I85PREP
⌘ K
AWS Security Specialty study materials
AWS Security Specialty study resources

AWS Security Specialty practice questions

One question at a time. Build your AWS Security Specialty understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Threat Detection and Incident Response

An Amazon GuardDuty detector repeatedly raises one finding type for activity the security team has reviewed and confirmed as benign. The team wants future findings that match defined criteria to be archived automatically instead of appearing as active findings. What should they configure?

  1. A GuardDuty threat intelligence set
  2. A GuardDuty suppression rule Correct answer.
  3. A GuardDuty trusted IP list
  4. A Security Hub insight

Explanation

Suppression rules define filter criteria; when a new finding matches, GuardDuty automatically archives it so it no longer appears as an active finding. Threat intelligence sets and trusted IP lists change what GuardDuty detects rather than how existing findings are handled. Insights in Security Hub only save grouping filters.

Question 2Threat Detection and Incident Response

Which CloudTrail capability lets an investigator demonstrate that delivered log files have not been altered since CloudTrail wrote them?

  1. An organization trail
  2. Advanced event selectors for data events
  3. CloudTrail Insights
  4. Log file integrity validation Correct answer.

Explanation

Log file integrity validation produces digest files containing SHA-256 hashes of each delivered log file, which can be checked later with the validate-logs command. Any modification to a log file breaks the hash chain and is reported. The other features affect what is logged or how it is monitored, not tamper evidence.

Question 3Threat Detection and Incident Response

A company runs workloads in five AWS Regions and wants a single Security Hub console view showing findings from all of them. Which configuration should the security team implement?

  1. Cross-Region aggregation in Security Hub Correct answer.
  2. S3 Cross-Region Replication of exported finding files
  3. A multi-Region CloudTrail trail
  4. A GuardDuty delegated administrator account

Explanation

Security Hub cross-Region aggregation uses a finding aggregator to link a home Region with other Regions so findings appear in one view. It does not move or copy the underlying findings between accounts by itself. The other options consolidate different data types or different services.

Question 4Threat Detection and Incident Response

Which AWS log source captures metadata about IP traffic that security groups and network ACLs accept or reject on EC2 network interfaces?

  1. Route 53 Resolver query logs
  2. VPC Flow Logs Correct answer.
  3. AWS WAF logs
  4. CloudTrail data events

Explanation

VPC Flow Logs record fields such as source and destination address, ports, bytes, and ACCEPT/REJECT for traffic on elastic network interfaces. Investigators use them to identify scanning, lateral movement, and data transfer volumes. The other log sources record API activity, DNS queries, or HTTP request inspections.

Question 5Threat Detection and Incident Response

An EC2 instance is suspected to be compromised and must be isolated for investigation while its running memory and disk remain available to the forensics team. Which action achieves this?

  1. Attach a security group with no inbound or outbound rules Correct answer.
  2. Terminate the instance and rely on its final EBS snapshot
  3. Detach all EBS volumes and attach them to an analyst workstation
  4. Stop the instance and delete its elastic network interface

Explanation

Replacing the instance's security groups with a quarantine group that permits no traffic severs network access while the instance keeps running, so memory and instance state survive for capture. Snapshots and volume detachments preserve disk data only.

Question 6Threat Detection and Incident Response

Which configuration generates an alert when the root user of an AWS account signs in to the console?

  1. Enabling GuardDuty S3 Protection
  2. Deploying an AWS Config conformance pack with detective and preventive rules
  3. Enabling IAM Access Analyzer
  4. A metric filter and alarm on root-user CloudTrail events Correct answer.

Explanation

Root sign-in events appear in CloudTrail with userIdentity.type set to Root. A CloudWatch Logs metric filter on the trail's log group combined with a CloudWatch alarm notifies the team when such an event occurs. The other controls address policy analysis, S3 threats, or configuration compliance.

Question 7Threat Detection and Incident Response

How long does CloudTrail Event history retain management events by default?

  1. 90 days Correct answer.
  2. 365 days
  3. 7 days
  4. 30 days

Explanation

Event history keeps the last 90 days of management events in a Region and is viewable without configuring a trail. Longer retention requires a trail that delivers to S3 or CloudWatch Logs, or a CloudTrail Lake event data store.

Question 8Threat Detection and Incident Response

Which AWS service continuously discovers sensitive data such as personally identifiable information stored in S3 buckets?

  1. AWS Config
  2. Amazon Macie Correct answer.
  3. Amazon GuardDuty
  4. Amazon Inspector

Explanation

Macie uses managed and custom data identifiers to sample and classify objects in S3, reporting sensitive data findings. Inspector covers workload vulnerabilities, GuardDuty covers threat detection, and Config covers configuration state.

Question 9Threat Detection and Incident Response

An AWS Organization wants one security account to add member accounts, manage GuardDuty configuration, and view aggregated GuardDuty findings. What should the team configure?

  1. Attach a service control policy that denies guardduty:CreateDetector
  2. Create an organization trail in the security account
  3. Enable AWS Config in every member account
  4. Designate a GuardDuty delegated administrator account Correct answer.

Explanation

GuardDuty integrates with Organizations through a delegated administrator, which can enable and manage detectors for member accounts and see their findings. The delegated administrator must be designated from the organization's management account. The other options either centralize different data or block GuardDuty entirely.

Question 10Threat Detection and Incident Response

When GuardDuty generates a high-severity finding for an EC2 instance, the security team wants the instance quarantined automatically within seconds. Which design meets the requirement?

  1. A CloudWatch Logs subscription filter that sends an email notification to the on-call engineer
  2. A daily AWS Config rule evaluation with manual remediation
  3. An EventBridge rule that invokes Lambda to quarantine the instance Correct answer.
  4. A Security Hub insight filtered to high-severity findings

Explanation

GuardDuty publishes findings to EventBridge, where a rule can match the finding type and severity and target Lambda, SSM Automation, or Step Functions for near-real-time containment. This removes the human delay that notification-only designs introduce.

Question 11Threat Detection and Incident Response

An IAM user's long-term access key leaked publicly and has been deleted, but the user had assumed a role and temporary session credentials remain valid for several more hours. Which step revokes those sessions?

  1. Attach a policy denying requests when aws:TokenIssueTime is before the incident Correct answer.
  2. Enable MFA delete on the CloudTrail bucket and versioning on all log buckets
  3. Rotate every KMS key in the account and re-encrypt all stored data immediately
  4. Change the account root password and enable hardware MFA on the root user

Explanation

Issued temporary credentials cannot be individually invalidated, but a policy that denies actions when aws:TokenIssueTime is earlier than a known timestamp blocks all sessions created before that point. This is the mechanism behind the AWSRevokeOlderSessions managed policy. Key rotation, root password changes, and bucket protections do not affect existing STS sessions.

Question 12Threat Detection and Incident Response

An analyst wants GuardDuty to detect anomalous access to S3, such as requests from unusual locations or unusual API call patterns against buckets. What must be enabled?

  1. VPC Flow Logs with S3 traffic
  2. Amazon Macie discovery jobs
  3. CloudTrail data events on every bucket
  4. GuardDuty S3 Protection Correct answer.

Explanation

S3 Protection is a GuardDuty feature that analyzes CloudTrail S3 management and data events to produce bucket-level findings. Enabling the feature for the account and Region activates those finding types. Raw data events alone produce no findings.

Question 13Threat Detection and Incident Response

An analyst must map relationships among IAM roles, IP addresses, and API calls over the past year to determine the blast radius of a compromised role. Which service should be used?

  1. Amazon Inspector
  2. AWS Config
  3. Amazon Detective Correct answer.
  4. AWS Security Hub

Explanation

Detective ingests CloudTrail, VPC Flow Logs, GuardDuty findings, and EKS audit logs and retains up to a year of behavior data it uses to build entity profiles and behavior graphs. Those graphs let analysts pivot from an IAM role to related IPs and API activity.

Question 14Threat Detection and Incident Response

Which CloudTrail configuration records object-level API activity such as GetObject and PutObject for later investigation?

  1. Management events with read and write logging enabled in all Regions
  2. S3 data events enabled with advanced event selectors Correct answer.
  3. VPC Flow Logs in the bucket's Region
  4. CloudTrail Insights events

Explanation

Object-level operations are data events, which are not logged by default and must be selected explicitly, for example with advanced event selectors scoped to specific buckets or prefixes. Management events cover control-plane operations only.

Question 15Threat Detection and Incident Response

Analysts reviewing Security Hub findings want a one-click action that sends the selected finding to the company's ticketing system. What should be created?

  1. A finding aggregator that links findings across Regions
  2. A Config remediation action that runs an SSM document
  3. An insight that groups findings by resource type and severity
  4. A custom action that targets an EventBridge rule Correct answer.

Explanation

A Security Hub custom action appears in the console for selected findings; invoking it emits an EventBridge event that a rule can route to a ticketing integration. It is analyst-initiated, unlike automation rules.

Question 16Threat Detection and Incident Response

Before terminating a compromised EC2 instance, an investigator must preserve its volumes so a forensic team in another account can analyze copies without altering the originals. What is the best action?

  1. Take EBS snapshots and share them cross-account Correct answer.
  2. Copy the instance's files to an S3 bucket by using the AWS CLI
  3. Enable termination protection on the instance
  4. Create an AMI and delete the source instance

Explanation

EBS snapshots are point-in-time block-level copies that preserve the original disk exactly and can be shared with, or copied to, another account for analysis. Attaching a snapshot-derived volume to a forensic host lets the team examine a copy while the original remains untouched.

Question 17Threat Detection and Incident Response

A regulated company needs CloudTrail logs from all accounts held in a central account where they cannot be altered or deleted for seven years. Which design meets the requirement?

  1. An organization trail delivering to a central bucket with Object Lock in compliance mode Correct answer.
  2. Individual trails in every account that deliver to local buckets with versioning and MFA delete enabled
  3. Cross-account CloudWatch Logs subscription filters with 30-day retention
  4. A per-account CloudTrail Lake event data store with 90-day retention

Explanation

An organization trail collects events from every account into a single destination, and S3 Object Lock in compliance mode prevents deletion or overwrite even by the central account's administrators for the retention period. A bucket policy limits who can write to the bucket. Per-account or short-retention designs either remain modifiable or fall far short of seven years.

Question 18Threat Detection and Incident Response

An investigator needs to quantify how much data a compromised instance sent to an external IP address. Which VPC Flow Log field provides this?

  1. pkt-srcaddr
  2. log-status
  3. action
  4. bytes Correct answer.

Explanation

The bytes field records the number of bytes transferred during the aggregation interval for each flow record, so summing it per destination helps size an exfiltration. The action field only shows ACCEPT or REJECT, and the address fields identify endpoints.

Question 19Threat Detection and Incident Response

A penetration testing firm performs authorized tests from a fixed set of public IP addresses and wants GuardDuty to stop raising findings for traffic from those addresses. What is the most direct configuration?

  1. Suppression rules for every finding type that the tests generate
  2. Disabling GuardDuty during the test window
  3. An SCP that excludes the tester IP range
  4. A trusted IP list containing the tester addresses Correct answer.

Explanation

A trusted IP list tells GuardDuty that activity involving those addresses is expected, so finding types that support trusted IPs are not generated for that traffic. It is the intended control for known authorized sources such as penetration testers or internal scanners.

Question 20Threat Detection and Incident Response

Which feature surfaces unusual volumes of write management API calls or unusual API error rates relative to an account's established baseline?

  1. AWS Config
  2. GuardDuty
  3. CloudTrail Insights Correct answer.
  4. IAM Access Analyzer

Explanation

CloudTrail Insights continuously baselines write management API call rates and error rates, then generates Insights events when activity deviates significantly. It is a CloudTrail feature, so the events are delivered alongside trail logs.

Question 21Threat Detection and Incident Response

An analyst wants to identify which EC2 instances resolved domain names associated with known command-and-control infrastructure. Which log source provides this?

  1. CloudTrail data events for S3
  2. Route 53 Resolver query logs captured at the ENI level Correct answer.
  3. VPC Flow Logs
  4. ELB access logs

Explanation

Route 53 Resolver query logs record the DNS queries made by resources in a VPC, including the querying instance's network interface and the name that was resolved. That lets an analyst tie a suspicious domain to a specific instance. Flow logs record IP metadata only and cannot reveal queried names.

Question 22Threat Detection and Incident Response

An AWS Organization wants to stop member accounts from disabling GuardDuty or stopping CloudTrail logging, even by account administrators. Which control should be applied at the organization root?

  1. A service control policy that denies guardduty:DeleteDetector and cloudtrail:StopLogging Correct answer.
  2. An AWS Config rule with automatic remediation
  3. IAM permission boundaries attached to every administrator role in each member account and Region
  4. A GuardDuty suppression rule scoped to the organization

Explanation

Service control policies set the maximum permissions available to principals in member accounts, so a deny for detector deletion and trail-stopping actions applies even to account administrators. Permission boundaries can be altered by those same administrators, and detective controls act after the fact. SCPs do not affect the organization's management account.

Question 23Threat Detection and Incident Response

A security team copies an EBS snapshot of a compromised instance to a forensic account in another Region, but the copy fails with an authorization error. The volume is encrypted with a customer managed KMS key. What is the most likely cause?

  1. The forensic account's S3 bucket policy does not allow the snapshot to be written
  2. The source account lacks ec2:ModifySnapshotAttribute
  3. The KMS key policy does not allow the forensic account to use the key Correct answer.
  4. The forensic role is missing iam:PassRole for the EC2 service

Explanation

Copying an encrypted snapshot re-encrypts it with a key in the destination account and Region, so the caller needs permission to use both the source key for decryption and the destination key for encryption. Granting those rights in the KMS key policies resolves the failure. Snapshot copies do not traverse an S3 bucket policy.

Question 24Threat Detection and Incident Response

Which Security Hub capability can automatically change the workflow status and add a note to findings that match specified criteria, without writing code or Lambda functions?

  1. Automation rules Correct answer.
  2. Finding aggregation
  3. Insights
  4. Custom actions

Explanation

Automation rules in Security Hub evaluate criteria against new and updated findings and can update fields, set workflow status, and add notes. They run server-side with no code or event bus configuration needed. Custom actions, by contrast, require an analyst to select findings and trigger a downstream target.

Question 25Threat Detection and Incident Response

Which GuardDuty capability requires deploying a security agent as an EKS add-on to detect runtime threats such as a compromised container executing suspicious binaries?

  1. EKS Runtime Monitoring Correct answer.
  2. EKS audit log monitoring
  3. Lambda Protection
  4. S3 Protection

Explanation

EKS Runtime Monitoring uses the GuardDuty security agent, installed as an EKS add-on, to observe process, network, and file activity inside containers at runtime. EKS audit log monitoring is agentless and analyzes control-plane audit logs only, so it cannot see activity inside a running container.

Question 26Threat Detection and Incident Response

A compliance team must be able to demonstrate that CloudTrail log files delivered to an S3 bucket have not been modified, deleted, or replaced since CloudTrail wrote them. Which CloudTrail capability supports this requirement?

  1. CloudTrail Insights event rate analysis
  2. CloudWatch Logs export tasks
  3. CloudTrail Event history
  4. Log file integrity validation Correct answer.

Explanation

Log file integrity validation makes CloudTrail produce digest files that contain hash values for each delivered log file, signed with an AWS key pair, so an auditor can verify that a log file is unchanged and that no files are missing. Validation is performed with the AWS CLI validation command against the digest files in the bucket. Event history, Insights, and Logs exports provide visibility but no tamper-evidence for delivered log files.

Question 27Threat Detection and Incident Response

A security team wants a saved view in AWS Security Hub that counts only findings associated with resources tagged Environment=Prod and groups those counts by severity, without altering the findings' workflow status. What should they create?

  1. A custom insight with a group-by statement Correct answer.
  2. An AWS Service Catalog portfolio shared with the security account
  3. A GuardDuty suppression rule that archives matching findings
  4. An automation rule that changes the workflow status of matching findings

Explanation

Custom insights are saved, query-based views in Security Hub that aggregate and group matching findings (for example by severity or by resource) so teams can track trends on a dashboard. Insights are read-only aggregations and do not change workflow status or archive anything. Automation rules and suppression rules do modify findings, which is the opposite of what is required here.

Question 28Threat Detection and Incident Response

An incident responder must run ad-hoc SQL queries over several years of CloudTrail management events from every account in an AWS Organization, without building or maintaining a separate schema and query layer. Which approach meets this requirement?

  1. Create an organization event data store in CloudTrail Lake and query it with SQL Correct answer.
  2. Query CloudTrail Event history in each account with LookupEvents and aggregate the results
  3. Use CloudWatch Logs Insights on the log group that receives the organization trail
  4. Enable CloudTrail Insights on the organization trail and review the anomaly timeline

Explanation

CloudTrail Lake provides managed event data stores that ingest events from all accounts in an organization and support direct SQL queries over a configurable retention period of up to several years, with no separate schema or query infrastructure to maintain. Event history is limited to 90 days per account, and Logs Insights only reaches events actually delivered to that log group for as long as they are retained. Insights surfaces anomalies but does not support retrospective SQL investigation.

Question 29Security Logging and Monitoring

How long does CloudTrail retain events in the Event history view of the console by default?

  1. 365 days
  2. Indefinitely, until manually deleted
  3. 30 days
  4. 90 days Correct answer.

Explanation

Event history is a built-in, free view of the last 90 days of management events in a Region and requires no trail. Longer retention requires delivering the trail to S3 or CloudWatch Logs and querying or archiving it there.

Question 30Security Logging and Monitoring

Which piece of information is not available in VPC Flow Log records?

  1. The contents of packet payloads Correct answer.
  2. The ACCEPT or REJECT action recorded for the traffic
  3. Source and destination IP addresses
  4. Source and destination ports

Explanation

VPC Flow Logs capture metadata about IP traffic, such as addresses, ports, protocol, byte counts and whether the security group or network ACL allowed it. They do not capture packet payload contents, so deep packet inspection requires a different tool such as Traffic Mirroring or AWS Network Firewall.

Question 31Security Logging and Monitoring

A company already runs a multi-Region CloudTrail trail that records management events. Auditors now require a record of every object-level read and write in one specific S3 bucket. What should be added?

  1. Add S3 data events for that bucket to the trail Correct answer.
  2. Turn on CloudTrail Insights for the trail
  3. Enable S3 server access logging on the bucket
  4. Create an S3 event notification that invokes a Lambda function

Explanation

Object-level S3 activity such as GetObject and PutObject is recorded only as data events, which are not logged by default. Data events are enabled per trail by specifying the bucket or prefix, and they incur additional charges.

Question 32Security Logging and Monitoring

A security team wants an automated workflow to start as soon as GuardDuty publishes a new finding. Which service is the native event source to consume those findings?

  1. AWS Trusted Advisor
  2. Amazon EventBridge Correct answer.
  3. Amazon Inspector
  4. AWS Config

Explanation

GuardDuty publishes findings as events to Amazon EventBridge, where rules can match on finding severity or type and route them to Lambda, SNS, SSM Automation or Step Functions. This is the standard pattern for automated finding response.

Question 33Security Logging and Monitoring

An organization trail is created in the management account with all features enabled. Which statement describes the result for member accounts?

  1. Only API calls from the management account are recorded
  2. It covers all accounts in the organization and members cannot modify it Correct answer.
  3. Any member account administrator can delete or stop the trail
  4. Member accounts must create their own trails to capture events

Explanation

An organization trail applies to every account in the organization, and member accounts see it read-only in their console. They cannot modify, stop or delete it, which prevents a compromised member account from blinding the audit trail.

Question 34Security Logging and Monitoring

What does CloudTrail log file integrity validation depend on?

  1. CloudWatch Logs metric filters that watch for deletion events
  2. KMS encryption of every log file with a customer managed key
  3. Signed digest files that hash each delivered log file Correct answer.
  4. S3 Object Lock in compliance mode on the log bucket

Explanation

When log file integrity validation is enabled, CloudTrail delivers a digest file alongside each log file that contains a SHA-256 hash chain signed with a private key. An auditor can then prove that log files were not altered or removed after delivery.

Question 35Security Logging and Monitoring

A security team needs an alert whenever anyone signs in as the AWS account root user. The trail already delivers to a CloudWatch Logs log group. What is the most direct solution?

  1. Rely on GuardDuty to raise a finding when root is used
  2. Create a metric filter on the trail log group for root sign-ins and alarm on it Correct answer.
  3. Enable CloudTrail Insights to flag unusual sign-in volume
  4. Create an S3 event notification that invokes an AWS Lambda function to parse the logs

Explanation

A metric filter scans incoming log events for a pattern such as the root identity in ConsoleLogin or us-east-1 events and increments a custom metric. A CloudWatch alarm on that metric then notifies an SNS topic, giving near real-time detection.

Question 36Security Logging and Monitoring

A team must continuously detect security groups that allow inbound SSH from 0.0.0.0/0 and keep a record of each noncompliant resource. Which service is designed for this?

  1. Run Amazon Inspector against the VPC subnets
  2. Enable CloudTrail Insights on the organization trail
  3. Use an AWS Config managed rule that flags unrestricted ingress on security groups Correct answer.
  4. Enable GuardDuty and review the findings it produces for each account in the Region

Explanation

AWS Config continuously evaluates resource configurations against rules and records compliance state plus a configuration timeline. The managed rule for unrestricted SSH ingress detects the condition and marks the resource noncompliant, which can trigger remediation.

Question 37Security Logging and Monitoring

A company with many AWS accounts needs one place to view findings against CIS and PCI DSS benchmarks across all accounts. Which design meets this requirement?

  1. AWS Security Hub with a delegated administrator account for the organization Correct answer.
  2. Amazon Detective with one behavior graph per account
  3. A separate Security Hub subscription in each account with no aggregation
  4. CloudTrail Lake with one event data store per account

Explanation

Security Hub integrates with Organizations so a delegated administrator can enable standards and aggregate findings from all member accounts into one view. Administrators can then triage findings across accounts and Regions from a single console.

Question 38Security Logging and Monitoring

Which service should be used to discover and classify personally identifiable information stored in S3 buckets?

  1. AWS Config
  2. Amazon Inspector
  3. Amazon GuardDuty
  4. Amazon Macie Correct answer.

Explanation

Macie uses managed and custom data identifiers to sample and classify objects in S3, producing sensitivity findings for categories such as names, credentials and financial data. Findings can be routed through EventBridge for automated response.

Question 39Security Logging and Monitoring

A trail in account A must deliver its log files to an S3 bucket owned by a central log-archive account. Which condition must hold for delivery to succeed?

  1. The log-archive account must create an IAM role that CloudTrail assumes to write objects
  2. The bucket must be in a different Region from the trail to isolate log storage
  3. The bucket policy must allow cloudtrail.amazonaws.com to put objects, and the bucket must be in the trail's Region Correct answer.
  4. The trail must first be converted to an organization trail in the management account

Explanation

Cross-account delivery requires a bucket policy that grants the CloudTrail service principal write access, typically scoped with a source-account or source-ARN condition. CloudTrail also requires the destination bucket to be in the same Region as the trail, so a trail must be created in each Region whose logs land in that Region's bucket.

Question 40Security Logging and Monitoring

Which statement describes how GuardDuty obtains the data it analyzes in a standard account?

  1. Results are derived from Athena queries over the account's S3 access logs
  2. VPC Flow Logs, CloudTrail events and DNS logs, with no agents required Correct answer.
  3. Only CloudTrail management events, because flow logs require a NAT gateway
  4. Agents installed on each EC2 instance forward security telemetry

Explanation

GuardDuty is an agentless service that ingests independent data sources including VPC Flow Logs, CloudTrail management and S3 data events, and DNS query logs. It applies threat intelligence and machine learning to identify malicious or anomalous activity.

Question 41Security Logging and Monitoring

A team wants log events from CloudWatch Logs streamed to Amazon OpenSearch within seconds so dashboards stay nearly live. What delivers this?

  1. A CloudWatch Logs subscription filter that streams events to Firehose or Lambda Correct answer.
  2. A VPC Flow Log with a 1-minute aggregation interval
  3. A CloudTrail Insights event selector
  4. An S3 event notification configured on the CloudTrail log bucket in the same Region

Explanation

Subscription filters match log events in real time and forward them to Kinesis Data Streams, Firehose, Lambda or OpenSearch, which makes them the standard path for near real-time log analytics. They operate on the log stream, not on the archived S3 objects.

Question 42Security Logging and Monitoring

A team creates CloudWatch log groups for its Lambda functions and configures nothing else. Months later log storage costs have grown sharply. What explains this?

  1. Log groups default to never expiring, so events are retained indefinitely Correct answer.
  2. CloudTrail data events are being written into the same log group
  3. CloudWatch Logs replicates each event to three Regions by default
  4. Lambda automatically exports all log events to S3 on a schedule

Explanation

A new log group has no retention setting, meaning events are kept forever and billed for storage. Setting a retention period on each log group causes CloudWatch Logs to delete older events automatically.

Question 43Security Logging and Monitoring

Auditors need to run SQL queries over three years of CloudTrail events without provisioning or managing a database or Athena tables. Which option fits?

  1. Create a CloudTrail Lake event data store and run SQL queries against it Correct answer.
  2. Create an Athena table over the S3 bucket that receives the trail
  3. Enable CloudTrail Insights and query the insights dashboard
  4. Stream the trail to CloudWatch Logs and use Logs Insights for seven years

Explanation

CloudTrail Lake is a managed, immutable event data store that supports SQL queries and retention of up to ten years, with no infrastructure to manage. It supports both CloudTrail events and custom events ingested from other sources.

Question 44Security Logging and Monitoring

GuardDuty is enabled in an account, but the team wants coverage for suspicious object-level activity such as unusual GetObject calls in S3 buckets. What should be verified or configured?

  1. Enable S3 Protection for GuardDuty in the account and Region Correct answer.
  2. Enable CloudTrail data events for the buckets instead
  3. Enable Malware Protection for EC2
  4. Enable EKS audit log monitoring

Explanation

S3 Protection is a GuardDuty protection plan that analyzes CloudTrail S3 data events to detect suspicious access patterns such as anomalous retrievals or access from unusual locations. It must be enabled per account and Region, and its status can be checked in GuardDuty settings.

Question 45Security Logging and Monitoring

Which events does a new CloudTrail trail record by default?

  1. Lambda Invoke function-level calls
  2. VPC flow records for all network interfaces
  3. Management events such as CreateBucket and RunInstances Correct answer.
  4. S3 object-level GetObject calls

Explanation

A trail logs management (control plane) events such as CreateBucket, RunInstances or AttachRolePolicy by default. Data events for S3 objects, Lambda invocations and similar resource-level operations must be explicitly enabled.

Question 46Security Logging and Monitoring

A company suspects an EC2 instance is exfiltrating data by tunneling it through DNS queries resolved by the VPC resolver. Which log source should be enabled to investigate?

  1. VPC Flow Logs with a 10-minute aggregation interval
  2. CloudTrail data events for Route 53
  3. Application Load Balancer access logs
  4. Route 53 Resolver query logging delivered to CloudWatch Logs or Firehose Correct answer.

Explanation

Resolver query logs capture the DNS queries made by resources in the VPC, including query names, types and source IP addresses. That record is what supports detection of high-volume or encoded subdomain queries typical of DNS tunneling.

Question 47Security Logging and Monitoring

Detection of an unauthorized API call must trigger an alert within seconds of the call. The trail currently delivers only to S3. What should be done?

  1. Use VPC Flow Logs, which capture every API call
  2. Deliver the trail to CloudWatch Logs and alarm on metric filters Correct answer.
  3. Enable CloudTrail Insights, which streams events to CloudWatch in real time
  4. CloudTrail delivers to S3 within one second, so the current setup is sufficient

Explanation

CloudTrail typically delivers log files to S3 every five minutes, which is too slow for second-level detection. Sending the trail to a CloudWatch Logs log group enables metric filters and alarms to fire within seconds of the event, and it also supports subscription filters.

Question 48Security Logging and Monitoring

A security team wants to prevent administrators in any member account from stopping or deleting CloudTrail trails, including privileged users. What is the most reliable control?

  1. Attach an IAM policy to each IAM user that denies cloudtrail:StopLogging in the account
  2. Enable log file validation on the trail
  3. Apply an SCP denying cloudtrail:StopLogging and cloudtrail:DeleteTrail to all accounts Correct answer.
  4. Enable MFA delete on the log bucket

Explanation

Service control policies set the maximum available permissions for every principal in an organization account, including the account root and administrators. Denying the trail-tampering actions at the organization level prevents them from being granted locally.

Question 49Security Logging and Monitoring

A security engineer must identify IAM roles whose granted permissions have not been exercised during the past 90 days. Which approach fits best?

  1. Run an AWS Config rule that checks for unused IAM policies
  2. Enable GuardDuty and check for credential-related findings
  3. Use the IAM Access Analyzer unused access analyzer to review unused permissions Correct answer.
  4. Review CloudTrail event history in the console

Explanation

The unused access analyzer in IAM Access Analyzer continuously monitors CloudTrail activity and generates findings for unused permissions, roles, credentials and access keys over a chosen window. Findings can be reviewed and archived, supporting least-privilege cleanup.

Question 50Security Logging and Monitoring

How is encryption at rest enabled for a CloudWatch Logs log group using a customer managed key?

  1. Turn on S3 default encryption for the log bucket
  2. Associate a KMS key with the log group Correct answer.
  3. Set a retention policy of one year on the log group
  4. Enable CloudTrail log file validation on the trail

Explanation

Each log group can be associated with a symmetric KMS customer managed key, and CloudWatch Logs then encrypts the stored log events with it. The key policy must allow the logs service principal to use the key.