Security Engineering on AWS Certification Security Engineering on AWS Certification Security Monitoring & Logging 2 — Questions and Answers
Question 1: A security engineer needs to ensure CloudTrail logs stored in S3 cannot be deleted by anyone, including administrators, for 7 years. Which feature should they enable?
- S3 bucket versioning
- S3 Object Lock in Compliance mode (Correct answer)
- S3 lifecycle policies
- S3 server-side encryption
Correct answer: S3 Object Lock in Compliance mode
S3 Object Lock in Compliance mode prevents any user, including root, from deleting or overwriting objects during the retention period.
Question 2: Which AWS Config rule can automatically detect whether S3 buckets have public read access enabled?
- s3-bucket-versioning-enabled
- s3-bucket-public-read-prohibited (Correct answer)
- s3-bucket-ssl-requests-only
- s3-bucket-logging-enabled
Correct answer: s3-bucket-public-read-prohibited
The 's3-bucket-public-read-prohibited' managed rule flags any S3 bucket that allows public read access as NON_COMPLIANT.
Question 3: VPC Flow Logs can be published to which destinations? (Choose the most complete answer)
- Only Amazon S3
- Only CloudWatch Logs
- Amazon S3, CloudWatch Logs, or Amazon Kinesis Data Firehose (Correct answer)
- Only Amazon Kinesis
Correct answer: Amazon S3, CloudWatch Logs, or Amazon Kinesis Data Firehose
VPC Flow Logs support delivery to S3 for long-term storage, CloudWatch Logs for real-time analysis, and Kinesis Data Firehose for streaming pipelines.
Question 4: An engineer notices GuardDuty finding type 'UnauthorizedAccess:IAMUser/TorIPCaller'. What does this indicate?
- An IAM user's credentials were used from a Tor network exit node (Correct answer)
- A Tor browser was installed on an EC2 instance
- CloudTrail was disabled from a Tor IP
- An S3 bucket was accessed anonymously
Correct answer: An IAM user's credentials were used from a Tor network exit node
This finding means AWS API calls were made using IAM user credentials from an IP address associated with a Tor exit node, suggesting potential credential compromise.
Question 5: Which service provides a centralized view of security alerts and compliance status by aggregating findings from GuardDuty, Inspector, Macie, and other AWS security services?
- AWS Systems Manager
- Amazon Detective
- AWS Security Hub (Correct answer)
- AWS Trusted Advisor
Correct answer: AWS Security Hub
AWS Security Hub aggregates, organizes, and prioritizes security findings from multiple AWS services and third-party products into a unified dashboard.
Question 6: What is the recommended way to ensure CloudWatch Logs from multiple AWS accounts are available for centralized SIEM analysis?
- Grant cross-account IAM roles to each account
- Use CloudWatch Logs subscriptions to stream to Kinesis Data Streams in a central account (Correct answer)
- Copy log groups manually between accounts
- Deploy a CloudWatch agent on each account's EC2 instances
Correct answer: Use CloudWatch Logs subscriptions to stream to Kinesis Data Streams in a central account
CloudWatch Logs subscription filters stream log data in real time to Kinesis, enabling cross-account centralization for SIEM ingestion.
Security Engineering on AWS Certification Security Engineering on AWS Certification Security Monitoring & Logging 2
A security engineer needs to ensure CloudTrail logs stored in S3 cannot be deleted by anyone, including administrators, for 7 years.
Which feature should they enable?