Courseiva

CCNA Security Logging Questions

75 of 103 questions · Page 1/2 · Security Logging topic · Answers revealed

Practice these questionsExam hubAll questions
1
MCQhard

A security engineer notices that an S3 bucket containing sensitive data has been accessed from an IP address outside the allowed range. CloudTrail logs show the access was made using temporary credentials from an assumed role. What additional logging is needed to trace the access back to the original IAM user who assumed the role?

A.Enable CloudTrail to log data events for the S3 bucket.
B.Enable VPC Flow Logs for the VPC where the request originated.
C.Configure CloudWatch Logs to capture the EC2 instance's system logs.
D.Enable S3 server access logging for the bucket.
E.Enable AWS Config to record S3 bucket policies.
AnswerE

AWS Config does not record API calls; CloudTrail already records the session issuer in management events.

Why this answer

The information needed to trace the access back to the original IAM user who assumed the role is already available in CloudTrail management events, which are enabled by default. The AssumeRole API call is logged as a management event and includes the ARN of the IAM user or role that performed the assumption. Therefore, no additional logging is required to identify the original user.

Options A, B, C, D, and E do not provide this specific information: A and D log the S3 access but show only the assumed role; B and C are unrelated; E records configuration changes but not the specific AssumeRole call.

Exam trap

Candidates may assume that data events (A) or S3 server access logs (D) will capture the original user, but they only log the assumed role's ARN. The key is recognizing that management events already contain the AssumeRole call with the original user identity.

How to eliminate wrong answers

Option A is wrong because CloudTrail data events for S3 would log the API calls made to the bucket (e.g., GetObject, PutObject) but would still show the assumed role's ARN, not the original IAM user who assumed the role. Option B is wrong because VPC Flow Logs capture network traffic metadata (IP addresses, ports, protocols) but do not include IAM user or role information, so they cannot trace back to the original user. Option C is wrong because EC2 instance system logs (e.g., /var/log/messages) capture OS-level events, not AWS IAM role assumption details, and are irrelevant to tracing the original IAM user.

Option D is wrong because S3 server access logs record requests to the bucket (e.g., requester, IP, operation) but the requester field will show the assumed role's ARN, not the original IAM user who assumed the role.

Practice this question →
2
Multi-Selecthard

A security engineer wants to detect and alert on AWS account root user activity. Which THREE services can be used together to achieve this? (Select THREE.)

Select 3 answers
A.AWS Config
B.Amazon CloudWatch Events (EventBridge)
C.AWS CloudTrail
D.Amazon CloudWatch Logs
E.Amazon GuardDuty
AnswersB, C, D

CloudWatch Events can filter and alert on root user events.

Why this answer

Amazon CloudWatch Events (EventBridge) is correct because it can be used to create a rule that matches specific API calls recorded by AWS CloudTrail. When the root user performs an action, CloudTrail logs the event, and EventBridge can trigger a notification (e.g., via SNS or Lambda) based on that event. This combination allows real-time detection and alerting of root user activity.

Exam trap

The trap here is that candidates may think Amazon GuardDuty is the correct choice because it detects threats, but it does not provide a native, customizable alerting mechanism for root user activity; instead, the combination of CloudTrail, EventBridge, and CloudWatch Logs is the standard AWS-recommended approach.

Practice this question →
3
Multi-Selectmedium

A security engineer is troubleshooting an issue where CloudTrail is not delivering logs to an S3 bucket. The bucket policy appears correct. Which TWO additional steps should the engineer take to diagnose the issue? (Choose TWO.)

Select 2 answers
A.Verify that the S3 bucket exists and is in the correct region.
B.Check CloudWatch Logs for CloudTrail errors.
C.Create an IAM role for CloudTrail with S3 write permissions.
D.Enable S3 server access logging on the bucket.
E.Review the CloudTrail configuration in the AWS Management Console for error messages.
AnswersA, E

Basic check.

Why this answer

If the S3 bucket does not exist or is in a different region, CloudTrail cannot deliver log files to it. CloudTrail requires the bucket to be in the same region as the trail (for a single-region trail) or in the designated bucket region for a multi-region trail. Verifying the bucket's existence and region ensures the delivery path is valid.

Option E is correct because the CloudTrail configuration in the AWS Management Console displays error messages related to delivery failures, such as bucket policy issues or permission errors. Reviewing this console can provide immediate insight into why logs are not being delivered, without needing to check other logs manually.

Exam trap

The trap here is that candidates often assume CloudTrail uses an IAM role for S3 access (like many other AWS services), but CloudTrail relies solely on a resource-based bucket policy, so creating an IAM role (Option C) is unnecessary and incorrect.

Practice this question →
4
Multi-Selecthard

A company is using AWS CloudTrail and wants to detect when an IAM user performs a specific action, such as stopping an EC2 instance. The security engineer needs to set up a real-time notification. Which THREE steps should the engineer take? (Choose THREE.)

Select 3 answers
A.Create a metric filter in CloudWatch Logs to match the StopInstances event
B.Create a CloudTrail trail that delivers logs to CloudWatch Logs
C.Use Amazon QuickSight to visualize CloudTrail logs
D.Create a CloudWatch alarm on the metric and configure it to send an SNS notification
E.Use Amazon Athena to query CloudTrail logs in S3
AnswersA, B, D

Metric filter extracts metrics from logs.

Why this answer

A metric filter in CloudWatch Logs can parse CloudTrail log events for the 'StopInstances' API call and convert it into a CloudWatch metric. This metric can then trigger an alarm for real-time notification, enabling the security engineer to detect the specific action as required.

Exam trap

The trap here is that candidates may confuse services like QuickSight or Athena for real-time monitoring, but they are designed for historical analysis and visualization, not for triggering real-time notifications.

Practice this question →
5
Multi-Selecthard

A security engineer is configuring Amazon GuardDuty in a multi-account environment using AWS Organizations. The engineer needs to ensure that all findings from member accounts are visible in the administrator account. Additionally, the engineer wants to receive real-time notifications for high-severity findings. Which TWO actions should the engineer take? (Choose TWO.)

Select 2 answers
A.Enable Amazon Detective to analyze GuardDuty findings.
B.Designate an administrator account in GuardDuty to manage the multi-account environment.
C.Create an Amazon EventBridge rule that triggers an SNS notification for high-severity GuardDuty findings.
D.Enable AWS CloudTrail in all member accounts to log GuardDuty API calls.
E.Use AWS Config to monitor GuardDuty configuration.
AnswersB, C

The administrator account can view findings from all member accounts.

Why this answer

Designating an administrator account in GuardDuty is the required step to centrally manage findings from all member accounts in an AWS Organizations multi-account setup. This configuration enables the administrator account to view and aggregate all findings from member accounts without needing to log into each account individually.

Exam trap

The trap here is that candidates may think Amazon Detective or AWS Config are needed for real-time notifications, but Detective is for post-incident analysis and Config is for compliance drift, not for triggering alerts on security findings.

Practice this question →
6
Multi-Selectmedium

A company is using AWS CloudTrail to monitor API activity in its AWS account. The security team needs to be alerted when unauthorized API calls are made to delete Amazon S3 buckets. Which TWO steps should the security team take to meet this requirement? (Choose TWO.)

Select 2 answers
A.Enable Amazon VPC Flow Logs to capture API calls and use Amazon Athena to query for DeleteBucket events.
B.Create an AWS CloudTrail trail that monitors Amazon CloudWatch Logs for DeleteBucket API calls.
C.Create an AWS Config rule to detect DeleteBucket API calls and send an SNS notification.
D.Configure CloudTrail to deliver logs to Amazon CloudWatch Logs and create a metric filter for the DeleteBucket API call.
E.Create an Amazon CloudWatch Events rule that matches the DeleteBucket API call and triggers an Amazon SNS notification.
AnswersD, E

CloudTrail can deliver to CloudWatch Logs, and a metric filter can trigger an alarm.

Why this answer

CloudTrail can be configured to deliver logs to Amazon CloudWatch Logs, and a metric filter can be created to match the `DeleteBucket` API call. This metric can then trigger an alarm that sends an SNS notification, alerting the security team to unauthorized API calls. Option E is correct because Amazon CloudWatch Events (now Amazon EventBridge) can directly match the `DeleteBucket` API call from CloudTrail and trigger an SNS notification without needing a metric filter or alarm.

Exam trap

The trap here is that candidates may confuse AWS Config (which evaluates resource configurations) with CloudTrail (which records API activity), or think VPC Flow Logs can capture API-level events instead of network flows.

Practice this question →
7
MCQhard

A financial services company has a production AWS account with hundreds of EC2 instances running a mix of Linux and Windows workloads. The security team is responsible for detecting and responding to security incidents. They have enabled CloudTrail, VPC Flow Logs, and GuardDuty. Recently, GuardDuty generated a finding indicating that an EC2 instance is communicating with a known malicious IP address. The security engineer needs to investigate the incident. The engineer examines the GuardDuty finding and sees the affected resource is an EC2 instance ID. The engineer wants to identify which user or role launched the instance and what security groups were associated with it at launch time. Which approach should the engineer take to gather this information?

A.Log in to the EC2 console and view the instance details under the 'Security' tab.
B.Use AWS Systems Manager Inventory to collect metadata about the instance.
C.Search CloudTrail logs for the RunInstances event that created the instance, using the instance ID to filter.
D.Use AWS Config to view the configuration history of the EC2 instance and check the security group changes.
AnswerC

CloudTrail captures the API call with user identity and parameters.

Why this answer

CloudTrail logs the RunInstances API call, which includes the user identity (who launched the instance), the instance ID, and the security group IDs associated at launch. Option A is incorrect because the EC2 console Security tab shows current security groups and does not provide historical launch details or the user who launched. Option B is incorrect because AWS Systems Manager Inventory collects operational data but does not capture the launch user or initial security group associations.

Option D is incorrect because AWS Config records configuration changes over time but does not identify the user who performed the launch action.

Practice this question →
8
MCQhard

A company runs a multi-account AWS environment using AWS Organizations. The security team needs to implement centralized logging for all AWS CloudTrail events across all accounts. They create a new trail in the management account with the following configuration: trail name 'central-trail', apply to all accounts in the organization, enable data events for all S3 buckets, and store logs in a centralized S3 bucket. After one week, they notice that some accounts are not delivering CloudTrail logs to the central bucket. The security engineer verifies that the trail is still configured to apply to all accounts and that the S3 bucket policy allows cross-account access. What is the MOST likely reason for the missing logs?

A.The member accounts have not enabled CloudTrail Insights
B.The S3 bucket policy does not grant the correct permissions to the member accounts
C.The trail is not configured as a multi-region trail
D.Some accounts were added to the organization after the trail was created, and the trail was not updated to include them
AnswerD

When new accounts join, the trail must be updated or they need to enable the trail manually.

Why this answer

When a trail is created in the management account with 'apply to all accounts in the organization', it automatically includes all current member accounts. However, if new accounts are added to the AWS Organization after the trail is created, the trail does not automatically extend to those new accounts. The trail must be updated (e.g., via the CloudTrail console or API) to include the newly added accounts, or the organization trail feature must be re-enabled.

This is why logs from accounts added after trail creation are missing.

Exam trap

The trap here is that candidates assume 'apply to all accounts' means the trail dynamically includes any account added later, but in reality, the trail only applies to accounts that were members at the time of creation and must be manually updated for new accounts.

How to eliminate wrong answers

Option A is wrong because CloudTrail Insights is an optional feature that analyzes management events for unusual activity; it is not required for log delivery and its absence does not prevent logs from being delivered. Option B is wrong because the security engineer already verified that the S3 bucket policy allows cross-account access, so the policy is not the issue. Option C is wrong because the question does not mention any requirement for multi-region logging; the missing logs are from specific accounts, not from specific regions, and a single-region trail would still deliver logs from the home region of each account.

Practice this question →
9
Multi-Selecteasy

Which TWO AWS services can be used to detect and alert on suspicious activity in near real-time?

Select 2 answers
A.Amazon CloudWatch Events
B.Amazon Inspector
C.Amazon GuardDuty
D.AWS CloudTrail
E.AWS Config
AnswersA, C

CloudWatch Events can trigger on suspicious patterns.

Why this answer

Amazon CloudWatch Events (now part of Amazon EventBridge) can detect suspicious activity by monitoring AWS API calls, resource state changes, and custom application events in near real-time. It can trigger automated responses, such as invoking a Lambda function or sending an SNS notification, when specific patterns (e.g., unauthorized API calls or unusual resource modifications) are detected. This makes it suitable for near real-time alerting on suspicious activity.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail's logging capability with real-time detection, but CloudTrail delivers log files with a delay (typically 5-15 minutes) and does not natively analyze or alert on suspicious activity without additional services like CloudWatch Events or GuardDuty.

Practice this question →
10
MCQhard

Refer to the exhibit. A security engineer configured the above bucket policy for CloudTrail log delivery. However, logs are not being delivered. What is the most likely cause?

A.The Action should be 's3:PutObjectAcl' instead of 's3:PutObject'.
B.The Principal is incorrect; it should be the CloudTrail service principal for the region.
C.The condition requires 'bucket-owner-full-control' ACL, but CloudTrail does not set this ACL when delivering to the same account.
D.The Resource ARN is missing the account ID in the path.
AnswerC

CloudTrail sets the ACL only for cross-account delivery; for same account, the ACL is not set, causing the condition to fail.

Why this answer

When CloudTrail delivers logs to an S3 bucket in the same AWS account, it does not set the 'bucket-owner-full-control' canned ACL on the objects. The bucket policy condition requiring 's3:x-amz-acl': 'bucket-owner-full-control' will fail, as CloudTrail uses the default ACL (bucket-owner-full-control is only set for cross-account deliveries). This mismatch prevents log delivery.

Exam trap

The trap here is that candidates assume the 'bucket-owner-full-control' ACL condition is always required for CloudTrail, but it is only needed for cross-account deliveries, not same-account, causing the policy to fail silently.

How to eliminate wrong answers

Option A is wrong because the Action should be 's3:PutObject' to allow CloudTrail to write log objects; 's3:PutObjectAcl' is for modifying ACLs after upload, not the initial write. Option B is wrong because the Principal for CloudTrail delivery is the CloudTrail service principal (e.g., 'cloudtrail.amazonaws.com'), which is correct; the issue is not the principal but the ACL condition. Option D is wrong because the Resource ARN does not require an account ID in the path; the bucket policy uses the bucket ARN and a wildcard for objects (e.g., 'arn:aws:s3:::bucket-name/AWSLogs/*'), which is valid without an account ID in the path.

Practice this question →
11
Multi-Selecthard

A company wants to ensure that all API calls in their AWS account are logged and immutable. Which TWO actions should be taken? (Choose TWO.)

Select 2 answers
A.Enable MFA delete on the S3 bucket
B.Use AWS Config rules to monitor CloudTrail configuration
C.Enable S3 Object Lock on the CloudTrail S3 bucket
D.Encrypt the S3 bucket with AWS KMS
E.Enable AWS CloudTrail for all regions
AnswersC, E

Object Lock prevents log deletion or modification.

Why this answer

Enabling S3 Object Lock on the CloudTrail S3 bucket ensures that log files are immutable and cannot be overwritten or deleted by any user, including root. This is achieved through a write-once-read-many (WORM) model, which is essential for maintaining a tamper-proof audit trail of all API calls.

Exam trap

The trap here is that candidates often confuse encryption (Option D) with immutability, or they think MFA delete (Option A) provides sufficient protection, but neither prevents overwrites or ensures a WORM state, which is the core requirement for immutable logging.

Practice this question →
12
MCQmedium

A company uses Amazon CloudWatch Logs to collect application logs from EC2 instances. The security team wants to create an alarm that triggers when a specific error pattern appears in the logs. They have set up a metric filter and an alarm. However, the alarm is not triggering even though the error pattern exists in the logs. What is the most likely cause?

A.The log group retention period is set to 1 day.
B.The metric filter uses a custom namespace that is not allowed.
C.The metric filter was created before the log group.
D.The metric filter is only applied to log events that occur after the filter is created.
AnswerD

Metric filters do not backfill; they only apply to new log events.

Why this answer

Metric filters only apply to log events that are ingested after the filter is created. They do not evaluate historical log data, so if the error pattern existed before the filter was created, it will not be counted toward the metric. Option A is incorrect because the log group retention period determines how long logs are stored, not whether the metric filter evaluates them.

Option B is incorrect because custom namespaces are allowed for CloudWatch metrics. Option C is incorrect because the metric filter cannot be created without an existing log group; it must be created after the log group exists.

Practice this question →
13
MCQmedium

A company uses Amazon GuardDuty and wants to automatically isolate a compromised EC2 instance by removing it from the security group. Which approach should be used?

A.Set up an AWS Config rule to detect the finding and remediate.
B.Configure GuardDuty to directly modify the security group.
C.Create an Amazon EventBridge rule that triggers an AWS Lambda function to remove the instance from the security group.
D.Use AWS Systems Manager Automation to automatically modify the security group based on GuardDuty findings.
AnswerC

EventBridge can capture GuardDuty findings and invoke Lambda for automated remediation.

Why this answer

Amazon GuardDuty publishes findings to Amazon EventBridge, which can be used to trigger an AWS Lambda function. The Lambda function can then call the EC2 API to modify the security group and remove the compromised instance, achieving automated isolation without requiring direct GuardDuty integration with security groups.

Exam trap

The trap here is that candidates assume GuardDuty can directly perform remediation actions (Option B) or that AWS Config is the primary service for event-driven remediation (Option A), when in reality EventBridge is the standard integration point for triggering automated responses to GuardDuty findings.

How to eliminate wrong answers

Option A is wrong because AWS Config rules evaluate resource compliance and can trigger remediation actions, but they do not natively consume GuardDuty findings; you would need a custom Lambda or Systems Manager automation to bridge them, making this an indirect and less efficient approach. Option B is wrong because GuardDuty is a threat detection service that cannot directly modify security groups; it only generates findings and has no built-in remediation capabilities. Option D is wrong because AWS Systems Manager Automation can run remediation workflows, but it requires a separate trigger (e.g., EventBridge) to start the automation document based on GuardDuty findings, making it an extra layer of complexity compared to directly invoking Lambda via EventBridge.

Practice this question →
14
MCQmedium

A company uses AWS CloudTrail to log all API calls. The security team needs to be alerted when an IAM user creates a new access key. Which approach is most efficient?

A.Enable AWS Config managed rule to detect access key creation and trigger an SNS notification.
B.Create a CloudWatch Events rule that matches the CreateAccessKey event and targets an SNS topic.
C.Use CloudWatch Logs Insights to run a query every minute on CloudTrail logs and send results to SNS.
D.Configure CloudTrail to send logs to an S3 bucket and enable S3 event notifications to an SNS topic.
AnswerB

CloudWatch Events can filter specific API calls in real-time and trigger actions like SNS notifications.

Why this answer

CloudWatch Events (now part of Amazon EventBridge) can directly match the CreateAccessKey API call from AWS CloudTrail in real time and trigger an SNS notification. This approach is the most efficient as it requires no polling, no additional infrastructure, and provides immediate alerting with minimal latency.

Exam trap

The trap here is that candidates may confuse AWS Config's resource compliance monitoring with real-time event detection, or assume that S3 event notifications are suitable for low-latency security alerts, when in fact EventBridge rules are purpose-built for this use case.

How to eliminate wrong answers

Option A is wrong because AWS Config managed rules evaluate resource configurations periodically or on configuration changes, but they are not designed to detect API events like CreateAccessKey in real time; they would require a custom rule and still introduce delay. Option C is wrong because running a CloudWatch Logs Insights query every minute is inefficient, introduces up to a minute of latency, and incurs unnecessary costs for repeated scanning of log data. Option D is wrong because CloudTrail logs delivered to S3 have a delivery latency of up to 15 minutes, and S3 event notifications are not designed for real-time security alerting on API calls; this approach adds significant delay and complexity.

Practice this question →
15
Multi-Selecthard

A security engineer needs to monitor cross-account access to resources. Which THREE AWS services can be used to log or detect such access? (Choose THREE.)

Select 3 answers
A.AWS CloudTrail
B.Amazon VPC Flow Logs
C.Amazon GuardDuty
D.AWS Config
E.Amazon Inspector
AnswersA, C, D

Logs API calls including cross-account access.

Why this answer

AWS CloudTrail is correct because it logs all API calls made to the AWS environment, including cross-account access events such as AssumeRole, GetFederationToken, or any action performed by an IAM role from another account. These logs capture the source identity, target resource, and request parameters, enabling security engineers to detect and audit cross-account activity.

Exam trap

The trap here is that candidates often confuse network-level logging (VPC Flow Logs) with API-level logging (CloudTrail) or assume vulnerability scanners (Inspector) can detect access events, but only CloudTrail, GuardDuty, and Config provide the necessary identity and resource-level visibility for cross-account access monitoring.

Practice this question →
16
MCQhard

Refer to the exhibit. A security engineer investigates a potential unauthorized deletion of an AWS CloudTrail trail. The engineer runs the command and receives the output shown. Which additional step should the engineer take to determine if the trail deletion was unauthorized?

A.Enable AWS Config rules to monitor CloudTrail configuration changes and cross-reference the event time with an approved change window.
B.Check the source IP address 203.0.113.50 against a list of approved corporate IP ranges.
C.Review the IAM user 'admin' permissions to see if they have the cloudtrail:DeleteTrail permission.
D.Use CloudTrail Insights to detect unusual API activity for the DeleteTrail event.
AnswerA

Cross-referencing with an approved change window helps determine if the deletion was planned and authorized, addressing the authorization aspect directly.

Why this answer

The engineer needs to determine if the deletion was unauthorized. Checking the source IP or permissions may not be sufficient. The best approach is to verify if the deletion occurred within an approved change window, which can be tracked via AWS Config or change management processes.

Practice this question →
17
Multi-Selecteasy

Which TWO AWS services provide native integration with Amazon CloudWatch Logs for real-time monitoring of application logs? (Choose TWO.)

Select 2 answers
A.Amazon S3
B.Amazon Route 53
C.Amazon EC2
D.AWS Lambda
E.AWS CloudTrail
AnswersC, D

EC2 can use the CloudWatch agent to send logs.

Why this answer

Amazon EC2 is correct because it can be configured to send application logs to CloudWatch Logs via the CloudWatch Logs agent or unified CloudWatch agent, enabling real-time monitoring, search, and alerting on log data. AWS Lambda is correct because it natively integrates with CloudWatch Logs: every Lambda function execution automatically streams its logs to a CloudWatch Logs group, providing real-time visibility into function output and errors.

Exam trap

The SCS-C02 exam often tests the distinction between services that natively produce or stream application logs to CloudWatch Logs versus services that can only send logs via additional configuration or are limited to audit/API logs, leading candidates to mistakenly select CloudTrail or S3 as native integrations.

Practice this question →
18
MCQhard

Refer to the exhibit. A security engineer is investigating a CloudTrail event. Which statement is true about the trail that was created?

A.The source IP address is from an AWS service.
B.The trail was created using the AWS CLI.
C.The trail is a single-region trail.
D.The trail will log global service events.
AnswerD

The request parameters include 'includeGlobalServiceEvents' set to true.

Why this answer

The CloudTrail event shows that the trail was created with 'isMultiRegionTrail' set to true, meaning it logs events from all regions. The source IP is 203.0.113.5, which is not necessarily the console IP; the console can be used from any IP. The user agent indicates it was done via the console, not CLI.

The trail logs global service events because 'includeGlobalServiceEvents' is true.

Practice this question →
19
Multi-Selecthard

A security team wants to implement a centralized logging solution for multiple AWS accounts. The team needs to collect VPC Flow Logs, CloudTrail logs, and DNS query logs from all accounts. Which THREE services should the team use to aggregate these logs? (Choose THREE.)

Select 3 answers
A.AWS CloudHSM
B.AWS Config
C.Amazon Route 53 Resolver query logging
D.AWS CloudTrail
E.VPC Flow Logs
AnswersC, D, E

Resolver query logs can be published to a central S3 bucket for DNS query logs.

Why this answer

Amazon Route 53 Resolver query logging (Option C) is correct because it enables centralized collection of DNS query logs from VPCs across multiple AWS accounts. By configuring Route 53 Resolver query logging to send logs to a central Amazon S3 bucket or CloudWatch Logs group, the security team can aggregate DNS query logs from all accounts, meeting the requirement for centralized DNS logging.

Exam trap

The trap here is that candidates may confuse AWS CloudHSM or AWS Config as logging services, but neither is designed for log collection or aggregation; CloudHSM is for key management and Config is for configuration auditing, not for aggregating VPC Flow Logs, CloudTrail logs, or DNS query logs.

Practice this question →
20
Multi-Selecteasy

A security engineer is configuring VPC Flow Logs to capture network traffic metadata. Which TWO attributes can be captured in VPC Flow Logs? (Choose TWO.)

Select 2 answers
A.Packet payload
B.Source IP address
C.IAM user ID
D.Destination port
E.DNS query name
AnswersB, D

Captured.

Why this answer

VPC Flow Logs capture metadata about network traffic, including the source IP address (option B) and destination port (option D). The source IP address identifies the origin of the traffic, while the destination port indicates the application or service being targeted. These are standard fields in the flow log record format, as defined by AWS for capturing IP traffic metadata.

Exam trap

The trap here is that candidates often confuse network metadata with application-layer data, mistakenly thinking VPC Flow Logs can capture packet payloads or DNS query names, which are not part of the flow log record format.

Practice this question →
21
Multi-Selectmedium

A company needs to monitor for unauthorized changes to security group rules. Which TWO AWS services can be used together to achieve this?

Select 2 answers
A.Amazon GuardDuty
B.AWS Config
C.Amazon Inspector
D.AWS CloudTrail
E.Amazon CloudWatch Events
AnswersB, E

AWS Config can track changes to security group rules and evaluate them against desired configurations.

Why this answer

Options B and E are correct. AWS Config can track changes to security group rules, and Amazon CloudWatch Events can trigger a notification when a Config rule detects a change. Option A (GuardDuty) is for threat detection.

Option C (Inspector) is for vulnerability scanning. Option D (CloudTrail) logs API calls but is not the best for direct rule-level monitoring.

Practice this question →
22
Multi-Selectmedium

A company is using Amazon GuardDuty to detect threats. The security team wants to receive alerts for specific findings. Which TWO AWS services can be used to forward GuardDuty findings to a custom application for analysis? (Choose two.)

Select 2 answers
A.Amazon CloudWatch Events (Amazon EventBridge)
B.Amazon Kinesis Data Streams
C.Amazon Simple Queue Service (SQS)
D.AWS Lambda
E.Amazon S3
AnswersA, E

GuardDuty publishes findings to EventBridge, which can then route to various targets.

Why this answer

Amazon GuardDuty can publish findings to Amazon CloudWatch Events (now part of Amazon EventBridge) as events. These events can then be routed to a custom application via targets like AWS Lambda, SQS, or Kinesis, enabling real-time analysis and alerting. This is the primary, native integration for forwarding GuardDuty findings to downstream systems.

Exam trap

The trap here is that candidates confuse the service that receives the finding (EventBridge) with the service that processes or stores it (Lambda, SQS, Kinesis), forgetting that EventBridge is the required intermediary for forwarding GuardDuty findings to any custom application.

Practice this question →
23
MCQhard

A company uses Amazon GuardDuty to monitor for malicious activity in its AWS environment. The security team receives a high number of findings, many of which are false positives. They want to reduce noise by suppressing findings for known benign activities, such as internal vulnerability scans performed by the security team. GuardDuty has a feature to create suppression rules based on finding criteria. However, the team also wants to ensure that if a new type of threat is detected, it is immediately escalated. What is the MOST effective way to manage GuardDuty findings?

A.Set GuardDuty to only generate findings for medium and high severity, ignoring low severity findings.
B.Create a suppression rule that blocks all findings from the internal IP range used by the security team.
C.Disable the specific GuardDuty finding types that generate false positives.
D.Create suppression rules that automatically archive findings matching the known benign activity criteria, and periodically review the suppressed findings.
AnswerD

Suppression rules target specific criteria and allow for periodic review to ensure no missed threats.

Why this answer

Creating suppression rules that automatically archive findings matching known benign activity criteria reduces noise from false positives while still allowing the team to periodically review suppressed findings to ensure no genuine threats are missed. Option A (setting GuardDuty to only generate findings for medium and high severity) is less effective because low severity findings may still contain important information. Option B (suppressing all findings from an internal IP range) is too broad and could miss threats that originate from that range, such as compromised internal instances.

Option C (disabling specific finding types) would miss new variations of known threats that might be reported under those types, whereas suppression rules can be more granular and reviewed. Therefore, D is the most effective approach.

Practice this question →
24
MCQmedium

A company uses AWS Organizations to manage multiple accounts. The security team wants to enable CloudTrail for all accounts and centrally store logs. What is the most efficient way to achieve this?

A.Use an S3 bucket policy to allow cross-account log delivery
B.Create a CloudTrail trail in the management account and apply it to all accounts in the organization
C.Use AWS Lambda to create trails in each account
D.Ask each account admin to create their own CloudTrail trail and deliver to a central S3 bucket
AnswerB

Organization trails log all accounts centrally.

Why this answer

AWS Organizations allows you to create a single CloudTrail trail in the management account that automatically applies to all member accounts within the organization. This is the most efficient method as it eliminates the need for manual per-account configuration or custom automation, and it ensures consistent logging across the entire organization with centralized log delivery to a single S3 bucket.

Exam trap

The trap here is that candidates often assume cross-account S3 bucket policies (Option A) are sufficient, overlooking the native organization-wide trail capability that automates trail creation and management across all accounts.

How to eliminate wrong answers

Option A is wrong because while an S3 bucket policy can allow cross-account log delivery, it does not automate the creation of CloudTrail trails in each account; each account would still need to manually create its own trail, which is inefficient and error-prone. Option C is wrong because using AWS Lambda to create trails in each account introduces unnecessary complexity, potential latency, and maintenance overhead compared to the native organization-wide trail feature. Option D is wrong because asking each account admin to create their own trail is not only inefficient but also risks inconsistent configurations, missing logs, and increased administrative burden.

Practice this question →
25
MCQhard

A company uses Amazon RDS for MySQL and needs to monitor database activity for suspicious queries, such as unauthorized access attempts or SQL injection. The security team wants to centralize the logs from multiple RDS instances and analyze them in near real-time. Which solution should be implemented?

A.Enable RDS Enhanced Monitoring and stream the metrics to Amazon CloudWatch.
B.Enable VPC Flow Logs for the RDS instances and analyze the logs using Amazon Athena.
C.Enable AWS CloudTrail for RDS API calls and use Amazon GuardDuty to analyze the logs.
D.Enable database audit logs on each RDS instance, stream them to Amazon CloudWatch Logs, and use CloudWatch Logs Insights to query the logs.
AnswerD

Audit logs capture SQL queries; CloudWatch Logs provides centralized storage and analysis.

Why this answer

RDS for MySQL audit logs capture detailed database-level activity, including login attempts, query execution, and SQL injection patterns. Streaming these logs to CloudWatch Logs enables near real-time analysis using CloudWatch Logs Insights, which supports querying and alerting on suspicious queries across multiple RDS instances from a centralized location.

Exam trap

The trap here is confusing database-level audit logs (which capture SQL queries and authentication events) with infrastructure-level logs like Enhanced Monitoring or VPC Flow Logs, leading candidates to choose options that monitor performance or network traffic instead of actual database activity.

How to eliminate wrong answers

Option A is wrong because RDS Enhanced Monitoring provides OS-level metrics (CPU, memory, disk I/O) but does not capture database query content or authentication events needed to detect suspicious queries or SQL injection. Option B is wrong because VPC Flow Logs record network traffic metadata (IP addresses, ports, protocols) but do not include database query text or user authentication details; they cannot identify SQL injection or unauthorized access attempts at the database level. Option C is wrong because AWS CloudTrail logs RDS API calls (e.g., CreateDBInstance, ModifyDBInstance) but does not capture database engine-level activity such as SQL queries or login attempts; GuardDuty analyzes CloudTrail, VPC Flow Logs, and DNS logs for threats but cannot inspect database query content.

Practice this question →
26
MCQhard

Refer to the exhibit. An IAM policy is attached to a user. The user reports that they cannot upload objects to the S3 bucket 'example-bucket' using the AWS CLI from a remote location. What is the MOST likely cause?

A.The CLI is using HTTP instead of HTTPS.
B.The bucket policy denies access.
C.The bucket requires server-side encryption.
D.The user is not authorized to upload to the bucket.
E.The user does not have s3:PutObject permission.
AnswerA

The Deny statement blocks non-HTTPS requests.

Why this answer

The IAM policy shown in the exhibit includes a `Deny` effect for `s3:PutObject` when the request does not use `aws:SecureTransport` (i.e., HTTPS). If the AWS CLI is configured to use HTTP instead of HTTPS, the condition `aws:SecureTransport=false` is met, and the explicit deny blocks the upload. The user reports the issue from a remote location, which often involves misconfigured endpoints or proxies that force HTTP.

Exam trap

The trap here is that candidates often focus on the `Allow` statement and overlook the `Deny` statement with the `aws:SecureTransport` condition, assuming the user lacks permission entirely rather than recognizing the protocol-level restriction.

How to eliminate wrong answers

Option B is wrong because the exhibit shows an IAM policy attached to the user, not a bucket policy; a bucket policy is a separate resource-based policy that could deny access, but the question states the policy is attached to the user, and no bucket policy is mentioned. Option C is wrong because the policy does not reference server-side encryption (e.g., `s3:x-amz-server-side-encryption`), and the error is about upload failure, not encryption mismatch. Option D is wrong because the user is authorized via the IAM policy's `Allow` statement for `s3:PutObject`; the issue is the `Deny` condition on `aws:SecureTransport`.

Option E is wrong because the user does have `s3:PutObject` permission granted by the `Allow` statement; the problem is the overriding `Deny` when HTTP is used.

Practice this question →
27
MCQhard

A company uses Amazon Route 53 for DNS and wants to log all DNS queries made from its VPC. The logs must be stored in Amazon S3 for compliance purposes. Which solution meets these requirements?

A.Enable Route 53 Resolver query logging and publish to an S3 bucket.
B.Install a CloudWatch Logs agent on each EC2 instance and configure it to send DNS logs to CloudWatch Logs.
C.Enable AWS CloudTrail for DNS API calls and deliver to an S3 bucket.
D.Enable VPC Flow Logs and publish to an S3 bucket.
AnswerA

Route 53 Resolver query logging captures DNS queries made by resources in your VPC and can deliver logs to S3.

Why this answer

Route 53 Resolver query logging is the native AWS feature designed to capture DNS queries that originate from resources within a VPC. By enabling this feature and specifying an S3 bucket as the destination, you can log all DNS queries made by EC2 instances, Lambda functions, and other VPC resources without needing any additional agents or configuration. This directly meets the requirement for storing DNS query logs in S3 for compliance.

Exam trap

The trap here is confusing data-plane DNS query logs (Route 53 Resolver query logging) with control-plane API logs (CloudTrail) or network flow logs (VPC Flow Logs), leading candidates to select options that log the wrong type of information for the stated requirement.

How to eliminate wrong answers

Option B is wrong because installing a CloudWatch Logs agent on each EC2 instance captures only the DNS queries made by that specific instance's operating system, not all DNS queries from the VPC (e.g., queries from other services or from the Route 53 Resolver itself), and it requires manual agent management. Option C is wrong because AWS CloudTrail logs API calls made to Route 53 (e.g., creating hosted zones), not the DNS query traffic itself; DNS queries are data-plane operations, not control-plane API calls. Option D is wrong because VPC Flow Logs capture metadata about network traffic (IP addresses, ports, protocols) but do not log the content or queries of DNS traffic; they cannot provide the actual DNS query names or types.

Practice this question →
28
MCQhard

Refer to the exhibit. An AWS Config rule checks that S3 buckets deny HTTP requests. The bucket 'my-bucket' is reported as non-compliant. Which change would make the bucket compliant?

A.Add a bucket policy that allows only HTTPS requests.
B.Change the Effect to Allow.
C.Add the bucket ARN to the Resource element in the policy.
D.Remove the Condition element from the policy.
AnswerC

The current policy only denies HTTP on objects; adding the bucket ARN (without /*) covers the bucket itself.

Why this answer

The bucket policy denies actions when 'aws:SecureTransport' is false (HTTP). However, the policy only applies to the bucket's objects (arn:aws:s3:::my-bucket/*), not to the bucket itself. To deny HTTP requests to the bucket as well, the resource should include the bucket ARN (arn:aws:s3:::my-bucket).

The rule likely checks that both bucket and objects are denied.

Practice this question →
29
MCQmedium

A security engineer is designing a monitoring solution for an AWS Lambda function that processes sensitive data. The function occasionally fails due to timeouts. The engineer needs to be alerted immediately when the function fails and also wants to analyze the error logs. Which combination of services should the engineer use?

A.Amazon CloudWatch Logs and Amazon Kinesis Data Firehose
B.Amazon CloudWatch Logs and CloudWatch Alarms with Amazon SNS
C.AWS CloudTrail and Amazon SNS
D.AWS Config and Amazon SNS
AnswerB

CloudWatch Logs stores logs, and CloudWatch Alarms trigger SNS notifications on errors.

Why this answer

Amazon CloudWatch Logs captures the Lambda function's execution logs, including timeout errors, and CloudWatch Alarms can monitor specific metrics like `Errors` or `Throttles` for the function. When the alarm state is triggered (e.g., `ALARM`), it publishes a notification to an Amazon SNS topic, which can send immediate alerts via email, SMS, or other endpoints. This combination provides both real-time alerting and log analysis for troubleshooting.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which logs API activity) with CloudWatch Logs (which captures application logs), leading them to choose Option C, even though CloudTrail cannot capture runtime errors like timeouts.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Firehose is designed for streaming data ingestion into storage or analytics services, not for real-time alerting; it lacks the ability to trigger immediate notifications based on Lambda function failures. Option C is wrong because AWS CloudTrail records API calls (e.g., Invoke, UpdateFunctionConfiguration) but does not capture function execution logs or runtime errors like timeouts; it is not suitable for analyzing application-level error logs. Option D is wrong because AWS Config tracks resource configuration changes and compliance, not function execution errors or logs; it cannot alert on runtime failures like timeouts.

Practice this question →
30
MCQmedium

Refer to the exhibit. A security engineer finds this CloudTrail log entry. What is the most significant security concern indicated by this event?

A.The security group rule allows SSH access from any IP address (0.0.0.0/0).
B.The event is a normal administrative action and poses no security concern.
C.The user did not have MFA enabled when assuming the AdminRole.
D.The source IP address (203.0.113.5) is from an unusual location.
AnswerA

This exposes the instance to the internet on port 22.

Why this answer

The CloudTrail log entry shows an `AuthorizeSecurityGroupIngress` API call that adds a rule allowing SSH (port 22) from 0.0.0.0/0. This is a critical security concern because it exposes the EC2 instance to SSH access from any IP address on the internet, creating a high risk of brute-force attacks, unauthorized access, and potential compromise. Security best practices mandate restricting SSH access to specific trusted IP ranges, not the entire internet.

Exam trap

The trap here is that candidates may focus on the source IP address or MFA status, but the core security concern is the overly permissive security group rule that grants unrestricted SSH access to the internet.

How to eliminate wrong answers

Option B is wrong because the event is not a normal administrative action; it explicitly opens SSH to the world, which is a significant security risk and should be flagged as a concern. Option C is wrong because the CloudTrail log does not indicate whether MFA was enabled or not; the event shows the user assumed the AdminRole, but MFA status is not recorded in this log entry, so it cannot be concluded as a security concern from this event alone. Option D is wrong because the source IP address 203.0.113.5 is a documentation/test IP range (RFC 5737) and is not necessarily unusual; more importantly, the security concern is the open SSH rule, not the source IP of the API call.

Practice this question →
31
Multi-Selectmedium

A security team wants to detect and alert on potential security threats such as compromised instances or malicious activity within their AWS environment. Which TWO AWS services should be used together to provide comprehensive threat detection?

Select 2 answers
A.AWS Security Hub
B.AWS CloudTrail
C.Amazon Inspector
D.AWS Config
E.Amazon GuardDuty
AnswersA, E

Aggregates and prioritizes security findings.

Why this answer

Amazon GuardDuty (Option E) is a threat detection service that continuously monitors for malicious activity and unauthorized behavior using machine learning, anomaly detection, and integrated threat intelligence feeds. AWS Security Hub (Option A) aggregates findings from GuardDuty and other services, applies automated compliance checks, and enables centralized alerting and response. Together, they provide comprehensive threat detection by combining GuardDuty's raw threat detection with Security Hub's aggregation and orchestration capabilities.

Exam trap

The trap here is that candidates often confuse logging services (CloudTrail, Config) or vulnerability scanners (Inspector) with active threat detection, but GuardDuty and Security Hub are the only pair that provide continuous, intelligent threat monitoring and centralized alerting.

Practice this question →
32
Multi-Selecthard

Which THREE are features of Amazon GuardDuty that help with threat detection? (Select THREE.)

Select 3 answers
A.Analyzes AWS Config configuration history.
B.Analyzes S3 object content for malware.
C.Analyzes VPC Flow Logs.
D.Analyzes DNS query logs.
E.Analyzes AWS CloudTrail management events.
AnswersC, D, E

GuardDuty uses VPC Flow Logs for network analysis.

Why this answer

Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. It ingests and analyzes VPC Flow Logs (option C) to detect suspicious network traffic patterns, such as port scans or data exfiltration attempts. This analysis is a core feature of GuardDuty's threat detection capabilities.

Exam trap

The trap here is that candidates may confuse GuardDuty's core log sources (VPC Flow Logs, DNS logs, CloudTrail) with other AWS security services like AWS Config (for configuration history) or Amazon Macie (for S3 data classification), leading them to select options A or B incorrectly.

Practice this question →
33
MCQmedium

A company has a multi-account AWS environment managed by AWS Organizations. The security team wants to enable a centralized logging solution where all VPC flow logs, CloudTrail logs, and AWS Config configuration items are sent to a single S3 bucket in the security account. The team has already created the S3 bucket with appropriate bucket policies to allow cross-account writes. However, logs are not appearing from all accounts. What is the MOST likely reason for this issue?

A.The security account is not the master account of the AWS Organization.
B.The S3 bucket policy does not grant write access to the root user of each member account.
C.The member accounts do not have the required IAM roles to allow the logging services to write to the central bucket.
D.The S3 bucket is encrypted with SSE-KMS and the KMS key policy does not allow cross-account access.
AnswerC

Each member account needs a service-linked role (e.g., AWSServiceRoleForCloudTrail) to enable cross-account logging.

Why this answer

The most likely reason logs are not appearing from all accounts is that the member accounts lack the required IAM roles (service-linked roles) that allow the logging services (CloudTrail, Config, VPC Flow Logs) to assume permissions to write to the central S3 bucket. Even with a correct bucket policy, the logging services in each member account need an appropriate IAM role (e.g., AWSServiceRoleForCloudTrail, AWSServiceRoleForConfig) to be present and properly configured. Without these roles, the services cannot perform the cross-account write.

Option C is correct because these roles must exist in each member account. Options A, B, and D are incorrect: A - The security account does not need to be the master account; any designated account can serve as the central logging account. B - The bucket policy should grant permissions to the logging service principal (e.g., config.amazonaws.com, cloudtrail.amazonaws.com), not the root user of member accounts.

D - While KMS key policies can cause issues, the question states the S3 bucket is already configured with appropriate bucket policies, and the most common cause of missing logs is missing IAM roles, not KMS encryption.

Practice this question →
34
Matchingmedium

Match each AWS security tool to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Automated vulnerability assessment

Threat detection service

Centralized security findings aggregation

Investigation and analysis of security issues

Resource configuration monitoring and compliance

Why these pairings

Correct matches: AWS Shield protects against DDoS, AWS WAF filters web traffic, and GuardDuty provides threat detection. Common confusions include swapping Shield with WAF and Inspector with Macie.

Practice this question →
35
MCQhard

A company is using Amazon GuardDuty to detect threats in its AWS environment. The security team notices that GuardDuty is generating a high number of 'UnauthorizedAccess:IAMUser/MaliciousIPCaller' findings for an IAM user that is used by a legacy application. The security team has verified that the IP addresses flagged are not malicious but are legitimate IPs used by the application's third-party service. The company wants to suppress these findings without disabling GuardDuty entirely. Which solution is the MOST effective and secure?

A.Disable the specific finding type in GuardDuty settings.
B.Create a GuardDuty suppression rule that automatically archives findings for that IAM user.
C.Create a VPC flow log filter to exclude traffic from those IP addresses.
D.Modify the IAM user's permissions to restrict the IP addresses it can use.
AnswerB

Suppression rules allow you to filter out known false positives based on specific criteria.

Why this answer

GuardDuty suppression rules allow you to automatically archive findings that match specific criteria, such as a particular finding type and IAM user ARN. This suppresses false positives for that user without affecting other findings. Option B is correct because it uses this built-in feature.

Option A is incorrect because disabling the finding type would suppress all such findings for all users, which is too broad. Option C is incorrect because VPC flow log filters control logging, not GuardDuty findings. Option D is incorrect because modifying IAM permissions does not influence GuardDuty detection or suppression.

Practice this question →
36
MCQhard

Refer to the exhibit. After invoking the Lambda function, why are there no log streams in the log group?

A.The CloudWatch Logs log group retention policy is set to 0 days.
B.The Lambda function is not configured with a CloudWatch Logs log group.
C.The Lambda function timed out before writing logs.
D.The Lambda function's execution role lacks permissions to write to CloudWatch Logs.
AnswerD

The log group exists but no log streams were created, indicating a permissions issue.

Why this answer

The Lambda function was invoked but no logs were generated. This can happen if the Lambda function does not have the required permissions to create log streams in CloudWatch Logs. The function's execution role must include the 'logs:CreateLogStream' and 'logs:PutLogEvents' actions.

Practice this question →
37
MCQmedium

A security engineer is investigating a potential security incident. CloudTrail logs show that an IAM user 'admin' deleted an S3 bucket at 2023-01-15T10:30:00Z. The engineer needs to find the source IP address and user agent of the request. Which CloudTrail log field contains this information?

A.eventID
B.requestParameters
C.userAgent and sourceIPAddress
D.resources
AnswerC

These fields contain the required information.

Why this answer

CloudTrail logs capture the `userAgent` and `sourceIPAddress` fields directly in the log event record. These fields are part of the CloudTrail `Event` record structure, specifically under the `userIdentity` and `sourceIPAddress` top-level attributes, and they provide the exact source IP address and user agent string (e.g., AWS CLI, SDK, console browser) for the API call that deleted the S3 bucket.

Exam trap

The trap here is that candidates often confuse `requestParameters` with containing all request metadata, but it only holds the API call's input parameters, not the network-level origin details like source IP or user agent.

How to eliminate wrong answers

Option A is wrong because `eventID` is a unique identifier for the CloudTrail event, used for deduplication and correlation, but it does not contain the source IP or user agent. Option B is wrong because `requestParameters` contains the API request parameters (e.g., bucket name, region) but not the network-level metadata like source IP or user agent. Option D is wrong because `resources` lists the AWS resources involved in the event (e.g., the S3 bucket ARN) but does not include the source IP or user agent.

Practice this question →
38
Multi-Selectmedium

A company is implementing a security monitoring solution for its AWS environment. Which TWO services can be used to detect and alert on suspicious API activity? (Choose TWO.)

Select 2 answers
A.Amazon GuardDuty
B.AWS CloudTrail
C.Amazon Inspector
D.AWS Config
E.VPC Flow Logs
AnswersA, B

GuardDuty analyzes CloudTrail events and other data sources to detect suspicious API activity.

Why this answer

Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior, including suspicious API activity. It analyzes AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs to generate security findings and alerts. GuardDuty uses machine learning and anomaly detection to identify patterns such as unusual API calls, credential compromise, or reconnaissance attempts, making it a correct choice for detecting and alerting on suspicious API activity.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which logs API activity) with a service that also detects and alerts on suspicious activity, but CloudTrail itself does not analyze or alert—it only records events; GuardDuty is needed for detection and alerting.

Practice this question →
39
MCQhard

A company has a multi-account AWS environment with 50 accounts. The security team uses AWS CloudTrail to log management events in each account and delivers logs to a centralized S3 bucket in the security account. Recently, the team noticed that some CloudTrail logs are missing from the central bucket for a few accounts. The logs appear to be delivered intermittently. The security engineer checks the CloudTrail configuration in one of the affected accounts and sees that the trail is configured to deliver to the central bucket. The bucket policy in the security account allows CloudTrail to write from all accounts. The engineer also checks the CloudTrail console and sees that the trail status is 'Logging'. What is the MOST likely cause of the intermittent log delivery?

A.The S3 bucket has default encryption enabled, which interferes with CloudTrail writes.
B.The S3 bucket has a Lifecycle policy that deletes objects prematurely.
C.The CloudTrail trail is using Kinesis Data Firehose for delivery, which has a throughput limit.
D.The CloudTrail trail in each account is not associated with an SQS queue, causing delivery failures.
AnswerC

Correct. If the trail uses Kinesis Data Firehose, throughput limits can cause intermittent delivery failures, leading to missing logs.

Why this answer

The most likely cause is that the CloudTrail trail is configured to deliver logs via Kinesis Data Firehose, which has a throughput limit. If the volume of log data exceeds the Firehose stream's capacity, some logs may fail to be delivered, resulting in intermittent missing logs. Option A is incorrect because S3 default encryption (SSE-S3) does not interfere with CloudTrail writes; CloudTrail can write to encrypted buckets.

Option B is incorrect because a lifecycle policy deletes objects after they are stored, not during delivery, so it would not cause intermittent missing logs. Option D is incorrect because CloudTrail does not use SQS for log delivery; it delivers directly to S3 or via Firehose.

Practice this question →
40
MCQhard

A company has a multi-account AWS environment using AWS Organizations. The security team has enabled AWS CloudTrail with an organization trail that delivers logs to a centralized S3 bucket in the management account. They have also enabled Amazon GuardDuty in all accounts. Recently, they noticed that some EC2 instances in a member account are exhibiting unusual network behavior, such as outbound traffic to known malicious IP addresses. The security engineer needs to quickly determine the source of the traffic and identify which EC2 instances are affected. The engineer has access to the management account and the member account. Which course of action should the engineer take to most efficiently investigate this incident?

A.Use AWS Config to review the configuration changes of the EC2 instances and identify any anomalies.
B.Use Amazon Detective to investigate the GuardDuty findings and analyze VPC Flow Logs to identify the affected instances.
C.Use Amazon Inspector to scan the EC2 instances for vulnerabilities and correlate with network traffic.
D.Query the VPC Flow Logs stored in the centralized S3 bucket using Amazon Athena to find the source IP and affected instances.
AnswerB

Detective provides a consolidated investigation experience across logs and findings.

Why this answer

Amazon Detective automatically aggregates and analyzes VPC Flow Logs, CloudTrail logs, and GuardDuty findings, providing a visual investigation of the incident, including identifying the affected EC2 instances and the source of the traffic. This is the most efficient approach compared to manually querying logs with Athena (Option D), which would require writing SQL queries and interpreting raw data. Option A (AWS Config) is for tracking configuration changes, not network traffic.

Option C (Amazon Inspector) is for vulnerability scanning, not network behavior analysis.

Practice this question →
41
MCQhard

A company has a multi-account AWS environment using AWS Organizations. The security team wants to centralize all CloudTrail logs from all accounts into a single S3 bucket in the management account. They have enabled CloudTrail in the management account with an organization trail that delivers logs to an S3 bucket. However, logs from member accounts are not appearing. The S3 bucket policy includes permissions for CloudTrail to write logs, but it does not explicitly grant access to member accounts. What should the team do to ensure that member account CloudTrail logs are delivered to the central S3 bucket?

A.Ask each member account to create a new trail that delivers logs to the same S3 bucket.
B.Disable the organization trail and recreate it, ensuring that all member accounts are selected.
C.Verify that the organization trail is configured correctly with the 'Include all accounts in my organization' option enabled, and that the S3 bucket policy allows CloudTrail to write from all accounts.
D.Modify the S3 bucket policy to grant write access to the CloudTrail service principal for each member account's AWS account ID.
AnswerC

An organization trail requires proper configuration and bucket policy to allow access from member account CloudTrail services.

Why this answer

An organization trail automatically delivers logs from all accounts without needing separate trails in each account. If logs are not appearing, the issue is likely that the organization trail is not properly configured or member accounts are not enabled. Option A is incorrect because member trails cannot write to a bucket in another account without proper cross-account permissions, and this approach is not recommended.

Option B is incorrect because disabling and re-enabling might not fix the underlying issue. Option D is incorrect because the bucket policy must allow CloudTrail from all accounts, but the primary cause is often the organization trail setup.

Practice this question →
42
Multi-Selectmedium

Which TWO of the following are valid sources for Amazon CloudWatch Logs? (Select TWO.)

Select 2 answers
A.Amazon RDS for MySQL logs
B.VPC Flow Logs delivered to S3
C.Amazon S3 access logs
D.On-premises servers via the CloudWatch agent
E.AWS CloudTrail log file delivery
AnswersD, E

The CloudWatch agent can send logs from on-premises to CloudWatch Logs.

Why this answer

On-premises servers can send logs to Amazon CloudWatch Logs by installing and configuring the CloudWatch agent. The agent collects system and application logs from the server and forwards them to CloudWatch Logs for centralized monitoring, alerting, and storage. This is a valid and common hybrid monitoring pattern.

Exam trap

The trap here is that candidates often assume all AWS service logs (like RDS logs, S3 access logs, or VPC Flow Logs) are automatically sent to CloudWatch Logs, when in fact many require explicit configuration or are delivered to S3 by default, requiring additional steps to ingest into CloudWatch Logs.

Practice this question →
43
MCQmedium

A company uses Amazon GuardDuty for threat detection. The security team wants to automatically isolate an EC2 instance that is communicating with a known malicious IP address. Which combination of services should be used?

A.GuardDuty -> AWS Config -> Lambda -> modify security group
B.GuardDuty -> CloudWatch Alarm -> Lambda -> modify security group
C.GuardDuty -> EventBridge -> Lambda -> modify security group
D.GuardDuty -> AWS Shield -> modify security group
E.GuardDuty -> AWS Systems Manager -> modify security group
AnswerC

EventBridge can receive GuardDuty findings and trigger Lambda.

Why this answer

Amazon GuardDuty generates findings that can be sent to Amazon EventBridge as events. EventBridge can then trigger an AWS Lambda function that modifies the security group associated with the EC2 instance to deny traffic to/from the malicious IP address. This architecture provides a serverless, event-driven response mechanism without polling or additional services.

Exam trap

The trap here is that candidates confuse CloudWatch Alarms with EventBridge, not realizing that GuardDuty findings are event-driven and require a rule-based event bus (EventBridge) rather than a metric-based alarm (CloudWatch Alarm) to trigger remediation.

How to eliminate wrong answers

Option A is wrong because AWS Config is a configuration compliance and resource inventory service, not an event-driven trigger for real-time threat response; it cannot directly forward GuardDuty findings to Lambda. Option B is wrong because CloudWatch Alarms are designed for metric-based thresholds (e.g., CPU utilization), not for receiving structured JSON findings from GuardDuty; GuardDuty does not natively publish to CloudWatch Alarms. Option D is wrong because AWS Shield is a DDoS protection service and does not process GuardDuty findings or modify security groups.

Option E is wrong because AWS Systems Manager is an operations management service for patching and automation, not designed to consume GuardDuty findings in real time for security group modifications.

Practice this question →
44
MCQmedium

Refer to the exhibit. A security engineer created this S3 bucket policy to allow CloudTrail to deliver logs. However, log delivery is failing. What is the most likely cause?

A.The bucket is not in the same region as the trail
B.The bucket policy does not specify a condition
C.The bucket is encrypted with SSE-KMS
D.The bucket policy does not allow s3:GetBucketAcl
AnswerD

CloudTrail needs GetBucketAcl to verify bucket ownership.

Why this answer

CloudTrail requires the S3 bucket policy to grant the `s3:GetBucketAcl` permission to the CloudTrail service principal (`cloudtrail.amazonaws.com`) so that it can verify the bucket's ACL before delivering logs. Without this permission, CloudTrail cannot confirm it has write access, causing log delivery to fail. The missing `s3:GetBucketAcl` action is the most likely cause because the policy must explicitly allow both `s3:PutObject` and `s3:GetBucketAcl` for the service to function.

Exam trap

The trap here is that candidates often focus on encryption (SSE-KMS) or region mismatches as common failure points, but AWS specifically tests the requirement for `s3:GetBucketAcl` in CloudTrail bucket policies, which is a less intuitive but mandatory permission for the service to validate access.

How to eliminate wrong answers

Option A is wrong because CloudTrail can deliver logs to a bucket in a different region as long as the bucket policy allows cross-region access and the trail is configured accordingly; region mismatch does not inherently cause failure. Option B is wrong because conditions are optional in S3 bucket policies for CloudTrail; the policy can work without a condition block if the principal and actions are correctly specified. Option C is wrong because SSE-KMS encryption is supported by CloudTrail, provided the bucket policy includes the necessary `kms:Decrypt` and `kms:GenerateDataKey` permissions for the CloudTrail principal; encryption alone does not block log delivery.

Practice this question →
45
MCQmedium

A company is using AWS Organizations with multiple accounts. The security team needs to centrally monitor all root user API activity across all accounts and receive alerts within minutes. What is the MOST efficient solution?

A.Create an organization trail in CloudTrail that logs all accounts. Use CloudWatch Logs metric filters and alarms to detect root login events.
B.Enable CloudTrail in each account and aggregate logs to a centralized S3 bucket. Use Athena queries to detect root activity and send alerts via SNS.
C.Use AWS Lambda functions in each account to poll CloudTrail logs and send root activity to a central SQS queue.
D.Enable AWS Config rules in each account to detect root user activity and send notifications to a central SNS topic.
AnswerA

An organization trail logs all accounts centrally. CloudWatch Logs metric filters can detect root activity and trigger alarms in near real-time.

Why this answer

An organization trail in AWS CloudTrail logs API activity for all accounts in AWS Organizations from a single point, eliminating the need to manage per-account trails. By sending these logs to CloudWatch Logs, you can create metric filters to detect root user login events (e.g., the 'RootLogin' event) and configure CloudWatch Alarms to trigger SNS notifications within minutes, meeting the requirement for centralized monitoring and rapid alerts.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing per-account setups (B, C, D) instead of leveraging the native AWS Organizations integration with CloudTrail, which provides a single, centralized trail for all accounts.

How to eliminate wrong answers

Option B is wrong because while aggregating logs to a centralized S3 bucket is possible, using Athena queries to detect root activity is not efficient for real-time alerts within minutes; Athena is designed for ad-hoc querying of historical data, not for streaming or low-latency alerting. Option C is wrong because using Lambda functions in each account to poll CloudTrail logs introduces unnecessary complexity, latency, and cost; CloudTrail can deliver logs directly to CloudWatch Logs without polling, and a centralized solution is more efficient. Option D is wrong because AWS Config rules are designed for evaluating resource configurations against desired policies, not for monitoring API activity like root user logins; Config does not natively capture CloudTrail events and cannot provide real-time alerts for root API activity.

Practice this question →
46
MCQhard

A company uses AWS CloudTrail to log all API activity and delivers logs to an S3 bucket with server-side encryption (SSE-S3). The security team needs to ensure that only authorized personnel can access the logs and that any unauthorized access attempts are logged and alerted. Additionally, the team wants to prevent the logs from being deleted for at least one year. Which combination of actions should be taken?

A.Enable S3 Object Lock with a retention period of one year; enable S3 server access logs; use a bucket policy with a condition that allows access only from authorized IAM roles or users.
B.Enable S3 default encryption (SSE-S3) on the bucket; enable S3 server access logs; attach an IAM policy that allows only authorized users to access the bucket.
C.Enable MFA Delete on the bucket; enable CloudTrail log file validation; use bucket ACLs to restrict access.
D.Enable S3 Inventory to track objects; enable CloudTrail to log S3 API calls; use a bucket policy with a deny effect for unauthorized users.
AnswerA

Object Lock prevents deletion; server access logs record all requests; bucket policy with conditions restricts access.

Why this answer

S3 Object Lock with a retention period of one year enforces a write-once-read-many (WORM) model, preventing any deletion or overwrite of log objects for that duration. S3 server access logs capture detailed records of all requests made to the bucket, including unauthorized access attempts, which can be used for alerting. The bucket policy with a condition restricting access to authorized IAM roles or users ensures that only permitted principals can access the logs, meeting the security team's requirements for access control, logging of unauthorized attempts, and deletion prevention.

Exam trap

The trap here is that candidates often confuse S3 default encryption with data retention controls, or assume that CloudTrail logging of S3 API calls is sufficient to capture unauthorized access attempts, when in fact S3 server access logs are needed for request-level logging of denied operations.

How to eliminate wrong answers

Option B is wrong because enabling S3 default encryption (SSE-S3) only encrypts data at rest but does not prevent deletion of logs; it lacks a retention mechanism like Object Lock. Option C is wrong because MFA Delete protects against accidental deletion but does not enforce a minimum retention period (it can be bypassed by an authorized user with MFA), and bucket ACLs are deprecated and less granular than bucket policies for access control. Option D is wrong because S3 Inventory only provides a list of objects and their metadata, not real-time logging of access attempts; CloudTrail logs S3 API calls but does not log unauthorized access attempts at the S3 request level (e.g., denied GET requests), and a bucket policy with a deny effect for unauthorized users does not inherently log those attempts or prevent deletion.

Practice this question →
47
MCQeasy

A security team needs to detect unauthorized attempts to access an S3 bucket that contains sensitive data. Which AWS service can automatically analyze S3 access logs and generate findings for suspicious activity?

A.Amazon Macie
B.Amazon GuardDuty
C.AWS Trusted Advisor
D.Amazon Detective
AnswerB

GuardDuty analyzes S3 data events for suspicious activity.

Why this answer

Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads. It can analyze VPC Flow Logs, AWS CloudTrail event logs, and DNS logs, and when S3 access logging is enabled, GuardDuty can ingest those logs to detect suspicious S3 access patterns, such as anomalous data exfiltration or access from unusual geographies. GuardDuty then generates security findings that can be automated for remediation.

Exam trap

The trap here is that candidates often confuse Amazon Macie's data classification and sensitive data discovery capabilities with GuardDuty's threat detection, mistakenly thinking Macie can analyze access logs for unauthorized activity, when in fact Macie focuses on data content and access control policies, not real-time log-based threat detection.

How to eliminate wrong answers

Option A is wrong because Amazon Macie is a data security and data privacy service that uses machine learning to discover, classify, and protect sensitive data in S3, but it does not automatically analyze S3 access logs for unauthorized access attempts or generate findings for suspicious activity; it focuses on data classification and access control monitoring via its own findings, not log-based threat detection. Option C is wrong because AWS Trusted Advisor is an advisory service that inspects your AWS environment and makes recommendations for cost optimization, performance, security, and fault tolerance, but it does not perform real-time log analysis or generate findings for suspicious S3 access activity. Option D is wrong because Amazon Detective is a security investigation service that helps analyze and visualize security data to identify the root cause of findings, but it does not automatically analyze S3 access logs to generate findings for suspicious activity; it relies on existing findings from services like GuardDuty to perform its analysis.

Practice this question →
48
MCQhard

A company uses AWS Organizations to manage multiple accounts. The security team needs to implement a centralized logging solution where all VPC Flow Logs from all accounts are sent to a central S3 bucket in the security account. The flow logs must be encrypted with a customer-managed KMS key (CMK) that is owned by the security account. The security engineer has enabled VPC Flow Logs in each account and configured the destination to be the central S3 bucket. However, the flow logs are not being delivered. The engineer checks the S3 bucket policy and confirms that it grants the required permissions to the Flow Logs service principal. What is the MOST likely cause of the failure?

A.The VPC Flow Logs service does not support cross-account delivery.
B.The KMS key policy does not grant the Flow Logs service principal permission to use the key.
C.CloudTrail must be enabled in the source account for Flow Logs to work.
D.The S3 bucket policy is missing a condition for source account.
AnswerB

The key policy must allow the service principal to encrypt.

Why this answer

The KMS key policy must grant the VPC Flow Logs service principal (flow-logs.amazonaws.com) permission to use the customer-managed key for encryption. The engineer verified the S3 bucket policy, so the missing KMS key policy is the most likely cause. Option A is incorrect because VPC Flow Logs can deliver to cross-account S3 buckets.

Option C is incorrect because CloudTrail is not required for Flow Logs. Option D is incorrect because the S3 bucket policy already grants permissions to the Flow Logs service principal.

Practice this question →
49
MCQhard

Refer to the exhibit. A security engineer is reviewing an IAM policy attached to a user. The policy is intended to allow the user to get and put objects in the S3 bucket 'example-bucket' only from the IP range 203.0.113.0/24. However, the user reports that they are unable to put objects from an IP within that range. What is the most likely cause of this issue?

A.The condition key should be 'aws:sourceIp' (lowercase 's').
B.The policy should use the 'NotIpAddress' condition operator instead of 'IpAddress'.
C.The resource ARN should be 'arn:aws:s3:::example-bucket' without the '/*' suffix.
D.The policy lacks a separate statement to allow 's3:ListBucket' on the bucket resource.
AnswerD

For console access, ListBucket is required; without it, the user cannot see the bucket but can still perform PutObject via API. However, the question implies inability to put objects, which could be due to missing ListBucket in some SDK scenarios.

Why this answer

The policy only grants s3:GetObject and s3:PutObject actions on the bucket's objects (arn:aws:s3:::example-bucket/*), but does not include a separate statement allowing s3:ListBucket on the bucket resource (arn:aws:s3:::example-bucket). Without s3:ListBucket, the user cannot list the bucket's contents, which is often required by the AWS CLI or SDK to resolve object keys before performing put operations. The IP condition is correctly applied, so the issue is the missing list permission.

Exam trap

The trap here is that candidates focus on the IP condition syntax or resource ARN format and overlook the common requirement for an explicit s3:ListBucket permission when performing object operations via the AWS CLI or SDK.

How to eliminate wrong answers

Option A is wrong because 'aws:sourceIp' is the correct case-sensitive condition key; AWS condition keys are case-sensitive and 'aws:sourceIp' is valid. Option B is wrong because using 'NotIpAddress' would deny access from the specified range and allow all others, which is the opposite of the intended effect. Option C is wrong because the resource ARN 'arn:aws:s3:::example-bucket/*' is correct for object-level actions (GetObject, PutObject); the bucket-level ARN without '/*' is used for bucket-level actions like ListBucket, not for object operations.

Practice this question →
50
MCQhard

A company uses AWS Config to track resource changes. They notice that a weekly compliance report shows an S3 bucket as non-compliant with a rule that checks for server-side encryption. However, the bucket has default encryption enabled. What is the MOST likely reason for this discrepancy?

A.The Config rule checks for SSE on objects, not default bucket encryption.
B.The Config rule was deleted and recreated without re-evaluating existing resources.
C.The Config rule is only evaluating resources in a single AWS Region.
D.The S3 bucket is not tagged with a required tag for the Config rule.
AnswerA

The rule 's3-bucket-server-side-encryption-enabled' checks if the bucket policy requires encryption, not default encryption. Default encryption does not enforce encryption on uploads.

Why this answer

The AWS Config managed rule `s3-bucket-server-side-encryption-enabled` specifically checks whether the bucket policy enforces server-side encryption on objects uploaded to the bucket, not whether the bucket has default encryption configured. Default encryption only applies to objects that do not have an encryption setting at the time of upload, but the rule evaluates the bucket's policy for a condition that requires SSE for all PUT requests. Therefore, a bucket with default encryption enabled but without a policy enforcing SSE will be reported as non-compliant.

Exam trap

The trap here is that candidates confuse default bucket encryption with server-side encryption enforcement, assuming that enabling default encryption automatically satisfies the Config rule, when in fact the rule requires a bucket policy to deny unencrypted uploads.

How to eliminate wrong answers

Option B is wrong because deleting and recreating a Config rule without re-evaluating existing resources would cause the rule to evaluate only new resources, but the bucket would still be evaluated if it existed before the recreation; the discrepancy is not due to a missing re-evaluation. Option C is wrong because S3 is a global service, and AWS Config rules for S3 buckets evaluate resources across all regions by default; the rule is not limited to a single region unless explicitly scoped. Option D is wrong because the `s3-bucket-server-side-encryption-enabled` rule does not require any specific tags; it checks for encryption enforcement, not tagging.

Practice this question →
51
Multi-Selectmedium

A security engineer needs to capture all network traffic between EC2 instances in a VPC for forensic analysis. Which TWO services should be used together? (Choose TWO.)

Select 2 answers
A.Amazon VPC Flow Logs
B.AWS CloudTrail
C.AWS Config
D.Amazon Athena
E.Amazon GuardDuty
AnswersA, D

Captures network traffic metadata.

Why this answer

Amazon VPC Flow Logs capture IP traffic information for network interfaces in a VPC, including metadata such as source/destination IPs, ports, protocols, and packet accept/reject decisions. To perform forensic analysis on this raw flow log data, you can use Amazon Athena to query the logs directly from S3 using standard SQL, enabling efficient filtering and pattern detection across large volumes of network traffic.

Exam trap

The trap here is that candidates often confuse VPC Flow Logs (network metadata) with AWS CloudTrail (API activity) or GuardDuty (threat detection), failing to recognize that forensic analysis of raw traffic requires both a capture mechanism and a query engine like Athena.

Practice this question →
52
MCQhard

A company has a multi-account AWS environment using AWS Organizations. The security team wants to centralize all CloudTrail logs from all accounts into a single S3 bucket in the management account. The bucket policy allows cross-account access. However, logs from member accounts are not being delivered. What is the most likely cause?

A.CloudTrail cannot deliver logs to a bucket in a different account.
B.The S3 bucket is not configured with a CloudTrail prefix.
C.CloudTrail is not enabled in the member accounts.
D.The S3 bucket policy does not grant `s3:PutObject` permission to the member accounts.
AnswerD

Without this permission, CloudTrail cannot write logs to the bucket.

Why this answer

The S3 bucket policy must explicitly grant the `s3:PutObject` permission to the IAM roles or users from the member accounts that CloudTrail uses to deliver logs. Without this permission, CloudTrail in the member accounts cannot write log files to the central bucket, even if the bucket is configured for cross-account access. The bucket policy must also include a condition that the object ownership is set to the bucket owner (via `s3:x-amz-acl: bucket-owner-full-control`) to ensure the management account retains control.

Exam trap

The trap here is that candidates often assume CloudTrail cannot deliver across accounts (Option A) or that a missing prefix (Option B) is the issue, when in fact the root cause is almost always an insufficiently permissive S3 bucket policy that does not grant `s3:PutObject` to the member accounts' CloudTrail roles.

How to eliminate wrong answers

Option A is wrong because CloudTrail can deliver logs to an S3 bucket in a different account when the bucket policy grants the necessary cross-account permissions; this is a standard multi-account logging pattern. Option B is wrong because a CloudTrail prefix is optional and used for organizing logs within a bucket, not for enabling cross-account log delivery; its absence does not prevent log delivery. Option C is wrong because the question states that logs from member accounts are not being delivered, which implies CloudTrail is enabled in those accounts but the delivery is failing due to a permissions issue, not because CloudTrail is disabled.

Practice this question →
53
MCQhard

A security engineer is troubleshooting an issue where CloudTrail logs for a single AWS account are not being delivered to the centralized S3 bucket in the logging account. The engineer has verified that the CloudTrail trail is enabled, the S3 bucket policy allows CloudTrail to write, and the bucket exists. However, no log files have been delivered for the past 6 hours. The engineer checks the CloudTrail console and sees that the trail status shows 'Logging' but the latest log file time is from 8 hours ago. The engineer suspects a permission issue but cannot find any explicit deny in the bucket policy. What is the MOST likely cause of this issue?

A.The CloudTrail trail is not configured to deliver to a cross-account bucket.
B.The CloudTrail trail is configured with a role that does not have S3 full access.
C.The S3 bucket is in a different region than the CloudTrail trail.
D.The KMS key policy used by the S3 bucket does not grant CloudTrail permission to use the key.
AnswerD

CloudTrail needs kms:Decrypt permission on the KMS key to write to SSE-KMS encrypted buckets.

Why this answer

The issue is most likely that the KMS key used for server-side encryption of the S3 bucket does not grant CloudTrail the necessary permissions. Even if the bucket policy allows CloudTrail to write, if the S3 bucket uses SSE-KMS encryption, the KMS key policy must include a statement granting kms:Decrypt and kms:GenerateDataKey permissions to the CloudTrail service principal. Without this, CloudTrail cannot encrypt the log files, causing delivery to fail silently.

Option D correctly identifies this as the cause. Option A is incorrect because the trail is configured for cross-account delivery (logging account). Option B is incorrect because CloudTrail does not need S3 full access; write access to the bucket is sufficient.

Option C is incorrect because cross-region delivery is not required; CloudTrail can deliver to buckets in any region.

Practice this question →
54
Multi-Selecthard

A company has enabled Amazon GuardDuty in multiple AWS accounts. The security team wants to centralize GuardDuty findings into a single account for analysis. Which THREE steps are required to achieve this? (Choose THREE.)

Select 3 answers
A.Configure CloudWatch Logs cross-account subscription to aggregate findings.
B.Create an EventBridge rule to forward findings to the master account.
C.Invite member accounts to join the GuardDuty master account.
D.Accept the invitation in each member account.
E.Designate one account as the GuardDuty master account.
AnswersC, D, E

Invitation process.

Why this answer

In Amazon GuardDuty, to centralize findings from multiple accounts, you must designate a master account and then invite member accounts to join. The invitation process establishes a trusted relationship where the master account can aggregate and analyze findings from all member accounts. Without this step, the master account cannot receive findings from other accounts.

Exam trap

The trap here is that candidates often confuse the GuardDuty multi-account setup with other cross-account aggregation methods (like CloudWatch Logs subscription filters or EventBridge cross-account rules), but GuardDuty has its own built-in master-member mechanism that does not require those services.

Practice this question →
55
MCQeasy

A company wants to monitor for unauthorized changes to its Amazon S3 bucket policies. Which AWS service should be used to detect such changes?

A.AWS Config
B.AWS CloudTrail
C.Amazon GuardDuty
D.Amazon CloudWatch Logs Insights
AnswerA

AWS Config can evaluate resource configurations against rules, including S3 bucket policies.

Why this answer

AWS Config provides managed rules such as 's3-bucket-policy-not-more-permissive' that can evaluate S3 bucket policies for unauthorized changes. Option B is incorrect because AWS CloudTrail logs API calls but does not proactively evaluate policy compliance. Option C is incorrect because Amazon GuardDuty detects malicious activity but not policy changes.

Option D is incorrect because Amazon CloudWatch Logs Insights can query log data but is not designed for proactive monitoring of policy changes.

Practice this question →
56
MCQeasy

A security engineer needs to monitor for suspicious API calls in near real-time and trigger an automated response. Which AWS service should be used to capture and analyze these API calls?

A.AWS CloudHSM
B.Amazon GuardDuty
C.AWS CloudTrail
D.AWS Config
AnswerC

AWS CloudTrail records API calls for audit and can be integrated with CloudWatch Logs for near real-time monitoring.

Why this answer

AWS CloudTrail is the correct service because it captures all API calls made to the AWS environment, including those from the AWS Management Console, SDKs, CLI, and AWS services. By enabling CloudTrail Insights or using CloudWatch Events with CloudTrail logs, you can monitor for suspicious API calls in near real-time and trigger automated responses via Lambda functions or SNS notifications.

Exam trap

The trap here is that candidates confuse GuardDuty's threat detection capabilities with the actual capture of API calls, forgetting that GuardDuty consumes CloudTrail logs rather than generating them, so the service that captures the calls is CloudTrail, not GuardDuty.

How to eliminate wrong answers

Option A is wrong because AWS CloudHSM provides hardware security modules for cryptographic key storage and operations, not for monitoring or analyzing API calls. Option B is wrong because Amazon GuardDuty is a threat detection service that analyzes VPC Flow Logs, DNS logs, and CloudTrail events for malicious activity, but it does not natively capture API calls itself—it relies on CloudTrail as a data source, and the question asks for the service that captures and analyzes the calls, not just analyzes them. Option D is wrong because AWS Config evaluates resource configurations against desired policies and tracks configuration changes, but it does not capture or analyze API calls; it focuses on resource state, not the API actions that led to that state.

Practice this question →
57
MCQmedium

A security team wants to detect and alert when an EC2 instance is terminated. They have enabled CloudTrail and are sending logs to CloudWatch Logs. Which combination of services should they use to achieve this with minimal latency?

A.CloudWatch Logs metric filter and CloudWatch alarm
B.AWS Config and AWS Lambda
C.Amazon CloudWatch Events (EventBridge) and Amazon SNS
D.Amazon GuardDuty and Amazon SNS
AnswerC

EventBridge provides near real-time event matching.

Why this answer

Amazon CloudWatch Events (EventBridge) can monitor EC2 instance state changes in real-time and trigger an SNS notification with minimal latency. Option A is wrong because metric filters and alarms from CloudWatch Logs introduce latency due to log ingestion and processing. Option B is wrong because AWS Config evaluates changes periodically (not real-time).

Option D is wrong because GuardDuty focuses on security threats, not instance state changes.

Practice this question →
58
MCQmedium

Refer to the exhibit. A security engineer configured this S3 bucket policy for CloudTrail, but CloudTrail logs are not being delivered. What is the MOST likely missing permission?

A.Missing s3:GetBucketAcl permission.
B.The condition StringEquals should be StringLike.
C.Missing s3:PutObject permission for the bucket.
D.The bucket ARN is incorrect.
AnswerC

CloudTrail also requires s3:PutObject on the bucket ARN to write log files, not just the prefix.

Why this answer

CloudTrail requires that the S3 bucket policy grants the s3:PutObject permission to the CloudTrail service principal to write log files. The exhibit shows a bucket policy that grants s3:GetBucketAcl but is missing a statement that allows s3:PutObject on the bucket (or on the appropriate log prefix). Without s3:PutObject, CloudTrail cannot deliver log files to the bucket.

Therefore, the most likely missing permission is s3:PutObject for the bucket, making option C correct.

Practice this question →
59
Multi-Selectmedium

Which TWO actions should a security engineer take to ensure that Amazon GuardDuty can effectively monitor for suspicious activity in a VPC? (Choose two.)

Select 2 answers
A.Enable DNS query logging and publish to CloudWatch Logs.
B.Enable VPC Flow Logs and publish to CloudWatch Logs.
C.Enable CloudTrail data events for S3.
D.Enable S3 server access logs.
E.Enable AWS Config configuration history.
AnswersA, B

GuardDuty uses DNS logs for domain-based threat detection.

Why this answer

Amazon GuardDuty relies on DNS query logs to detect suspicious domain name resolution patterns, such as DNS tunneling or communication with known malicious domains. By enabling DNS query logging and publishing to CloudWatch Logs, GuardDuty can ingest this data as a source for its threat detection algorithms. Without DNS logs, GuardDuty cannot analyze DNS-based attack vectors within the VPC.

Exam trap

The trap here is that candidates often think enabling CloudTrail or S3 logs is sufficient for VPC monitoring, but GuardDuty specifically requires VPC Flow Logs and DNS query logs as its primary network-based data sources for detecting suspicious VPC activity.

Practice this question →
60
MCQeasy

A company wants to monitor failed SSH login attempts to its EC2 instances. Which AWS service should be used to collect and analyze these logs?

A.VPC Flow Logs
B.Amazon CloudWatch Logs with the unified CloudWatch agent
C.AWS CloudTrail
D.AWS Config
AnswerB

The CloudWatch agent can collect OS logs and deliver them to CloudWatch Logs for analysis.

Why this answer

Amazon CloudWatch Logs with the unified CloudWatch agent is the correct choice because the agent can be configured to collect and forward system log files, such as /var/log/secure (Amazon Linux) or /var/log/auth.log (Ubuntu), which record SSH authentication attempts including failures. This allows centralized monitoring and analysis of failed SSH logins via CloudWatch Logs Insights or metric filters.

Exam trap

The trap here is that candidates confuse VPC Flow Logs (network-level) with OS-level logs, or assume CloudTrail captures all activity including guest OS events, when in fact CloudTrail only records AWS API calls, not in-OS authentication logs.

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs capture metadata about network traffic (IP addresses, ports, protocols) but do not log application-level events like SSH authentication failures. Option C is wrong because AWS CloudTrail records API calls made to the AWS control plane (e.g., EC2 RunInstances) but does not capture guest OS-level logs such as SSH login attempts. Option D is wrong because AWS Config tracks resource configuration changes and compliance, not operating system log events.

Practice this question →
61
MCQmedium

Refer to the exhibit. A CloudWatch Logs metric filter is configured. Which log event will trigger the filter to create a metric?

A."2023-01-01 12:00:00 ERROR Connection refused"
B."ERROR: Connection refused"
C."2023-01-01 12:00:00 WARNING Disk full"
D."2023-01-01 12:00:00 INFO Starting process"
AnswerB

This log event starts with 'ERROR:', which matches the metric filter pattern exactly, triggering the metric.

Why this answer

The metric filter pattern is configured to match log events that begin with the string 'ERROR:'. Option B starts with 'ERROR:', so it triggers the metric filter. Options A, C, and D start with a timestamp and do not match the pattern.

Exam trap

The trap is that the filter pattern may appear to require multiple tokens or a specific format, but in reality it can be a simple string match. Many candidates overthink the pattern syntax and fail to recognize that a single term can be a valid filter pattern.

Practice this question →
62
MCQmedium

A security engineer notices that an S3 bucket containing sensitive logs is publicly accessible. Which service should be used to automatically remediate this by applying a bucket policy?

A.AWS Config
B.Amazon GuardDuty
C.AWS Trusted Advisor
D.AWS CloudTrail
AnswerA

AWS Config can evaluate rules and trigger automatic remediation actions.

Why this answer

AWS Config is the correct service because it can continuously monitor S3 bucket configurations and automatically remediate non-compliant resources using AWS Config Rules and AWS Systems Manager Automation documents. When a rule detects that an S3 bucket is publicly accessible, it can trigger an automatic remediation action, such as applying a bucket policy that denies all public access, without manual intervention.

Exam trap

The trap here is that candidates often confuse AWS Config's monitoring and remediation capabilities with GuardDuty's threat detection or Trusted Advisor's advisory checks, failing to recognize that only AWS Config supports automated, rule-based remediation actions.

How to eliminate wrong answers

Option B is wrong because Amazon GuardDuty is a threat detection service that analyzes VPC flow logs, DNS logs, and CloudTrail events to identify malicious activity, but it cannot automatically remediate S3 bucket policies. Option C is wrong because AWS Trusted Advisor provides best-practice recommendations and security checks, including S3 bucket permissions, but it does not have native automated remediation capabilities; it only generates alerts. Option D is wrong because AWS CloudTrail is a logging service that records API calls for auditing and does not have the ability to apply or modify bucket policies automatically.

Practice this question →
63
MCQeasy

A company wants to ensure that all API calls made to their AWS account are logged and immutable. They have enabled AWS CloudTrail and are delivering logs to an S3 bucket. The security team requires that logs cannot be deleted or modified by anyone, including the root user. What should they do?

A.Enable S3 Object Lock with Compliance retention mode on the bucket.
B.Enable MFA Delete on the S3 bucket.
C.Enable S3 Versioning on the bucket.
D.Add a bucket policy that denies s3:DeleteObject for all principals.
AnswerA

Compliance mode prevents any deletion even by root.

Why this answer

S3 Object Lock with retention mode Compliance prevents any user, including root, from deleting or overwriting objects. Option B is wrong because MFA Delete prevents deletion but requires additional authentication and can be disabled by root if they have MFA. Option C is wrong because versioning alone does not prevent deletion of versions; objects can still be deleted, though old versions are retained.

Option D is wrong because bucket policies can be changed by root, so a deny policy is not immutable.

Practice this question →
64
Multi-Selecthard

A security engineer is designing a centralized logging solution for 10 AWS accounts. Which THREE AWS services should be used to aggregate, store, and analyze logs?

Select 3 answers
A.Amazon Kinesis Data Streams
B.AWS Organizations
C.Amazon Athena
D.Amazon CloudWatch Logs
E.Amazon S3
AnswersB, C, E

Organizations helps manage multiple accounts centrally.

Why this answer

AWS Organizations is correct because it provides a centralized management structure for multiple AWS accounts, enabling you to automatically enforce policies and aggregate logs from all member accounts into a central S3 bucket. Amazon S3 is the recommended service for storing large volumes of logs durably and cost-effectively. Amazon Athena enables you to run ad-hoc SQL queries directly on the logs stored in S3, providing a serverless analytics solution for log analysis without the need for complex ETL or infrastructure management.

Together, these three services form a complete solution: Organizations for aggregation, S3 for storage, and Athena for analysis.

Exam trap

The trap here is that candidates often select Amazon Kinesis Data Streams or Amazon CloudWatch Logs as the primary aggregation and storage service, overlooking that AWS Organizations is required to centrally manage log delivery from multiple accounts, and that S3 plus Athena provides the most scalable and cost-effective solution for long-term storage and ad-hoc analysis.

Practice this question →
65
MCQmedium

An organization wants to detect and alert on any IAM user that creates a new access key without using multi-factor authentication (MFA). What is the MOST efficient way to achieve this?

A.Create a CloudWatch Events rule that triggers on CreateAccessKey events, and check if the user's MFA status is inactive.
B.Analyze S3 server access logs to detect access key creation.
C.Enable AWS Config managed rule for IAM user MFA, which monitors if users have MFA enabled.
D.Use IAM Access Analyzer to monitor for unused access keys.
AnswerA

CloudTrail logs the event and CloudWatch Events can evaluate conditions in real time.

Why this answer

CloudWatch Events (now Amazon EventBridge) can capture the CreateAccessKey API call in real time, and a Lambda target can check the IAM user's MFA status via the GetLoginProfile or ListMFADevices API. This provides immediate detection and alerting without polling or log analysis, making it the most efficient approach for this specific requirement.

Exam trap

The trap here is that candidates confuse the AWS Config rule for 'IAM user MFA' (which only checks if MFA is enabled on the user account) with the ability to detect MFA usage during a specific API call, leading them to select Option C.

How to eliminate wrong answers

Option B is wrong because S3 server access logs are not designed to capture IAM API events like CreateAccessKey; they log object-level access to S3 buckets, not IAM user actions. Option C is wrong because the AWS Config managed rule for IAM user MFA only checks whether MFA is enabled on the user account at the time of evaluation, not whether MFA was used during a specific access key creation event. Option D is wrong because IAM Access Analyzer focuses on analyzing resource policies for unintended access, not on monitoring access key creation events or MFA usage.

Practice this question →
66
MCQeasy

A company wants to centrally collect and analyze logs from multiple AWS accounts. Which AWS service should be used to aggregate logs from various sources for monitoring and alerting?

A.Amazon S3
B.AWS Config
C.AWS CloudTrail
D.Amazon CloudWatch Logs
AnswerD

CloudWatch Logs can aggregate logs from multiple sources and accounts.

Why this answer

Amazon CloudWatch Logs is the correct service because it provides a centralized platform for collecting, monitoring, and analyzing log data from multiple AWS accounts and on-premises sources. It supports cross-account log aggregation via subscription filters and cross-account destinations, enabling real-time monitoring and alerting through CloudWatch Logs Insights and metric filters. This makes it the appropriate choice for the stated requirement of central log aggregation for monitoring and alerting.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which records API calls) with a log aggregation service, but CloudTrail is a log source, not a centralized aggregation and analysis platform like CloudWatch Logs.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service, not a log aggregation and analysis service; while logs can be stored in S3, it lacks native real-time monitoring, alerting, and query capabilities required for centralized analysis. Option B is wrong because AWS Config is a service for evaluating and auditing resource configurations against desired policies, not for collecting and analyzing logs from multiple sources. Option C is wrong because AWS CloudTrail is specifically designed to record API activity within an AWS account, but it does not aggregate logs from other services or accounts for centralized monitoring and alerting; it is a source of logs, not an aggregation platform.

Practice this question →
67
MCQeasy

A security engineer needs to monitor for unauthorized changes to security group rules in an AWS account. The engineer wants to receive real-time notifications when a security group rule is added, modified, or removed. Which AWS service should the engineer use to capture these API calls?

A.Amazon GuardDuty
B.AWS CloudTrail
C.VPC Flow Logs
D.AWS Config
AnswerB

CloudTrail records all API calls, including security group modifications.

Why this answer

AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including EC2 APIs such as AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, AuthorizeSecurityGroupEgress, RevokeSecurityGroupEgress, CreateSecurityGroup, and DeleteSecurityGroup. By enabling CloudTrail trail with management events and optionally data events for EC2, the security engineer can capture these API calls in near real-time and stream them to Amazon CloudWatch Logs or Amazon EventBridge to trigger notifications for unauthorized changes to security group rules.

Exam trap

The trap here is that candidates often confuse AWS Config's ability to detect configuration changes (like security group rule drift) with the real-time API call capture requirement, but AWS Config relies on CloudTrail for change notifications and has inherent latency, whereas CloudTrail directly captures the API call at the moment it occurs.

How to eliminate wrong answers

Option A is wrong because Amazon GuardDuty is a threat detection service that analyzes VPC Flow Logs, DNS logs, and CloudTrail management events for malicious activity, but it does not directly capture or provide real-time notifications for specific API calls like security group rule changes. Option C is wrong because VPC Flow Logs capture metadata about network traffic (IP addresses, ports, protocols) at the network interface level, not API calls that modify security group rules. Option D is wrong because AWS Config is a configuration auditing and compliance service that evaluates resource configurations against rules and can detect drift, but it operates on a periodic or event-driven basis (typically minutes delay) and does not capture API calls in real-time; it relies on CloudTrail for change notifications.

Practice this question →
68
MCQeasy

A company uses Amazon GuardDuty to monitor for malicious activity in their AWS account. The security team receives a GuardDuty finding that indicates an EC2 instance is communicating with a known cryptocurrency mining pool. The team needs to investigate the finding and determine which security group rules allowed the outbound traffic. The EC2 instance is in a VPC with a single security group attached. Which AWS service should the security team use to review the outbound traffic details?

A.AWS CloudTrail
B.VPC Flow Logs
C.AWS Config
D.Amazon GuardDuty
AnswerB

VPC Flow Logs record outbound traffic details.

Why this answer

VPC Flow Logs capture network traffic metadata, including outbound connections to external IPs. Option A is wrong because CloudTrail records API calls, not network traffic. Option C is wrong because AWS Config tracks resource configuration changes, not network traffic.

Option D is wrong because GuardDuty provides findings based on threats but does not store detailed traffic logs.

Practice this question →
69
MCQhard

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The security team needs to monitor for unauthorized changes to security groups. They have enabled AWS Config with the security-group-change detection rule. However, they notice that changes are being detected but not all changes trigger a notification. The team wants to ensure that every security group modification (create, delete, or rule change) sends an alert to the security operations center via Amazon SNS. The current setup: AWS Config rules evaluate resources periodically, and SNS notifications are sent only when the rule compliance status changes. What should the team do to achieve real-time alerts for all security group changes?

A.Deploy Amazon GuardDuty and enable the Security Group Monitoring feature.
B.Configure an Amazon EventBridge rule that matches API calls via CloudTrail for security group modifications and sends notifications to an SNS topic.
C.Increase the frequency of AWS Config rule evaluations to every minute to reduce detection latency.
D.Enable VPC Flow Logs and set up a metric filter for security group-related traffic anomalies.
AnswerB

CloudTrail logs all API calls, including security group modifications, in real time. An EventBridge rule can match these events and trigger an SNS notification, ensuring immediate alerts for every change.

Why this answer

CloudTrail logs all API calls, including security group modifications, in real time. By creating an Amazon EventBridge rule that matches SecurityGroup events and targets an SNS topic, the team can receive immediate notifications. Option A is incorrect because GuardDuty focuses on threat detection (e.g., suspicious API activity), not on monitoring all security group configuration changes.

Option C is incorrect because even with frequent evaluations, AWS Config rules evaluate configuration snapshots periodically and do not provide real-time alerting for each change. Option D is incorrect because VPC Flow Logs monitor network traffic, not security group modifications.

Practice this question →
70
MCQhard

A company has a multi-account AWS Organization with 50 accounts. The security team wants to monitor for unauthorized IAM role assumption across all accounts. They have enabled AWS CloudTrail in all accounts and are delivering logs to a central S3 bucket in the security account. They also have Amazon GuardDuty enabled in all accounts. The security team wants a centralized dashboard to visualize cross-account role assumption events. They have limited budget and want to use existing services. What should they do?

A.Use Amazon Athena to query CloudTrail logs in S3 and visualize with Amazon QuickSight.
B.Use AWS Config aggregator to view cross-account IAM role creation.
C.Use Amazon CloudWatch Logs Insights to query logs from the central S3 bucket.
D.Use Amazon Elasticsearch Service to index CloudTrail logs from S3 and visualize with Kibana.
AnswerA

Athena can query logs directly in S3, and QuickSight can create dashboards.

Why this answer

Amazon Athena can query CloudTrail logs stored in S3 using standard SQL, and Amazon QuickSight can create visualizations from Athena query results. This leverages existing services without additional cost for Amazon QuickSight (pay-per-session pricing) and minimal cost for Athena (based on data scanned). Option B is incorrect because AWS Config aggregator provides a view of resource configuration across accounts, not API call analysis.

Option C is incorrect because CloudWatch Logs Insights cannot directly query logs stored in S3; it requires logs to be in CloudWatch Logs. Option D is incorrect because Amazon Elasticsearch Service incurs additional costs and complexity, which the company wants to avoid.

Practice this question →
71
Multi-Selecteasy

A company needs to monitor for unauthorized changes to its Amazon S3 bucket policies. Which TWO services can be used together to achieve this? (Choose two.)

Select 2 answers
A.Amazon Route 53
B.AWS CloudTrail
C.VPC Flow Logs
D.AWS Config
E.Amazon SNS
AnswersD, E

Tracks configuration changes to S3 bucket policies.

Why this answer

AWS Config is correct because it provides continuous monitoring and evaluation of your AWS resource configurations, including S3 bucket policies. You can create AWS Config rules (e.g., s3-bucket-policy-grantee-check) to detect changes to bucket policies and trigger compliance evaluations. When a policy change is detected, AWS Config can invoke an SNS topic to send notifications, enabling real-time alerting for unauthorized modifications.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which logs API calls) with AWS Config (which monitors configuration state), leading them to select CloudTrail instead of Config, even though CloudTrail alone cannot trigger notifications for unauthorized changes without additional services like EventBridge or SNS.

Practice this question →
72
MCQmedium

A company has a requirement to retain CloudTrail logs for 7 years for compliance. The logs are stored in an S3 bucket. The security team needs to ensure that logs are not deleted before the retention period ends, even by users with full S3 permissions. Which action should be taken?

A.Enable MFA Delete on the bucket and require MFA for all delete operations.
B.Enable S3 Object Lock in Compliance mode on the bucket with a retention period of 7 years.
C.Enable S3 Versioning and set a lifecycle policy to expire noncurrent versions after 7 years.
D.Create a bucket policy that denies s3:DeleteObject for all users.
AnswerB

Compliance mode prevents any deletion, even by root.

Why this answer

S3 Object Lock in Compliance mode prevents any user, including the root user, from overwriting or deleting objects until the retention period expires. This meets the requirement to retain CloudTrail logs for 7 years, even against users with full S3 permissions, because Compliance mode cannot be bypassed or removed by any user.

Exam trap

The trap here is that candidates often choose MFA Delete (Option A) because it adds security, but they overlook that MFA Delete does not prevent deletion by authorized users who have MFA devices, whereas Object Lock in Compliance mode provides true immutability against all users.

How to eliminate wrong answers

Option A is wrong because MFA Delete only adds an extra authentication factor for delete operations but does not prevent deletion by users who have MFA credentials, so it cannot guarantee retention against all users. Option C is wrong because versioning with a lifecycle policy only expires noncurrent versions after 7 years, but current versions can still be deleted immediately by users with s3:DeleteObject permission, and lifecycle policies do not prevent direct deletion. Option D is wrong because a bucket policy that denies s3:DeleteObject for all users can be overridden by an explicit allow in an IAM policy or by the root user, and it does not protect against accidental or malicious deletion by users with full permissions who can modify the policy itself.

Practice this question →
73
MCQmedium

A company has a requirement to retain CloudTrail logs for 7 years for compliance. They currently store logs in an S3 bucket with standard storage. The security team wants to minimize storage costs while meeting the retention requirement. The logs must be available for retrieval within 24 hours of a request. Which storage class should the team use for the logs after the first 30 days?

A.S3 Glacier Flexible Retrieval
B.S3 One Zone-IA
C.S3 Standard-IA
D.S3 Glacier Deep Archive
AnswerD

Deep Archive offers lowest cost with retrieval time up to 12 hours, meeting the requirement.

Why this answer

(S3 Glacier Deep Archive) is correct because it offers the lowest storage cost for long-term archival data, with retrieval times of up to 12 hours, which meets the 24-hour retrieval requirement. Option A (S3 Glacier Flexible Retrieval) is more expensive and provides faster retrieval than needed. Option B (S3 One Zone-IA) lacks the durability required for compliance data.

Option C (S3 Standard-IA) is more expensive than Deep Archive and not optimized for long-term archival.

Practice this question →
74
MCQhard

A company has a CloudTrail trail that logs management events for all regions in the management account. They want to also log data events for all S3 buckets in the organization. Which configuration change will meet this requirement with the LEAST operational overhead?

A.Use Amazon EventBridge to capture S3 events and forward them to CloudTrail.
B.Enable S3 server access logs for all buckets and aggregate them using Athena.
C.Create a new trail in each member account to log S3 data events and deliver to a central S3 bucket.
D.Modify the existing trail to add an event selector for S3 data events with a scope of all buckets.
AnswerD

Organization trails can log data events for all S3 buckets across the organization with a single configuration.

Why this answer

CloudTrail trails can be configured with an event selector that includes data events for S3, and setting the scope to 'all buckets' logs data events for every S3 bucket in the account without needing separate configurations. This approach reuses the existing management trail, minimizing operational overhead by avoiding additional trails, services, or aggregation steps.

Exam trap

The trap here is that candidates may think data events require separate trails or external services like EventBridge, but CloudTrail's built-in event selector for S3 data events with an 'all buckets' scope directly meets the requirement with minimal overhead.

How to eliminate wrong answers

Option A is wrong because Amazon EventBridge captures S3 events (e.g., object-level notifications) but does not natively forward them to CloudTrail; CloudTrail ingests S3 data events directly via its own event selectors, not through EventBridge, and using EventBridge would add unnecessary complexity and cost. Option B is wrong because S3 server access logs provide detailed access records but are not CloudTrail data events; they require separate setup per bucket, aggregation via Athena, and do not integrate with CloudTrail's centralized logging, increasing operational overhead. Option C is wrong because creating a new trail in each member account duplicates effort and requires managing multiple trails, whereas CloudTrail can log S3 data events across all accounts in an organization from the management account using a single trail with the appropriate event selector.

Practice this question →
75
MCQmedium

A company uses Amazon GuardDuty in a single AWS account to detect threats. The security team receives an alert that a specific EC2 instance is communicating with a known command and control (C2) server. The security engineer needs to immediately isolate the instance while preserving the root cause evidence. The engineer has access to the AWS Management Console. Which action should the engineer take FIRST?

A.Terminate the instance immediately to stop the communication.
B.Take a snapshot of the EBS volume and then isolate the instance by modifying the security group.
C.Modify the security group to block all outbound traffic.
D.Install the CloudWatch Logs agent on the instance to capture logs.
AnswerB

Snapshot preserves evidence, then isolation stops communication.

Why this answer

The correct first action is to take a snapshot of the EBS volume to preserve root cause evidence, then modify the security group to block all outbound traffic, isolating the instance. Option A is incorrect because terminating the instance destroys volatile evidence and may not capture the current state. Option C is incorrect because modifying the security group without first taking a snapshot could lose critical evidence before isolation.

Option D is incorrect because installing the CloudWatch agent takes time and does not immediately stop communication or isolate the instance.

Practice this question →
Page 1 of 2 · 103 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Security Logging questions.

Start 20-question session