Design and implement a logging solution.
16 practice questions under this official exam objective (SCS-C02, SCS-C03), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
16 total · page 1 of 1How Can the Security Team Trace a Former Employee's Access Key Activity in AWS?
Investigating what an identified access key did over the past three months maps directly to the CloudTrail console's 90-day event history, which is se
CloudWatch agent fails to publish logs because the IAM policy grants cloudwatch: instead o
An EC2 Auto Scaling group launches Amazon Linux instances that run the CloudWatch agent to ship logs to CloudWatch Logs. The agent runs and networking
Fix CloudTrail-to-S3 delivery by verifying the bucket policy and that the bucket exists
CloudTrail is not delivering events to its S3 destination. The first checks are whether the S3 bucket named in the trail actually exists and whether t
Detect missing software with an AWS Config rule and auto-install via EventBridge, Lambda,
The company must find EC2 instances lacking a required corporate package and install it automatically. Centrally enabling AWS Config with the ec2-mana
Use Amazon Security Lake to aggregate and normalize organization, Marketplace, and on-prem
A company needs one place to aggregate and normalize logs from its entire Organizations organization, AWS Marketplace offerings, and on-premises syste
Forward logs with the CloudWatch agent to CloudWatch Logs and query with Logs Insights
Auto-scaled Linux web servers must not lose logs on scale-in, and logs must be queryable for sessions/user issues, cost-effectively. Install the Cloud
Capture Cognito auth events in CloudTrail, store in S3, and query with Athena
To capture both successful and unsuccessful Cognito login attempts and query them, use AWS CloudTrail, which records Cognito API calls such as Initiat
Filter CloudTrail for TerminateInstances and review AssumeRoleWithSAML to identify the fed
The fastest way to find which federated user terminated an EC2 instance a week ago is to filter CloudTrail event history (90-day window) for the Termi
Stream on-prem logs via Kinesis Agent to Firehose, process with Managed Flink, store in Op
On-premises device logs must be analyzed in near real time on AWS and retained 365 days for pattern/substring search. Install the Kinesis Agent on pre
Use an organizational CloudTrail trail with CloudWatch Logs metric filters and alarms to S
All accounts in the organization must log every user action, and alerts must fire in near real time to an email list. An organizational CloudTrail tra
How Should Auto Scaling Applications Preserve Logs for One Year?
Local logs on Auto Scaling EC2 instances disappear when scale-in terminates an instance. The durable solution is to stream logs with the CloudWatch ag
How to Create CloudHSM-Backed KMS Keys and Audit Their Use?
Creating and controlling keys in AWS KMS custom key stores backed by AWS CloudHSM keeps symmetric key material inside the HSM cluster, and AWS CloudTr
Use a CloudTrail trail with log file validation and S3 data events for object-level loggin
To log object-level S3 activity and cryptographically validate log integrity, create a CloudTrail trail, enable data events and specify Amazon S3 as t
Send Secrets Manager events to CloudWatch Logs, add an IncomingBytes metric filter with an
An EventBridge rule already catches Secrets Manager events from CloudTrail. To alert on anomalous GetSecretValue volume, set CloudWatch Logs as the ru
Apply an inbound SNS message data protection policy with the De-identify operation to mask
To stop sensitive data in SNS messages from leaking into transaction/debug logs, configure an inbound message data protection policy on the SNS topics
Use Kinesis for real-time forensic log streaming and OpenSearch Service for persistent log
Hundreds of Docker-on-EC2 apps need forensic logging with real-time analytics, message replay, and persistence. Amazon Kinesis ingests the log stream