security team must have read access to that bucket. Option B is wrong because CloudTrail can be enabled per account without Organizations.

Option E is wrong because IAM roles are not needed for read access if bucket policy is used.

Options A, B, and D are correct. Amazon GuardDuty identifies threats, AWS Security Hub aggregates findings, and Amazon Detective investigates them. Option C is wrong because AWS CloudTrail is a logging service, not a detection or response service.

Option E is wrong because Amazon Inspector is for vulnerability assessment, not general threat detection.

Using CloudTrail to deliver logs to a central S3 bucket, with S3 Event Notifications triggering a Lambda function that ingests logs into CloudWatch Logs for real-time analysis, is a common pattern. Option A is wrong because Kinesis Data Firehose can be used but adds latency. Option B is wrong because CloudWatch Logs does not directly aggregate across accounts.

Option D is wrong because SQS alone does not provide analysis.

Option B is correct because CloudWatch Logs uses the KMS key specified in the log group's encryption setting. Option A is wrong because CloudWatch Logs does not support KMS key via bucket policy. Option C is wrong because S3 encryption policies are for S3 buckets, not CloudWatch Logs.

Option D is wrong because KMS key policies grant permissions, but the log group must be associated with the key.

Option B is correct because the current data resource only specifies the prefix 'logs/', not the entire bucket. To log all object-level events for the bucket, the value should be 'arn:aws:s3:::my-bucket/'. Option A is wrong because the bucket itself is not the issue; the prefix is.

Option C is wrong because the trail already includes management events. Option D is wrong because the trail already has a data resource for S3.

Option C is correct because GuardDuty uses threat intelligence feeds to identify known malicious IPs. Option A is wrong because VPC Flow Logs only show traffic metadata, not reputation. Option B is wrong because CloudTrail does not analyze network traffic.

Option D is wrong because Trusted Advisor provides best practice checks, not IP reputation.

Option C is correct because AWS Config rules can be set to auto-remediate using Systems Manager Automation or Lambda functions to apply a restrictive bucket policy. Option A is incorrect because CloudTrail cannot remediate. Option B is incorrect because GuardDuty detects threats but does not remediate S3 bucket policies.

Option D is incorrect because Trusted Advisor provides best practice checks but does not automatically remediate.

Option A is correct because S3 Object Lock with retention mode Compliance prevents any user, including root, from deleting or overwriting objects. Option B is wrong because MFA Delete prevents deletion but can be disabled by root. Option C is wrong because bucket policies can be changed by root.

Option D is wrong because versioning alone does not prevent deletion of versions.

Option D is correct because the policy allows logs:CreateLogStream and logs:PutLogEvents, but the principal is set to the logs service, not the EC2 instance role. The role should have these permissions. Option A is wrong because the log group exists.

Option B is wrong because the resource ARN is correct. Option C is wrong because CloudWatch agent does not need logs:DescribeLogGroups.

Option D is correct. The 11th field (ACCEPT) is the action field, which indicates whether the traffic was accepted or rejected. Option A is wrong because the version field (1st field) is 2.

Option B is wrong because the protocol field (7th field) is 6 (TCP). Option C is wrong because the destination port (5th field) is 443.

Options B, C, and D are correct. Amazon S3 provides durable storage, Amazon Athena allows querying logs, and AWS Organizations enables centralized management. Option A (Kinesis Data Streams) is for real-time streaming, not necessary.

Option E (CloudWatch Logs) is for real-time monitoring but not ideal for long-term analysis.

Option B is correct because AwsServiceEvent indicates the event was initiated by an AWS service on behalf of the customer. Option A is wrong because that would be AwsApiCall. Option C is wrong because that would be AwsConsoleSignin.

Option D is wrong because AwsServiceEvent is a valid event type.

Option B is correct because CloudTrail logs the CreateAccessKey API call, and a CloudWatch Events rule can trigger on this event and evaluate whether MFA was used (via the userIdentity details). Option A is wrong because IAM Access Analyzer is for analyzing resource policies, not monitoring API calls. Option C is wrong because Config rules can evaluate resource configurations, but detecting MFA usage during an API call is better done via CloudTrail.

Option D is wrong because S3 server access logs do not capture API events.

S3 server access logs cannot be delivered to a bucket in a different region; the destination bucket must be in the same region as the source bucket. Option A is wrong because cross-account delivery is possible with proper permissions. Option B is wrong because no additional IAM role is needed for server access logs.

Option D is wrong because enabling versioning is not required for log delivery.

CloudWatch Logs can aggregate logs from multiple accounts using cross-account log groups or with the help of Kinesis. Option B is correct because CloudWatch Logs is the primary log aggregation service. Option A is wrong because CloudTrail is for API logging, not general log aggregation.

Option C is wrong because S3 is storage, not a monitoring service. Option D is wrong because Config is for configuration tracking.

Option B is correct because CloudTrail records API calls, including EC2 AuthorizeSecurityGroupIngress, etc. Option A is wrong because VPC Flow Logs capture network traffic, not API calls. Option C is wrong because Config records resource state changes but not real-time API calls.

Option D is wrong because GuardDuty detects threats, not API logging.

Option A is correct because EC2 instance logs (OS logs) capture commands executed on the instance. Option B is wrong because VPC Flow Logs only show network traffic, not commands. Option C is wrong because CloudTrail logs API calls, not OS commands.

Option D is wrong because S3 access logs track S3 access, not EC2 activity.

Option A is correct because VPC Flow Logs capture network traffic metadata, including outbound connections. Option B is wrong because CloudTrail does not capture network traffic. Option C is wrong because GuardDuty provides findings but not traffic logs.

Option D is wrong because Config does not log network traffic.

Option B is correct because Amazon Athena can query CloudTrail logs in S3 using SQL, and Amazon QuickSight can visualize the results. Option A is wrong because Amazon Elasticsearch Service is not free and adds cost. Option C is wrong because CloudWatch Logs Insights can query logs but requires logs to be in CloudWatch Logs, not S3.

Option D is wrong because AWS Config is for resource configuration, not API call analysis.

Option B is correct because VPC Flow Logs require a resource-based policy on the destination bucket to allow the member accounts to write logs. Option A is wrong because flow logs can be aggregated across accounts. Option C is wrong because CloudTrail is not used for VPC Flow Logs.

Option D is wrong because VPC Flow Logs do not require IAM roles on member accounts.

The CloudWatch Logs agent can send /var/log/secure to CloudWatch Logs, where a metric filter can count failed attempts and trigger an alarm. Option A is correct. Option B is wrong because modifying /etc/hosts.deny is not monitoring.

Option C is wrong because VPC Flow Logs do not capture application-level login attempts. Option D is wrong because GuardDuty detects threats but is not as targeted for this specific metric.

Option A is correct because the policy requires the condition s3:x-amz-acl to be set to bucket-owner-full-control, but the application may not be setting that ACL. Option B is wrong because the resource ARN is correct for the specified path. Option C is wrong because the Effect is Allow.

Option D is wrong because the policy does not mention encryption.

AWS Config can track changes to S3 bucket policies and trigger a notification via Amazon SNS. Options A and D are correct. Option B is wrong because CloudTrail logs API calls but does not evaluate configuration changes against a baseline.

Option C is wrong because VPC Flow Logs are for network traffic. Option E is wrong because Route 53 is for DNS.

S3 Object Lock with a retention mode of Compliance prevents any user, including the root user, from deleting objects until the retention period expires. Option A is correct. Option B is wrong because MFA Delete can be bypassed by root.

Option C is wrong because bucket policies do not prevent deletion by bucket owners with full permissions. Option D is wrong because versioning alone does not prevent deletion.

Option A is correct because CloudTrail can deliver logs to an S3 bucket in another account by using a bucket policy that grants CloudTrail's service principal write access. Option B is wrong because KMS keys are for encryption, not cross-account access. Option C is wrong because S3 ACLs are not recommended for cross-account; bucket policy is used.

Option D is wrong because IAM roles are used for other services but CloudTrail uses bucket policies.

Option B is correct because AWS Config records S3 bucket policy changes and can trigger a Lambda function via Amazon EventBridge to send alerts. Option A is wrong because CloudTrail alone does not trigger alerts; it logs events but requires further processing. Option C is wrong because AWS Trusted Advisor provides security checks but does not monitor for real-time changes.

Option D is wrong because S3 server access logs do not include bucket policy changes.

Option D is correct because S3 Block Public Access prevents public access at the account level, and AWS Config rules can detect public ACLs and policies. Option A is wrong because CloudTrail alone cannot detect public access, only API calls. Option B is wrong because GuardDuty does not detect public S3 objects by default.

Option C is wrong because Macie is for sensitive data discovery, not public access detection.

Option A is correct because Amazon RDS supports Enhanced Monitoring for OS metrics and publishes audit logs to CloudWatch Logs when the audit log option is enabled. Option B is wrong because CloudTrail logs API calls to the RDS service, not SQL queries. Option C is wrong because VPC Flow Logs capture network traffic.

Option D is wrong because AWS Config records resource configuration changes.

VPC Flow Logs capture network traffic metadata, and CloudTrail captures API calls. Analyzing both together provides a complete picture. Option B is correct because it combines both services.

Option A is wrong because CloudTrail alone does not capture network traffic. Option C is wrong because VPC Flow Logs do not capture API calls. Option D is wrong because Config does not log API calls or network traffic.

The log shows source port 443 (HTTPS) and destination port 3389 (RDP) from a public IP to a private IP. The use of port 443 as source for RDP is unusual and could indicate an attempt to disguise RDP traffic as HTTPS. Option A is wrong because port 443 is source, not destination.

Option B is wrong because the traffic is from public to private, not outbound. Option D is wrong because the log shows ACCEPT, meaning traffic was allowed.

Option B is correct because Glacier Deep Archive is the lowest cost for long-term archival with retrieval times up to 12 hours, which meets the 24-hour requirement. Option A is wrong because Standard-IA is more expensive than Deep Archive. Option C is wrong because Glacier Flexible Retrieval has retrieval times of minutes to hours, but Deep Archive is cheaper.

Option D is wrong because One Zone-IA is not durable enough for compliance data.