Security Engineering on AWS Certification Security Engineering on AWS Certification Security Monitoring & Logging

Question 1

Which AWS service provides a complete history of API calls made within your account, including calls from the AWS Management Console, SDKs, and CLI?

Accepted Answer

AWS CloudTrail

Answer

Amazon CloudWatch

Answer

AWS Config

Answer

Amazon GuardDuty

Question 2

When configuring CloudTrail for a multi-account AWS Organization, what is the best practice for storing logs?

Accepted Answer

Use an organization trail to aggregate logs into a centralized S3 bucket in the management account

Answer

Store logs in each individual account's S3 bucket

Answer

Enable CloudTrail only in the management account

Answer

Store logs in an EC2 instance in each region

Question 3

Which CloudTrail feature allows you to validate that log files have not been tampered with after delivery?

Accepted Answer

Log file validation using digest files

Answer

Log file encryption

Answer

S3 versioning

Answer

CloudWatch Logs integration

Question 4

An engineer wants to receive real-time alerts when a root account login occurs. Which combination of services should they use?

Accepted Answer

CloudTrail + CloudWatch Logs + CloudWatch Alarms + SNS

Answer

CloudTrail + S3 event notifications

Answer

AWS Config + Lambda

Answer

GuardDuty + Security Hub

Question 5

What is the purpose of AWS Config in a security monitoring strategy?

Accepted Answer

To record configuration changes to AWS resources and evaluate compliance against rules

Answer

To monitor network traffic for threats

Answer

To scan EC2 instances for vulnerabilities

Answer

To aggregate security findings across services

Question 6

Which AWS service uses machine learning to analyze CloudTrail events and other data sources to detect unexpected and potentially unauthorized activity in your AWS environment?

Accepted Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

AWS Security Hub

Answer

AWS Trusted Advisor