Domain 2: Security Logging and Monitoring

Design and implement logging and monitoring solutions.

5 minutes 5 Questions

Domain 2: Security Logging and Monitoring is a critical component of the AWS Certified Security – Specialty (SCS-C02) exam, accounting for approximately 18% of the total exam content. This domain focuses on designing and implementing robust logging, monitoring, and alerting mechanisms to detect sec…

Concepts covered
VPC Flow LogsAthena for Security AnalysisAWS CloudTrailAmazon CloudWatch Logs and MetricsAWS Config RulesCentralized Logging Architecture
Test mode:
Start practice test

AWS SCS-C02 - Domain 2: Security Logging and Monitoring Example Questions

Test your knowledge of Domain 2: Security Logging and Monitoring

Question 1

An organization centralized all CloudTrail logs into a dedicated logging account using an organization trail. A security engineer notices that during a recent incident, logs from one member account showed a 4-hour gap. The member account's CloudTrail was not modified, S3 bucket policies are correct, and the organization trail is enabled. Which root cause analysis best explains the logging gap?

Correct Answer: An SCP or S3 bucket policy change in the logging account temporarily blocked the member account's log delivery to the centralized S3 bucket

An SCP or S3 bucket policy change in the logging account could temporarily block the member account's ability to deliver logs to the centralized S3 bucket, causing a gap in recorded events even though the organization trail itself remained enabled and the member account's CloudTrail was unmodified.

CloudWatch Logs agent is not involved in CloudTrail log delivery to S3; CloudTrail delivers directly to S3. KMS key policy affecting read access would not prevent log delivery (writing), only reading existing logs. SNS notification throttling does not affect actual log delivery to S3, as SNS notifications are supplementary and independent of the log writing process.

The key concept tested is understanding how centralized CloudTrail log delivery dependencies such as S3 bucket policies and SCPs in the logging account can disrupt log ingestion from member accounts.

Question 2

Which AWS service enables ad-hoc SQL analysis of GuardDuty findings exported to S3 in a serverless, pay-per-query model using standard ANSI SQL syntax?

Correct Answer: Amazon Athena with table definitions mapped to the exported findings data

Amazon Athena is the correct answer because it is a serverless, pay-per-query service that uses standard ANSI SQL to directly analyze data stored in Amazon S3, making it ideal for ad-hoc analysis of exported GuardDuty findings by defining table schemas over the S3 data.

Redshift Spectrum requires a provisioned Redshift cluster, so it is not fully serverless. OpenSearch Service requires provisioned domains and is not a pay-per-query model. QuickSight is a visualization and BI tool, not an ad-hoc SQL query engine, and SPICE is an in-memory caching layer rather than a direct S3 query mechanism.

The key concept tested is understanding serverless SQL analytics on S3 data for security investigation workflows.

Question 3

Which Amazon Athena capability enables administrators to segregate query execution histories among separate security teams while establishing precise data consumption thresholds?

Correct Answer: Utilizing Athena Workgroups

Utilizing Athena Workgroups is the correct approach because workgroups logically separate query execution details, isolate histories for different teams, and allow administrators to enforce cost controls via data usage limits per query or per workgroup.
Configuring AWS Glue tables manages metadata catalogs rather than query separation or cost thresholds. Applying custom IAM policies secures access to resources but does not natively provide per-megabyte data consumption limits. Enabling Federated Queries allows querying data across disparate external sources instead of managing operational controls.
The key concept tested is Athena Workgroup configuration for cost management and operational isolation.

More Domain 2: Security Logging and Monitoring questions
339 questions (total)
Practice 100 questions
One session at a time, always new questions