I85PREP
⌘ K
AWS Security Specialty (SCS-C03) study materials
AWS Security Specialty (SCS-C03) study resources

AWS Security Specialty (SCS-C03) practice questions

One question at a time. Build your AWS Security Specialty (SCS-C03) understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Threat Detection and Incident Response

Which AWS service continuously analyzes VPC Flow Logs, AWS CloudTrail event logs, and DNS query logs to detect malicious or unauthorized activity?

  1. Amazon GuardDuty Correct answer.
  2. AWS CloudTrail
  3. Amazon Inspector
  4. AWS Config

Explanation

GuardDuty is a managed threat detection service that ingests independent data sources, including CloudTrail management and data events, VPC Flow Logs, and DNS logs, and applies threat intelligence and anomaly detection to them. It produces findings but does not itself remediate.

Question 2Threat Detection and Incident Response

Which AWS service builds an interactive behavior graph of users, resources, and IP addresses to help investigators analyze security findings?

  1. AWS Security Hub
  2. AWS Shield Advanced
  3. Amazon Detective Correct answer.
  4. Amazon Macie

Explanation

Detective ingests findings and log data and builds a linked behavior graph so analysts can pivot from a finding to related entities and historical activity. It is an investigation service, not a detector or an aggregation layer.

Question 3Threat Detection and Incident Response

Which AWS service uses machine learning and pattern matching to discover and classify sensitive data such as personally identifiable information stored in Amazon S3?

  1. Amazon Inspector
  2. Amazon Macie Correct answer.
  3. AWS Config
  4. Amazon GuardDuty

Explanation

Macie samples and analyzes objects in S3 buckets to identify sensitive data types and reports findings about buckets that are publicly accessible or unencrypted. The output feeds Security Hub and EventBridge for response workflows.

Question 4Threat Detection and Incident Response

Which statement best describes the role of AWS Security Hub in a threat detection strategy?

  1. It aggregates and normalizes findings from AWS security services. Correct answer.
  2. It captures full packet payloads from VPC traffic for deep network inspection.
  3. It replaces CloudTrail as the record of API activity.
  4. It patches operating system vulnerabilities on EC2 instances.

Explanation

Security Hub collects findings from services such as GuardDuty, Inspector, Macie, and IAM Access Analyzer, converts them to the AWS Security Finding Format, and evaluates them against security standards. It does not generate network telemetry or perform remediation on its own.

Question 5Threat Detection and Incident Response

Which type of information is recorded in VPC Flow Logs?

  1. Source and destination IP addresses, ports, and packet counts Correct answer.
  2. The IAM principal that opened each connection
  3. The full payload of each captured packet
  4. The TLS certificate presented by the destination server

Explanation

Flow Logs capture metadata about IP traffic, including source and destination addresses, ports, protocol, packet and byte counts, and the ACCEPT or REJECT action. They do not capture payload contents or identity information.

Question 6Threat Detection and Incident Response

An EC2 instance is suspected of beaconing to a command-and-control server. Which action isolates it from the network while keeping it running for investigation?

  1. Terminate the instance and restore it from the latest EBS snapshot.
  2. Attach a security group with no inbound or outbound rules. Correct answer.
  3. Stop the instance and detach its root EBS volume for later snapshotting.
  4. Disassociate the instance's Elastic IP address from the network interface.

Explanation

Security groups are stateful and default to deny, so a group with no rules blocks all inbound and outbound traffic while the instance keeps running and remains available for snapshotting and analysis. It is reversible, which matters when the finding may be a false positive.

Question 7Threat Detection and Incident Response

Which feature lets you log DNS queries made by resources in a VPC for threat detection and investigation?

  1. AWS CloudTrail data events
  2. VPC Flow Logs
  3. Route 53 Resolver query logging Correct answer.
  4. AWS Network Firewall flow logs

Explanation

Resolver query logging records the DNS queries that Resolver answers for resources in an associated VPC and can deliver them to CloudWatch Logs, S3, or Firehose. Query names are valuable because GuardDuty uses DNS logs to detect domains associated with malware and exfiltration.

Question 8Threat Detection and Incident Response

Which task is Amazon Inspector designed to perform?

  1. Detect anomalous spikes in API call volume in an account
  2. Scan compute workloads for software vulnerabilities and exposure Correct answer.
  3. Correlate findings across accounts into an investigation behavior graph
  4. Classify sensitive objects stored in Amazon S3

Explanation

Inspector continuously scans EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure, then publishes findings to Security Hub and EventBridge. It is a vulnerability management service rather than a threat detection or investigation service.

Question 9Threat Detection and Incident Response

An access key for an IAM user is confirmed leaked and is being used by an attacker. You must stop the misuse immediately while preserving evidence of the key's prior activity. What should you do first?

  1. Delete the IAM user that owns the key.
  2. Set the access key status to Inactive. Correct answer.
  3. Rotate the account root user password.
  4. Remove the IAM user from all IAM groups.

Explanation

Deactivating the key immediately invalidates it for API calls while keeping the key ID and its CloudTrail history available for the investigation. Deletion can follow once evidence has been reviewed.

Question 10Threat Detection and Incident Response

An organization needs a CloudTrail trail that all member accounts must use and that member accounts cannot stop or alter. What should be configured?

  1. A CloudTrail Lake event data store in each member account
  2. CloudTrail Insights enabled on a trail in the management account
  3. A separate trail in each member account with S3 versioning enabled
  4. An organization trail created from the management account Correct answer.

Explanation

An organization trail applies to every account in the organization and is controlled from the management account, so member accounts cannot modify or delete it. It also provides a single destination bucket for centralized retention and analysis.

Question 11Threat Detection and Incident Response

You want an automated response whenever GuardDuty reports an EC2 finding of a specific type. Which approach should you use?

  1. A CloudWatch Logs subscription filter that invokes an AWS Config rule
  2. An S3 event notification that invokes Amazon Inspector
  3. An EventBridge rule on GuardDuty findings that invokes Lambda Correct answer.
  4. A CloudTrail Insights event that starts an SSM Automation runbook automatically

Explanation

GuardDuty publishes findings to the default EventBridge event bus with a detail-type of GuardDuty Finding, so a rule can match on finding type and severity and route the event to a Lambda function or automation runbook. This is the standard pattern for automated containment.

Question 12Threat Detection and Incident Response

An analyst must query several months of CloudTrail management events with SQL to hunt for a specific API call pattern. What is the most efficient approach?

  1. Stream all CloudTrail events to CloudWatch Logs and query them with Logs Insights
  2. Query the CloudTrail logs in S3 with Amazon Athena using a partitioned table Correct answer.
  3. Export GuardDuty finding history to CSV and filter it in a spreadsheet
  4. Call aws cloudtrail lookup-events for each hour of the investigation period

Explanation

Athena can query CloudTrail log files directly in S3 using SQL, and partitioning by account, Region, and date reduces scanned data and cost for large historical hunts. It is the standard approach for retrospective analysis across long time ranges.

Question 13Threat Detection and Incident Response

What does GuardDuty S3 protection detect?

  1. Unusual or suspicious API activity against S3 buckets and objects Correct answer.
  2. Data transferred out of S3 to an unapproved Region
  3. Objects containing unencrypted personal data
  4. Public read access granted by an S3 bucket policy

Explanation

S3 protection analyzes CloudTrail S3 data events to identify suspicious activity such as anomalous access patterns, credential misuse, or requests from known malicious IP addresses. It is behavior-based threat detection rather than configuration or content inspection.

Question 14Threat Detection and Incident Response

A scheduled penetration test produces recurring GuardDuty findings of a specific type across a set of instances. How can you stop these from cluttering the findings list without reducing detection?

  1. Archive each matching finding manually in the GuardDuty console
  2. Disable the GuardDuty detector in the affected Region
  3. Turn off CloudTrail logging for the affected instances
  4. Create a GuardDuty filter that automatically archives matching findings Correct answer.

Explanation

GuardDuty filters define criteria, such as finding type or resource tag, and automatically archive matching findings so they no longer appear as active. Detection continues for all other activity, which is what distinguishes a filter from disabling protection.

Question 15Threat Detection and Incident Response

Which AWS capability lets you run a predefined, auditable sequence of containment steps, such as snapshotting volumes and isolating an instance, in response to a finding?

  1. GuardDuty protection plans in the account
  2. AWS Config automatic remediation with rollback
  3. Amazon Inspector assessment templates
  4. AWS Systems Manager Automation runbooks Correct answer.

Explanation

Systems Manager Automation runbooks execute documented, repeatable steps against resources and record each execution for audit. They are commonly invoked from EventBridge rules to perform containment and evidence collection.

Question 16Threat Detection and Incident Response

Malware is suspected on a running EC2 instance. Which approach preserves the most reliable disk evidence for analysis?

  1. Terminate the instance and rely on CloudTrail logs for evidence
  2. Snapshot the EBS volumes and mount them on an isolated forensic instance Correct answer.
  3. Log in to the instance and delete suspicious files before taking a snapshot
  4. Reboot the instance and copy files to a bastion host over SCP

Explanation

An EBS snapshot captures the volume at a point in time without altering the running system, and mounting it on a separate isolated instance lets analysts examine files and persistence mechanisms without contaminating the original. The instance itself should be isolated rather than terminated.

Question 17Threat Detection and Incident Response

You need an alert whenever the root user of an account signs in to the AWS Management Console. What should you configure?

  1. A GuardDuty IPSet containing the root user's address
  2. A CloudWatch Logs metric filter on CloudTrail logs with an alarm Correct answer.
  3. An AWS Config rule that checks whether root MFA is enabled
  4. An S3 Lifecycle rule on the CloudTrail log bucket

Explanation

A metric filter matches ConsoleLogin events where userIdentity.type is Root and increments a custom metric, and a CloudWatch alarm notifies responders when that metric is non-zero. This is a common detective control for root account use.

Question 18Threat Detection and Incident Response

Which service should detect and record when a security group is changed to allow 0.0.0.0/0 inbound on port 22?

  1. AWS Shield Standard
  2. Amazon GuardDuty
  3. AWS Config with a managed rule Correct answer.
  4. Amazon Macie

Explanation

AWS Config records resource configuration history and continuously evaluates rules such as restricted-ssh against it, so a noncompliant security group change is flagged and retained as a configuration item timeline. This provides both detection and evidence of when the change occurred.

Question 19Threat Detection and Incident Response

After a suspected compromise, you need to see which domain names internal hosts attempted to reach through a centralized egress VPC. Which log source provides this?

  1. CloudTrail data events for the NAT gateway
  2. S3 server access logs
  3. VPC Flow Logs with the default format
  4. AWS Network Firewall alert logs Correct answer.

Explanation

Network Firewall alert logs record details of traffic that matched a stateful rule and include fields such as TLS server name indication and HTTP host, so domain-level egress attempts can be identified. They are the appropriate source for domain visibility in a centralized egress architecture.

Question 20Threat Detection and Incident Response

Which AWS service provides a centralized console for declaring incidents, paging responders, and tracking post-incident analysis?

  1. AWS Systems Manager Incident Manager Correct answer.
  2. AWS Trusted Advisor
  3. Amazon Detective
  4. AWS Security Hub

Explanation

Incident Manager manages the incident lifecycle with engagement plans, on-call schedules, escalation, and runbooks, and it can be triggered from EventBridge or CloudWatch alarms. It complements detection services by handling the response coordination layer.

Question 21Threat Detection and Incident Response

GuardDuty Malware Protection for EC2 raises a finding indicating malware on an instance. Which statement describes what the service does to support investigation?

  1. It captures a memory dump before raising the finding
  2. It terminates the instance and quarantines its subnet
  3. It scans attached EBS volumes and can snapshot them for analysis Correct answer.
  4. It blocks the malicious process with the host firewall

Explanation

Malware Protection for EC2 scans attached EBS volumes for malware without requiring an agent and can retain snapshots of the affected volumes in an AWS-controlled account for later forensic review. It does not capture memory, terminate instances, or modify host firewalls.

Question 22Threat Detection and Incident Response

A finding reports that role credentials used by an EC2 instance were seen from an IP address outside AWS. Which statement captures both the meaning and the correct containment step?

  1. The instance was launched in a non-approved Region; move it and re-enable the role
  2. The security group is too permissive; restrict outbound rules on the instance
  3. Role credentials used from outside AWS; isolate the instance and revoke sessions Correct answer.
  4. An IAM user access key leaked; deactivate the key and rotate it

Explanation

This finding means the temporary credentials issued to an instance role were used from a source outside AWS, which typically indicates credential theft through server-side request forgery or a compromised host. Containment requires isolating the instance, removing the role's permissions, and revoking existing sessions with an explicit deny keyed to the session issue time, because temporary credentials remain valid until they expire.

Question 23Threat Detection and Incident Response

An attacker with administrator credentials deletes CloudTrail log files from the S3 bucket. How can you determine whether the remaining log files were altered?

  1. Validate the log files using the digest files CloudTrail delivered alongside them Correct answer.
  2. Query CloudTrail Lake for an immutable copy of each log file
  3. Compare S3 object ETags against the console event history
  4. Re-enable the trail so CloudTrail restores the deleted objects

Explanation

CloudTrail delivers hourly digest files containing SHA-256 hashes of the log files and signs them, and the validate-logs command uses them to prove whether a log file has been modified or removed after delivery. Preventing this scenario relies on bucket controls such as versioning, Object Lock, and restricted delete permissions.

Question 24Threat Detection and Incident Response

An organization wants to prevent even a compromised administrator in a member account from disabling CloudTrail or deleting the central log bucket. Which control achieves this?

  1. Enable MFA delete and versioning on the central log bucket in the log archive account
  2. Enable GuardDuty S3 protection in every member account
  3. Replicate the log bucket to a second Region with versioning enabled
  4. Apply an SCP denying cloudtrail:StopLogging and s3:DeleteObject Correct answer.

Explanation

Service control policies set the maximum permissions for principals in member accounts, so an explicit deny for StopLogging and for delete operations on the log bucket cannot be overridden by an account administrator. Bucket-level protections help with recovery but do not stop a privileged principal from acting.

Question 25Threat Detection and Incident Response

An instance must be quarantined so it cannot reach the internet, while investigators still need to reach it with Session Manager. All subnets share one route table. Which control is most appropriate?

  1. Apply a network ACL that denies all egress except to the Systems Manager endpoints Correct answer.
  2. Enable GuardDuty and let it block the outbound connection automatically
  3. Attach a security group that allows only inbound SSH from the investigator's address
  4. Detach the internet gateway from the VPC shared with production workloads

Explanation

A network ACL filters at the subnet boundary and can block all destinations except the interface endpoints used by Systems Manager, which preserves a management channel for forensics without touching shared routing. It is also scoped to the compromised subnet rather than the whole VPC.

Question 26Threat Detection and Incident Response

A GuardDuty finding indicates that an IAM role may have been used from an unusual location. The analyst wants to visualize weeks of historical behavior for that role, the IP addresses involved, and related resources in a single graph to scope the investigation. Which AWS service is designed for this?

  1. Amazon Macie
  2. AWS Config
  3. AWS Trusted Advisor
  4. Amazon Detective Correct answer.

Explanation

Amazon Detective ingests findings and log data and builds a behavioral graph of users, roles, IP addresses, and resources so investigators can explore relationships and history without writing queries. AWS Config tracks resource configuration history rather than identity and network behavior.

Question 27Threat Detection and Incident Response

A compliance team must be able to demonstrate that CloudTrail log files were not modified or deleted after CloudTrail delivered them to the bucket. Which trail configuration supports that?

  1. Applying SSE-KMS encryption to the delivered log files
  2. Aggregating all accounts into an organization trail
  3. Enabling log file integrity validation on the trail Correct answer.
  4. Streaming the trail to CloudWatch Logs with metric filters

Explanation

Log file integrity validation makes CloudTrail produce signed digest files that can later be used to prove log files were delivered intact and were not altered or removed. Encryption protects confidentiality but does not by itself prove that the contents were unchanged.

Question 28Threat Detection and Incident Response

During an investigation, an analyst queries CloudTrail for GetObject calls against a sensitive bucket and finds none, even though other evidence suggests objects were retrieved. The trail is a multi-Region organization trail that is enabled and delivering logs. What most likely explains the missing events?

  1. The trail logs only management events, and S3 data events were never enabled. Correct answer.
  2. The bucket policy allows public read access, and CloudTrail does not log requests made without credentials.
  3. S3 server access logging must be enabled before CloudTrail can record GetObject calls.
  4. Object-level calls are logged only in the bucket's home Region, which the trail excluded.

Explanation

CloudTrail records management events by default, while object-level operations such as GetObject and PutObject are data events that must be explicitly selected on the trail (or logged through S3 server access logs). Without data events, those calls do not appear in CloudTrail at all.

Question 29Security Logging and Monitoring

When a CloudTrail trail is created without configuring any event selectors for data events, which events does it record?

  1. Management events only Correct answer.
  2. Data events only
  3. Both management events and data events
  4. Insight events only

Explanation

Trails capture management (control plane) events by default, while data events such as S3 GetObject or DynamoDB PutItem must be enabled explicitly with event selectors. Insight events are a separate optional feature that must also be turned on.

Question 30Security Logging and Monitoring

A security engineer wants to inspect the payload of traffic traversing an EC2 instance's network interface to look for signs of a web exploit. What should be used?

  1. CloudTrail data events on the network interface
  2. Traffic Mirroring to an analysis appliance Correct answer.
  3. VPC Flow Logs with the maximum aggregation interval
  4. CloudWatch Logs Insights on the VPC flow log group

Explanation

VPC Flow Logs record metadata about IP traffic (source, destination, ports, bytes, action) and never capture packet contents. Traffic Mirroring copies the actual packets so an IDS or analysis tool can inspect payloads.

Question 31Security Logging and Monitoring

Which statement describes how Amazon GuardDuty obtains the data it analyzes?

  1. It requires the GuardDuty agent to be installed on every EC2 instance.
  2. It requires the customer to enable VPC Flow Logs and DNS logging first.
  3. It ingests CloudTrail, VPC flow, and DNS data without extra setup. Correct answer.
  4. It analyzes only CloudTrail data events for S3 buckets.

Explanation

GuardDuty is a managed threat detection service that continuously consumes independent feeds of CloudTrail management events, VPC flow data, and DNS logs; no agents or customer-side log configuration are required. Optional protections such as S3 Protection and malware scanning can be enabled for broader coverage.

Question 32Security Logging and Monitoring

A new CloudWatch Logs log group is created and no retention setting is specified. What happens to the log events?

  1. They are exported to Amazon S3 after 30 days.
  2. They are deleted automatically after 90 days.
  3. They are deleted automatically after 7 days.
  4. They are retained indefinitely. Correct answer.

Explanation

CloudWatch Logs log groups have no default retention: events are kept indefinitely until a retention period is configured, and many teams set one explicitly to control cost and meet data-handling requirements.

Question 33Security Logging and Monitoring

What is the primary purpose of AWS Security Hub?

  1. To store raw VPC flow logs and CloudTrail events for forensic analysis
  2. To centralize and normalize findings from many security tools Correct answer.
  3. To distribute KMS keys to member accounts
  4. To capture packet payloads for intrusion detection

Explanation

Security Hub provides a central view of security findings that are normalized into the AWS Security Finding Format and evaluated against standards such as the AWS Foundational Security Best Practices. It aggregates rather than replaces the services that generate the findings.

Question 34Security Logging and Monitoring

Which service should be enabled to discover whether Amazon S3 buckets contain personally identifiable information such as passport numbers?

  1. AWS CloudTrail
  2. Amazon Macie Correct answer.
  3. Amazon Inspector
  4. AWS Config

Explanation

Macie uses managed data identifiers and machine learning to sample and classify objects in S3, reporting sensitive data findings and bucket-level security issues. It is purpose-built for data discovery in S3 rather than for vulnerability or configuration assessment.

Question 35Security Logging and Monitoring

What does AWS Config primarily provide?

  1. Real-time packet inspection of VPC traffic
  2. A record of configuration changes with rules that check compliance Correct answer.
  3. A managed SIEM with built-in correlation rules
  4. Automated remediation of IAM access keys that are older than 90 days only

Explanation

AWS Config continuously records configuration items for supported resources, keeps a history of changes, and evaluates rules to report compliance. Remediation is possible through SSM Automation documents but is not limited to access-key age.

Question 36Security Logging and Monitoring

Which CloudTrail capability is used to demonstrate that delivered log files have not been altered since CloudTrail wrote them?

  1. The event history in the console
  2. Server-side encryption with SSE-KMS
  3. Log file integrity validation Correct answer.
  4. CloudTrail Insights

Explanation

When log file integrity validation is enabled, CloudTrail produces digest files containing SHA-256 hashes and signs them so a validator can confirm the logs are unchanged. Encryption protects confidentiality but does not by itself prove the log was not modified.

Question 37Security Logging and Monitoring

A company has workloads in us-east-1 and eu-west-1 and expects to add more Regions later. The security team wants one trail that captures management events from every current and future Region. What should they configure?

  1. CloudTrail Insights enabled separately in each Region of the account
  2. An organization trail limited to the home Region of the management account
  3. A multi-region trail created in one Region with the option to apply to all Regions Correct answer.
  4. A separate single-Region trail in each existing Region, merged by an AWS Lambda function

Explanation

A multi-region trail applies event selectors to all Regions in the partition, including Regions that the account starts using later, so no per-Region trails are needed. An organization trail extends one trail to every account in the organization.

Question 38Security Logging and Monitoring

The security team must be alerted within minutes whenever the root user of any account signs in to the console. The trail already delivers events to an S3 bucket. What is the most direct way to generate the alert?

  1. Schedule an hourly Lambda job that lists objects in the trail bucket and searches them.
  2. Enable CloudTrail Insights and wait for the console dashboard to populate.
  3. Deliver the trail to CloudWatch Logs, filter for root sign-ins, and attach an alarm Correct answer.
  4. Turn on S3 server access logging for the trail bucket.

Explanation

CloudTrail can deliver events to CloudWatch Logs, where metric filters turn matching event patterns into metrics that CloudWatch alarms can act on in near real time. S3 delivery alone is unsuitable for minute-level alerting because objects arrive on a delay and must be queried.

Question 39Security Logging and Monitoring

Users report that connections to an EC2 instance on port 443 time out. The team wants evidence of whether the traffic is being blocked before reaching the instance. Which log data should they examine?

  1. AWS Config configuration history for the security group
  2. GuardDuty findings for the instance's elastic network interface over the last seven days
  3. CloudTrail data events for the network interface
  4. Flow log records with action REJECT for the instance's network interface Correct answer.

Explanation

Flow log records include an action field that shows whether traffic was ACCEPTed or REJECTed, so REJECT records for the destination port are direct evidence of blocking by a security group or network ACL. Configuration history shows rule definitions but not whether a specific packet was blocked.

Question 40Security Logging and Monitoring

About 18 months of CloudTrail logs are stored in an S3 bucket. An analyst needs to run ad hoc SQL queries over them without provisioning a database server. What is the most appropriate approach?

  1. Use CloudWatch Logs Insights against the trail's log group
  2. Use CloudTrail event history in the console
  3. Download the objects and search them with a custom script running on an EC2 instance
  4. Define an Athena table over the log bucket and query it with standard SQL Correct answer.

Explanation

Athena queries data in place in S3 using standard SQL and requires no infrastructure, which suits ad hoc searches across a large CloudTrail archive. Event history only covers the last 90 days, and Logs Insights only sees data delivered to a log group.

Question 41Security Logging and Monitoring

Application logs are in CloudWatch Logs and must be streamed in near real time to a third-party SIEM through Amazon S3. Which mechanism should be used?

  1. A CloudWatch Logs metric filter with an alarm action
  2. A CloudTrail Insights trail enabled on the application log group
  3. A scheduled export task that writes the full log group to an S3 bucket
  4. A subscription filter that sends the log group to Amazon Data Firehose Correct answer.

Explanation

Subscription filters deliver log events in near real time to a supported destination such as Kinesis Data Streams, Data Firehose, or Lambda; Firehose can then buffer and deliver the data to the SIEM's S3 location. Export tasks are batch operations that can take many hours and are not real time.

Question 42Security Logging and Monitoring

A team wants to be notified when the rate of write management API calls in their account spikes far above its normal baseline. Which CloudTrail feature addresses this?

  1. CloudTrail Insights Correct answer.
  2. Event history lookup
  3. Log file integrity validation
  4. Data event selectors for S3 objects

Explanation

CloudTrail Insights baselines normal management event activity and raises insight events when API call volume or error rates deviate significantly, which can indicate resource misuse or misconfiguration. Integrity validation and event history do not perform anomaly detection.

Question 43Security Logging and Monitoring

A company uses AWS Organizations and needs every existing and future member account to deliver CloudTrail events to a central bucket. What is the most operationally efficient solution?

  1. Rely on each account's 90-day event history and export it weekly.
  2. Use a Lambda function triggered by account creation to create a trail in each new account.
  3. Create an organization trail from the management account for all member accounts Correct answer.
  4. Ask each account owner to create an identical trail and bucket.

Explanation

An organization trail is created in the management or delegated administrator account and automatically applies to all member accounts, including accounts added later, delivering events to a central S3 bucket. Per-account automation is unnecessary and more error-prone.

Question 44Security Logging and Monitoring

Regulations require that CloudTrail log files in an S3 bucket cannot be deleted or overwritten by anyone, including administrators, for seven years. What should be configured?

  1. Default encryption with SSE-S3 on the log bucket
  2. An S3 Lifecycle rule that transitions the objects to Glacier after 30 days and keeps them
  3. S3 server access logging enabled on the log bucket
  4. S3 Object Lock in compliance mode with seven-year retention and versioning Correct answer.

Explanation

Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting protected object versions until the retention period expires, which provides WORM guarantees. Versioning must be enabled, and Object Lock must be turned on when the bucket is created.

Question 45Security Logging and Monitoring

When GuardDuty reports an EC2 instance communicating with a known malicious host, the security team wants the instance isolated automatically within seconds. What should be built?

  1. An EventBridge rule matching the finding that invokes SSM Automation to isolate the instance Correct answer.
  2. A CloudTrail Insights event that triggers an SNS notification to the on-call engineer
  3. An AWS Config rule that marks the instance as noncompliant and notifies the team
  4. A CloudWatch alarm on the VPC flow log group that stops the affected instance automatically every time

Explanation

GuardDuty publishes findings as events to Amazon EventBridge, where rules can match finding attributes and invoke automation such as SSM Automation or Lambda for immediate containment. This decouples detection from response and keeps the response deterministic.

Question 46Security Logging and Monitoring

A new trail targets an existing S3 bucket in the same account. No log files ever appear in the bucket, and the bucket has default encryption and a restrictive policy. What is the most likely cause?

  1. CloudTrail requires the destination bucket to be in a different account from the trail
  2. The bucket policy does not allow the CloudTrail service principal to write objects Correct answer.
  3. Data event selectors were not enabled on the trail, so no records were produced
  4. The trail's log file integrity validation is disabled

Explanation

CloudTrail needs a bucket policy that allows the cloudtrail.amazonaws.com service principal in the trail's Region to call s3:GetBucketAcl and s3:PutObject with the appropriate prefix and ACL condition. A restrictive or missing policy silently blocks delivery.

Question 47Security Logging and Monitoring

An audit team needs immutable CloudTrail event storage with SQL querying for seven years, but the company does not want to manage S3 bucket policies, Glue tables, or Athena workgroups. Which option fits best?

  1. A CloudTrail Lake event data store with a seven-year retention period Correct answer.
  2. CloudWatch Logs Insights on a log group fed by the trail
  3. An S3 bucket with Object Lock and an Athena table the team builds and maintains
  4. Event history lookups in the CloudTrail console

Explanation

CloudTrail Lake stores events in an immutable event data store and provides built-in SQL querying with a configurable retention period, removing the need to build and maintain an S3-and-Athena pipeline. Integrity is enforced by the event data store itself.

Question 48Security Logging and Monitoring

A governance team must deploy the same set of 25 AWS Config rules and associated remediation actions to 30 accounts in an organization. What is the most efficient approach?

  1. Use AWS CloudTrail Lake to evaluate the rules against the accounts.
  2. Deploy a Config conformance pack through AWS Organizations. Correct answer.
  3. Create each rule individually in every account with a script.
  4. Ask each account to enable Security Hub and manually review its findings.

Explanation

A conformance pack is a YAML template that bundles Config rules and optional remediation actions, and it can be deployed across an organization from a central account. This avoids per-account scripts and keeps the rule set consistent.

Question 49Security Logging and Monitoring

VPC Flow Logs for a VPC capture the instance's application traffic, but there are no records for its repeated requests to 169.254.169.254 for instance metadata. What is the reason?

  1. Metadata requests are logged only when the flow log is created at the network interface level.
  2. Flow logs record only traffic that is rejected by a security group.
  3. An advanced event selector is required to capture link-local addresses.
  4. Traffic to the instance metadata service is not recorded by VPC Flow Logs. Correct answer.

Explanation

VPC Flow Logs do not capture certain traffic, including instance metadata service requests to 169.254.169.254, Amazon DNS queries to the VPC resolver, DHCP, and license activation traffic. This exclusion applies regardless of whether the flow log is attached at the VPC, subnet, or ENI level.

Question 50Security Logging and Monitoring

Logs from a log group in account B must be streamed in near real time to a log group in account A. Both log groups use customer managed KMS keys. The subscription filter in account B was created, but no events reach account A. What must be configured for delivery to succeed?

  1. An S3 export task in account B and a bucket policy in account A that grants read access to the security team
  2. A resource policy attached to account B's log group that allows account A's role to write events directly into it
  3. A CloudWatch Logs destination in account A that authorizes account B, plus matching KMS key permissions Correct answer.
  4. CloudTrail organization trail enabled in both accounts so that cross-account log delivery is authorized automatically

Explanation

Cross-account subscription requires a destination in the receiving account that authorizes the sending account and the CloudWatch Logs service principal, and the receiving log group's KMS key policy must allow the sending account to use the key for encryption. Without both pieces the subscription filter cannot deliver events.