Detection (16%)

SCS-C03 · 48 questions

• A retail enterprise with 45 AWS accounts in Organizations needs tamper-evident audit trails for all Regions, centralized in a log archive account, with KMS encryption and log file validation enabled. Security requires no gaps from new accounts or Regions. Which CloudTrail logging design ensures complete organization coverage?
• An e-commerce platform runs checkout microservices on ECS behind an ALB across two Regions, requiring early warning when latency rises or tasks become unhealthy before customers notice failures. The team already collects metrics but lacks proactive workload health signals. Which monitoring strategy should the engineer implement for workload health?
• A bank is moving 120 workloads with PCI card data, customer PII, and public marketing sites to AWS. Security must decide what to log, alarm depth, and retention before enabling tools. Which analysis best determines monitoring requirements for these varied workloads?
• A SaaS company stores 90 days of VPC Flow Logs and CloudTrail in S3 and must hunt lateral movement across 40 accounts by joining IP, user, and Security Hub findings with SQL. Which log analysis approach should the analyst choose to correlate petabyte-scale history cost-effectively?
• A fintech with 60 AWS accounts must detect anomalous S3 access, Malware findings, and PII exposure in logs through centralized dashboards and alerts without deploying agents. Which monitoring architecture should the detection engineer implement for agentless anomaly visibility?
• A telehealth startup runs an appointment API on API Gateway with a Node.js Lambda integration function. After a least-privilege role tightening, API Gateway execution logs stream to CloudWatch Logs but the integration Lambda emits no log streams despite successful invocations with 200 responses. Retention and encryption settings are unchanged. Which permission failure should the engineer verify first to restore Lambda function logging?
• A global retailer with 60 AWS accounts needs a single queryable inventory of CloudTrail, VPC flow, Route 53, and Security Hub findings for threat hunting, with automatic normalization and retention for analysts. Regional collectors currently create blind spots. Which solution should the security team deploy to aggregate security and monitoring events?
• A healthcare holding company must aggregate CloudTrail, VPC flow, and Route 53 logs from 100 accounts into an immutable lake for 7-year retention, with automated normalization and forwarding to Splunk. Analysts need unified querying without managing pipelines per source. Which log lake integration design meets these centralization needs?
• A global video streaming company runs stateless transcoders on ECS Fargate behind a Network Load Balancer in two Regions. Viewers reported buffering during an AZ impairment that target health stayed green through. They need synthetic transactions, per-AZ visibility, and paging on failure. Which workload health-check design gives earliest warning of endpoint impairment?
• A manufacturing enterprise with 120 accounts must continuously assess CIS compliance, auto-remediate noncompliant S3 public access, and produce executive posture reports across regions. Which automation set should the security team deploy for continuous assessment and reporting?
• A logistics company runs 50 tracking instances using the unified CloudWatch agent for syslog and memusedpercent. After centralizing the agent JSON in SSM Parameter Store and redeploying with SSM, memory metrics arrive but /var/log/messages stops appearing and the agent log shows no file error. The instance profile is unchanged. Which remediation should the operator apply to restore syslog delivery via the CloudWatch agent configuration?
• A fintech runs workloads in three accounts sending CloudTrail, VPC flow, and WAF logs to a central S3 bucket. Analysts need parsed fields, a common schema, cross-source correlation, and persistent dashboards for threat hunting. Which log normalization and correlation architecture should the team implement?
• A healthcare startup must centralize logs for HIPAA audit across 15 accounts: all management API activity, VPC traffic metadata, and Route 53 DNS queries must be immutable for one year and searchable for incidents. Which log ingestion and storage design should the architect choose to meet the logging requirements?
• A retail company runs isolated app VPCs peered to a central inspection VPC with AWS Direct Connect to stores. The SOC suspects port scanning between tiers and DNS data exfiltration to external domains, but has only CloudTrail management events. Visibility must cover east-west packet rejects and resolver queries. Which logging combination should the detection engineer enable to expose lateral movement and tunneling?
• A fintech centralizes CloudTrail, VPC Flow Logs, and GuardDuty findings in an S3 log archive across three Regions. Analysts need ad hoc SQL joins across months of data without managing servers or moving data. Which solution should the detection architect select to analyze centralized logs for threats?
• A payments startup runs a PCI card processor with DynamoDB, a marketing blog on S3, and dev sandboxes that change daily. Budget is tight and alert fatigue is high. Which workload analysis method should the detection engineer use to define right-sized monitoring and alerting requirements?
• A holding company with 60 AWS accounts needs a single view of GuardDuty, Inspector, and Macie findings plus centralized CloudTrail and Config history for threat hunting. Regional analysts require local access to aggregated data. Which monitoring aggregation design centralizes security and monitoring events for organization-wide alerting?
• A media company with 50 accounts stores PII in S3 and needs early warning of anomalous access plus a unified view of sensitive-data and threat findings. The SOC wants dashboards and alerts without building pipelines per account. Which monitoring design should the engineer implement to centralize anomalous-data detection with dashboards?
• A holding company with 60 AWS accounts needs weekly evidence that S3 buckets stay private, EBS volumes are encrypted, and IAM Access Keys rotate, plus automatic tickets for failures across all OUs. Central security wants managed rules without custom Lambda. Which automation solution provides regular assessments and investigations for this organization?
• A fintech aggregates CloudTrail, VPC flow logs, and WAF logs in S3 but analysts struggle with different formats and slow Athena queries during triage. They need normalized fields and fast correlation dashboards. Which log normalization design provides correlated search for triage?
• A retail company with 40 AWS accounts in Organizations must retain all management and data events centrally, prevent member accounts from disabling logging, and forward logs to a security SIEM. Auditors require one consistent trail definition. Which logging configuration should the engineer implement to centralize AWS service activity across the organization?
• A retail platform runs 200 EC2 instances behind an ALB and needs early warning of impaired hosts, failed health checks, and reboot events with actionable alerts. Which workload monitoring strategy provides comprehensive resource health checks with automated alerting?
• A fintech startup stores cardholder exports in S3 and runs 40 accounts under Organizations. Risk wants early warning of anomalous PII exposure, unusual API activity, and centralized queryable findings for audit. Data must stay queryable for threat hunting. Which anomalous-data detection design meets audit and hunting needs?
• A media company runs REST APIs on API Gateway with Lambda integrations and CloudFront delivery. Engineers see 502 errors but API Gateway execution logs and Lambda CloudWatch logs are missing, while access logs exist. Which logging configuration review best troubleshoots the missing functionality and permissions for diagnostics?
• A gaming company with 40 accounts and three Regions needs one security dashboard, long-term log retention, and automated response to GuardDuty and Config findings. Which architecture best aggregates security and monitoring events centrally?
• A logistics company with 40 accounts needs weekly checks for public S3 buckets, unencrypted EBS volumes, and open security groups, auto-remediation for critical drifts, consolidated scores, and evidence for auditors. Which automation should the engineer deploy to perform regular assessments?
• A logistics firm with shared transit gateway and Route 53 Resolver sees data exfiltration via DNS tunneling and lateral movement between VPCs, but has only VPC flow logs centrally. Security wants hub-level visibility of routed inter-VPC traffic from the transit gateway itself rather than per-VPC logging. Which log-source design detects DNS tunneling and cross-VPC threats effectively?
• A global enterprise aggregates CloudTrail, VPC, and Security Hub findings into OCSF, needs 7-year retention, and must feed a third-party SIEM without custom parsers. Security teams need delegated administration and automatic collection from new accounts. Which log storage and data lake integration should the architect implement for centralized analytics?
• A gaming company with ALB, CloudTrail, VPC Flow Logs, and EKS must retain 7 years of audit logs for regulators, enable SQL analysis of security events, and keep hot investigation data queryable for 90 days cost-effectively. Which log ingestion and storage design meets these requirements?
• A logistics company reports missing application logs from EC2 fleet running CloudWatch Agent, with gaps after an AMI update. The agent status is healthy but log groups lack recent events, suggesting config or IAM issues. Which remediation step best troubleshoots the CloudWatch Agent misconfiguration causing missing logs?
• A bank with 60 AWS accounts in Organizations must retain all management events for 7 years, prevent member admins from disabling logging, and centralize trails in a dedicated log archive account with KMS encryption. Auditors will verify completeness across regions. Which CloudTrail design should the team configure to ensure tamper-resistant organization coverage?
• A retailer's security team stores VPC flow logs, CloudTrail, and WAF logs in S3 across 25 accounts totaling terabytes per month. Analysts must run ad hoc SQL joins to trace an attacker IP across services for the past 90 days without moving data or provisioning servers. Which log analysis approach best meets scale and flexibility?
• A fintech with 60 accounts must spot credential theft and anomalous access to S3 buckets holding transaction exports, identify which exports hold sensitive data, centralize findings for analysts with long-term normalized retention for cross-account SQL analytics, and trigger alerts with visual trends. Which detection, aggregation, and dashboard design provides organization-wide anomaly visibility?
• A logistics company runs ALB, CloudFront, WAF, Route 53, and EKS microservices across two Regions, and the SOC needs centralized request, DNS, and Kubernetes audit trails for threat hunting with 1-year retention and low operational overhead. Which log source and storage combination provides complete coverage with minimal management?
• After a production outage, an API team finds API Gateway access logs in CloudWatch but no execution logs for 5xx errors from a REST API integrated with Lambda. The stage was recently redeployed, and engineers suspect missing permissions or disabled detailed logging. Which logging configuration review restores API Gateway execution logging?
• A media streaming platform runs CloudFront, API Gateway, Lambda, and DynamoDB with strict latency SLOs and needs to decide log sources, metrics, and retention before building dashboards. Architects must map critical user journeys to observability inputs and compliance needs. Which analysis approach best determines monitoring requirements for the workload?
• A healthcare organization with 80 accounts must continuously check CIS Benchmark drift, centralize compliance scores, and auto-remediate noncompliant S3 encryption and disabled logging. Which assessment and remediation automation meets continuous compliance needs?
• A multinational with 200 accounts generates CloudTrail, VPC flow, and GuardDuty findings across regions and needs a normalized queryable data lake with 7-year retention that analysts can join with Splunk without building ETL pipelines. Storage costs and schema management are concerns. Which log storage and integration design should the team implement to centralize security telemetry?
• A fintech runs payment workers on ECS Fargate behind an ALB and needs early warning for task crashes, target health shifts, and queue backlogs before customer impact. Leadership wants health-aware dashboards with paging only on actionable failures. Which workload monitoring strategy best provides resource health visibility?
• A regulated fintech operates 40 AWS accounts under AWS Organizations with a dedicated log archive account. Auditors require immutable API history for all Regions, centralized storage, and tamper detection. Which CloudTrail design should the security engineer deploy to meet centralized organization logging?
• A global logistics firm centralizes CloudTrail, VPC flow logs, and custom JSON app logs from 40 accounts into a central S3 bucket. Analysts need normalized fields, fast full-text search, and unified dashboards to correlate threats quickly without analysts writing separate queries for each log source. Which logging solution best normalizes, parses, and correlates diverse logs for rapid hunting?
• A retail fleet of Amazon EC2 instances stopped sending application logs to CloudWatch Logs after an AMI update, the agent is running, but the log group is empty and metrics are missing. The config file path changed and IAM permissions were narrowed. Which troubleshooting step restores missing logs from the CloudWatch agent configuration?
• A retail enterprise runs 60 accounts across three Regions, security analysts miss threats scattered in GuardDuty, WAF, and CloudTrail, and leadership wants one prioritized view with automated enrichment. Which aggregation design should the architect implement to centralize security findings and monitoring events?
• A gaming company with 40 VPCs attached to Transit Gateway suspects malware using DNS tunneling for exfiltration plus lateral movement between VPCs. Flow data and DNS visibility are incomplete and central logging is required, and the team wants hub-level visibility of routed inter-VPC traffic rather than enabling logs in all 40 VPCs. Which log source combination detects tunnel exfiltration and cross-VPC movement?
• A logistics company is migrating 200 EC2 instances, serverless APIs, and Aurora databases to AWS, and needs to define what to monitor for security, including authentication failures, privilege use, and data access anomalies across all layers. Budgets are limited. Which approach best analyzes workloads to determine monitoring requirements for alerting design?
• A logistics firm runs EKS, Lambda, and RDS across three Regions and must centralize API audit trails, Kubernetes control-plane logs, and database activity streams for threat hunting with 1-year retention. Which log source selection meets audit, container, and database coverage?
• A media company stores a year of CloudTrail and VPC flow logs in S3 totaling 8 TB and must find which IAM principal deleted production buckets and trace lateral movement quickly without moving data. Which log analysis approach should the analyst use to query findings efficiently?
• A multinational needs to centralize CloudTrail, VPC flow, and Route 53 logs from 60 accounts into OCSF format for Splunk analysis with 7-year retention and least operational overhead. Which log lake design should the team deploy to integrate third-party tools?