Design and implement monitoring and alerting to address security events.
11 practice questions under this official exam objective (SCS-C02, SCS-C03), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
11 total · page 1 of 1Use Amazon Inspector for ECR/ECS vulnerability scanning aggregated to a central Security H
A company runs Fargate ECS workloads and stores images in per-account ECR private registries. The audit team needs to identify OS and language-library
Alert on 5 bastion failed logins in 5 minutes via CloudWatch metric-filter alarm and SNS m
The company needs native notification when a bastion host sees 5 failed authentication attempts within 5 minutes, routed only to the administrator ass
Use GuardDuty RDS Protection with EventBridge and SNS for least-overhead Aurora unknown-us
The company wants email alerts when unknown users attempt to log in to Amazon Aurora MySQL, with the least operational overhead. GuardDuty RDS Protect
Alert on root console login via a CloudWatch Logs metric-filter alarm and an EventBridge C
CloudTrail already logs to S3; the engineer wants near-real-time email if the root user signs in to the console. Two actions achieve this: send CloudT
Use an EventBridge rule on root ConsoleLogin events to notify an SNS topic
To be alerted as soon as root signs in to the console, create an Amazon EventBridge rule with an event pattern matching ConsoleLogin where userIdentit
Capture Cognito auth events in CloudTrail, store in S3, and query with Athena
To capture both successful and unsuccessful Cognito login attempts and query them, use AWS CloudTrail, which records Cognito API calls such as Initiat
Use an organizational CloudTrail trail with CloudWatch Logs metric filters and alarms to S
All accounts in the organization must log every user action, and alerts must fire in near real time to an email list. An organizational CloudTrail tra
Send Secrets Manager events to CloudWatch Logs, add an IncomingBytes metric filter with an
An EventBridge rule already catches Secrets Manager events from CloudTrail. To alert on anomalous GetSecretValue volume, set CloudWatch Logs as the ru
Use an EventBridge rule on the Config compliance-change event to notify an SNS topic
To monitor the restricted-ssh Config rule continuously and get near-real-time notification when a security group becomes noncompliant, configure an Am
Log script activity in CloudTrail and use IAM Access Analyzer policy generation for least
To replace three AWS managed full-access policies with a least-privilege policy most efficiently, record the script's actual API calls in a CloudTrail
How to Detect EKS Audit Log and Runtime Risks with Email Alerts?
The question tests GuardDuty EKS Protection and Runtime Monitoring for detecting Kubernetes risks from EKS audit logs plus OS, network, and file event