Security Engineering on AWS Certification Security Engineering on AWS Certification Security Monitoring & Logging 3

Question 1

A company wants to automatically remediate non-compliant AWS Config rules. Which approach should they use?

Accepted Answer

Use AWS Config remediation actions backed by AWS Systems Manager Automation documents

Answer

Manually review Config findings daily

Answer

Create a Lambda function triggered by CloudWatch Events daily

Answer

Use AWS Trusted Advisor automated checks

Question 2

Which AWS service can analyze VPC Flow Logs, DNS logs, and CloudTrail logs to investigate the root cause and full scope of a security incident?

Accepted Answer

Amazon Detective

Answer

AWS Security Hub

Answer

Amazon Inspector

Answer

AWS Config

Question 3

An engineer wants to be notified whenever a security group is changed to allow unrestricted SSH access (port 22 from 0.0.0.0/0). Which solution achieves this?

Accepted Answer

Enable AWS Config rule 'restricted-ssh' with SNS notification on NON_COMPLIANT

Answer

Create a CloudWatch metric filter on EC2 logs

Answer

Enable GuardDuty port scan findings

Answer

Use Amazon Inspector network assessments

Question 4

What does enabling 'CloudTrail Insights' provide that standard CloudTrail does not?

Accepted Answer

Automatic detection of unusual API call rates or error rates that deviate from baseline

Answer

Encryption of log files at rest

Answer

Storage of logs for longer retention periods

Answer

Integration with AWS Organizations

Question 5

When GuardDuty is enabled in an AWS Organization, which account should be designated as the GuardDuty administrator?

Accepted Answer

A dedicated security account delegated as the GuardDuty administrator

Answer

Each member account manages its own GuardDuty

Answer

The root user account of each region

Answer

The account with the highest IAM privileges

Question 6

Which CloudWatch feature allows a security engineer to filter specific patterns in CloudTrail logs and create operational metrics, such as counting failed console login attempts?

Accepted Answer

CloudWatch Metric Filters

Answer

CloudWatch Dashboards

Answer

CloudWatch Contributor Insights

Answer

CloudWatch Synthetics