The answer is to install the CloudWatch Logs agent on the EC2 instance to stream /var/log/secure to CloudWatch Logs, then create a metric filter for 'Failed password' and set a CloudWatch alarm. This solution is correct because the agent enables real-time ingestion of system logs, and the metric filter counts each failed SSH attempt as a data point, allowing the alarm to trigger when the threshold of more than 10 attempts within 5 minutes is breached. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding of CloudWatch Logs as a targeted monitoring tool versus broader security services—a common trap is choosing GuardDuty or VPC Flow Logs, but GuardDuty detects threat patterns rather than counting specific login failures, and Flow Logs only capture network metadata, not application-level events like SSH passwords. Remember the key distinction: for counting specific log events with a threshold, always pair the CloudWatch Logs agent with a metric filter and alarm. Memory tip: “Agent streams, filter counts, alarm alerts—three steps for failed attempts.”
SCS-C02 Security Logging and Monitoring Practice Question
This SCS-C02 practice question tests your understanding of security logging and monitoring. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security team needs to monitor for failed login attempts to an EC2 instance running Linux. The team wants to send a real-time alert when more than 10 failed SSH attempts occur within 5 minutes. Which solution is the most efficient?
Install the CloudWatch Logs agent on the EC2 instance to stream /var/log/secure to CloudWatch Logs. Create a metric filter for 'Failed password' and set a CloudWatch alarm.
This approach provides real-time monitoring and alerting.
B
Enable VPC Flow Logs and filter for SSH traffic to detect failed attempts.
Why wrong: Flow Logs show network connections, not application-level login success/failure.
C
Configure the EC2 instance to write failed attempts to a file in S3 and use S3 events to trigger a Lambda function for alerting.
Why wrong: S3 events are not real-time and add latency.
D
Enable Amazon GuardDuty and create a custom threat list for failed SSH attempts.
Why wrong: GuardDuty does not monitor instance logs directly.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Install the CloudWatch Logs agent on the EC2 instance to stream /var/log/secure to CloudWatch Logs. Create a metric filter for 'Failed password' and set a CloudWatch alarm.
The CloudWatch Logs agent can send /var/log/secure to CloudWatch Logs, where a metric filter can count failed attempts and trigger an alarm. Option A is correct. Option B is wrong because modifying /etc/hosts.deny is not monitoring. Option C is wrong because VPC Flow Logs do not capture application-level login attempts. Option D is wrong because GuardDuty detects threats but is not as targeted for this specific metric.
Key principle: ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Install the CloudWatch Logs agent on the EC2 instance to stream /var/log/secure to CloudWatch Logs. Create a metric filter for 'Failed password' and set a CloudWatch alarm.
Why this is correct
This approach provides real-time monitoring and alerting.
Related concept
Standard ACLs match source addresses.
✗
Enable VPC Flow Logs and filter for SSH traffic to detect failed attempts.
Why it's wrong here
Flow Logs show network connections, not application-level login success/failure.
✗
Configure the EC2 instance to write failed attempts to a file in S3 and use S3 events to trigger a Lambda function for alerting.
Why it's wrong here
S3 events are not real-time and add latency.
✗
Enable Amazon GuardDuty and create a custom threat list for failed SSH attempts.
Why it's wrong here
GuardDuty does not monitor instance logs directly.
Common exam traps
Common exam trap: ACLs stop at the first match
ACLs are processed top to bottom. The first matching entry wins, and an implicit deny usually exists at the end.
Trap categories for this question
Command / output trap
Flow Logs show network connections, not application-level login success/failure.
Detailed technical explanation
How to think about this question
ACL questions test precision: source, destination, protocol, port and direction. A generally correct ACL can still fail if it is applied on the wrong interface or in the wrong direction.
KKey Concepts to Remember
Standard ACLs match source addresses.
Extended ACLs can match source, destination, protocol and ports.
The first matching ACL entry is used.
There is usually an implicit deny at the end.
TExam Day Tips
→Check inbound versus outbound direction.
→Read the ACL from top to bottom.
→Look for a broader permit or deny above the intended line.
Key takeaway
ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Review ACL processing order, placement rules (standard near destination, extended near source), and inbound vs outbound direction. Study wildcard masks and implicit deny. Then practise related SCS-C02 ACL questions on filtering logic and placement.
Security Logging and Monitoring — This question tests Security Logging and Monitoring — Standard ACLs match source addresses..
What is the correct answer to this question?
The correct answer is: Install the CloudWatch Logs agent on the EC2 instance to stream /var/log/secure to CloudWatch Logs. Create a metric filter for 'Failed password' and set a CloudWatch alarm. — The CloudWatch Logs agent can send /var/log/secure to CloudWatch Logs, where a metric filter can count failed attempts and trigger an alarm. Option A is correct. Option B is wrong because modifying /etc/hosts.deny is not monitoring. Option C is wrong because VPC Flow Logs do not capture application-level login attempts. Option D is wrong because GuardDuty detects threats but is not as targeted for this specific metric.
What should I do if I get this SCS-C02 question wrong?
Review ACL processing order, placement rules (standard near destination, extended near source), and inbound vs outbound direction. Study wildcard masks and implicit deny. Then practise related SCS-C02 ACL questions on filtering logic and placement.
What is the key concept behind this question?
Standard ACLs match source addresses.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to monitor failed SSH login attempts to EC2 instances. Which approach should be used?
easy
✓ A.Use the CloudWatch Logs agent to send /var/log/auth.log to CloudWatch Logs
B.Enable AWS CloudTrail for EC2 instances
C.Enable VPC Flow Logs
D.Use AWS Config to detect SSH access
Why A: Publish OS-level logs to CloudWatch Logs using the CloudWatch agent. CloudTrail does not capture OS login attempts. VPC Flow Logs capture network traffic, not OS events. Config is for resource compliance.
Variation 2. A company wants to monitor failed SSH login attempts to its EC2 instances. Which AWS service should be used to collect and analyze these logs?
easy
A.VPC Flow Logs
✓ B.Amazon CloudWatch Logs with the unified CloudWatch agent
C.AWS CloudTrail
D.AWS Config
Why B: Amazon CloudWatch Logs with the unified CloudWatch agent is the correct choice because the agent can be configured to collect and forward system log files, such as /var/log/secure (Amazon Linux) or /var/log/auth.log (Ubuntu), which record SSH authentication attempts including failures. This allows centralized monitoring and analysis of failed SSH logins via CloudWatch Logs Insights or metric filters.
Variation 3. A security engineer needs to monitor for failed SSH login attempts to EC2 instances and send alerts. Which combination of AWS services should be used?
easy
A.VPC Flow Logs and Amazon Athena.
B.AWS CloudTrail and Amazon SNS.
C.Amazon S3 event notifications and AWS Lambda.
✓ D.CloudWatch Logs agent on EC2, CloudWatch Logs metric filter, and CloudWatch Alarm.
Why D: Option A is correct because CloudWatch Logs agent can capture /var/log/secure (or auth.log) and send to CloudWatch Logs, which can then trigger a metric filter and alarm. Option B is wrong because CloudTrail does not capture OS-level logs. Option C is wrong because VPC Flow Logs capture network traffic, not SSH login attempts. Option D is wrong because S3 event notifications are for object-level events.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.