What format does AWS Security Hub use to represent security findings from various sources?

Open Cybersecurity Schema Framework (OCSF)

AWS Security Finding Format (ASFF)

JavaScript Object Notation (JSON)

What is required before Amazon Athena can query data stored in an S3 bucket?

A CloudWatch Logs subscription filter

A table definition in the AWS Glue Data Catalog

An EC2 instance running a query engine

What is the primary purpose of enabling transit gateway flow logs?

To record API calls made by IAM users

To monitor network traffic between VPCs and on-premises networks

A company needs to enrich CloudTrail logs with geolocation data before sending them to a third-party SIEM. The logs are delivered to CloudWatch Logs. The enrichment process must be real-time and serverless. Which solution should the company implement?

Use Amazon EMR to process the logs and send them to the SIEM.

Use a Kinesis Data Firehose delivery stream to read from CloudWatch Logs, enrich the data, and deliver to the SIEM.

Create a Lambda function that subscribes to the CloudWatch Logs log group, processes the logs, adds geolocation data, and sends the enriched logs to the SIEM.

Use AWS Glue to process the logs in S3 and add geolocation data, then export to the SIEM.

AWSCertified Security - Specialty

Domain 1Objective 2

Task 1.2: Design and Implement Logging Solutions SCS-C03 Practice Questions (Page 3)

Part of the Content Domain 1: Detection domain, which accounts for 16% of the SCS-C03 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

18concepts

16%of the exam

18 Concepts in This Objective

Identify log sources for ingestion
Evaluate log storage requirements
Configure CloudTrail for organization
Set up dedicated CloudWatch logging account
Configure CloudWatch Logs agent
Implement log data lakes with Security Lake
Integrate logs with third-party security tools
Analyze logs with CloudWatch Logs Insights
Analyze logs with Amazon Athena
Use Security Hub findings for log analysis
Normalize and parse logs with OpenSearch Service
Use Lambda for log processing
Visualize logs with Managed Grafana
Correlate logs across sources
Select log sources based on network design
Configure VPC Flow Logs
Configure transit gateway flow logs
Configure Route 53 Resolver logs

Questions 11–15

11foundation · easy
A security team wants to send CloudTrail logs to a third-party SIEM platform for advanced analytics. Which AWS service can stream CloudTrail logs to the SIEM in near real-time?
Select an answer first
12foundation · easy
What format does AWS Security Hub use to represent security findings from various sources?
Select an answer first
13foundation · easy
What is required before Amazon Athena can query data stored in an S3 bucket?
Select an answer first
14foundation · easy
What is the primary purpose of enabling transit gateway flow logs?
Select an answer first
15application · medium
A company needs to enrich CloudTrail logs with geolocation data before sending them to a third-party SIEM. The logs are delivered to CloudWatch Logs. The enrichment process must be real-time and serverless. Which solution should the company implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCS-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SCS-C03” is a trademark of its owner, used for identification only.