A security engineer is designing a logging strategy for a new application that will be deployed on EC2 instances in a VPC. The application will use an Application Load Balancer (ALB) and an Amazon RDS database. The security team needs to detect unauthorized access attempts and monitor network traffic. Which log sources should the engineer enable?

VPC Flow Logs, ALB access logs, and CloudTrail management events

VPC Flow Logs and Route 53 Resolver query logs

CloudTrail management events and AWS Config configuration history

ALB access logs and RDS database logs

A security analyst is investigating a potential brute-force attack on an EC2 instance. VPC Flow Logs and CloudWatch Logs are enabled. The analyst needs to identify the source IP addresses that attempted to connect to port 22 and failed. Which CloudWatch Logs Insights query would BEST identify these IP addresses?

fields srcAddr, dstAddr, dstPort | filter dstPort = 22 and action = 'REJECT' | stats count() by srcAddr | sort count() desc

fields srcAddr, dstPort | stats count() by srcAddr | sort count() desc | limit 10

fields srcAddr, dstAddr, action | filter action = 'REJECT' | stats count() by srcAddr | sort count() desc

fields srcAddr, dstAddr | filter dstPort = 22 | stats count() by srcAddr | sort count() desc

A security team suspects that an attacker is using DNS tunneling to exfiltrate data from a VPC. They need to enable logging to capture DNS queries and analyze them for suspicious patterns. Which log source should they enable?

AWS Config configuration history

AWSCertified Security - Specialty

Domain 1Objective 2

Task 1.2: Design and Implement Logging Solutions SCS-C03 Practice Questions (Page 5)

Part of the Content Domain 1: Detection domain, which accounts for 16% of the SCS-C03 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

18concepts

16%of the exam

18 Concepts in This Objective

Identify log sources for ingestion
Evaluate log storage requirements
Configure CloudTrail for organization
Set up dedicated CloudWatch logging account
Configure CloudWatch Logs agent
Implement log data lakes with Security Lake
Integrate logs with third-party security tools
Analyze logs with CloudWatch Logs Insights
Analyze logs with Amazon Athena
Use Security Hub findings for log analysis
Normalize and parse logs with OpenSearch Service
Use Lambda for log processing
Visualize logs with Managed Grafana
Correlate logs across sources
Select log sources based on network design
Configure VPC Flow Logs
Configure transit gateway flow logs
Configure Route 53 Resolver logs

Questions 21–25

21foundation · easy
Which AWS service provides query logs that capture DNS queries made by resources within a VPC?
Select an answer first
22foundation · easy
Which tool is commonly used to visualize and explore log data stored in Amazon OpenSearch Service?
Select an answer first
23application · medium
A security engineer is designing a logging strategy for a new application that will be deployed on EC2 instances in a VPC. The application will use an Application Load Balancer (ALB) and an Amazon RDS database. The security team needs to detect unauthorized access attempts and monitor network traffic. Which log sources should the engineer enable?
Select an answer first
24application · medium
A security analyst is investigating a potential brute-force attack on an EC2 instance. VPC Flow Logs and CloudWatch Logs are enabled. The analyst needs to identify the source IP addresses that attempted to connect to port 22 and failed. Which CloudWatch Logs Insights query would BEST identify these IP addresses?
Select an answer first
25application · medium
A security team suspects that an attacker is using DNS tunneling to exfiltrate data from a VPC. They need to enable logging to capture DNS queries and analyze them for suspicious patterns. Which log source should they enable?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCS-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SCS-C03” is a trademark of its owner, used for identification only.

Task 1.2: Design and Implement Logging Solutions SCS-C03 Practice Questions (Page 5)

Questions 21–25

Which AWS service provides query logs that capture DNS queries made by resources within a VPC?

Which tool is commonly used to visualize and explore log data stored in Amazon OpenSearch Service?

A security team suspects that an attacker is using DNS tunneling to exfiltrate data from a VPC. They need to enable logging to capture DNS queries and analyze them for suspicious patterns. Which log source should they enable?

Keep studying — Content Domain 1: Detection