A Route 53 health check is failing, but the associated resource is healthy. Which log or metric should be examined to troubleshoot the health check configuration?

CloudTrail logs for the Route 53 health check API calls.

VPC Flow Logs for the traffic to the health check endpoint.

CloudWatch Logs for the Route 53 health check.

CloudWatch metrics for the health check, such as HealthCheckStatus and HealthCheckPercentageHealthy.

A security engineer notices that API Gateway access logs are not being delivered to the specified CloudWatch Logs log group. The execution logs are working correctly. What is the MOST likely cause?

The access log format contains invalid variables that cause the log delivery to fail.

The API Gateway stage is not deployed, so access logs cannot be generated.

The API Gateway execution role lacks the logs:CreateLogStream permission.

The CloudWatch Logs log group has a retention policy that deletes logs immediately.

The CloudWatch Agent is installed on an EC2 instance, but logs are not appearing in CloudWatch Logs. The agent status shows it is running. Which configuration file should be examined FIRST to troubleshoot the issue?

The EC2 instance's user data script that installed the agent.

The CloudWatch Agent configuration file (e.g., /opt/aws/amazon-cloudwatch-agent/bin/config.json)

The EC2 instance's security group rules for outbound traffic.

The CloudWatch Logs log group's retention policy.

A company uses API Gateway to expose a REST API. The security team has enabled execution logging to CloudWatch Logs, but the logs are not showing the request/response data. The logs are appearing, but they only show the execution status (e.g., 200) and not the full request/response. What is the most likely cause?

The API Gateway REST API is using a custom domain name.

The API Gateway account-level IAM role is missing the logs:PutLogEvents permission.

The 'Log full requests/responses data' setting is not enabled in the stage.

The API Gateway stage has caching enabled, which suppresses full logging.

A security engineer is troubleshooting why Amazon CloudFront is not delivering access logs to the specified S3 bucket. The distribution is working correctly. Which configuration is REQUIRED for CloudFront to deliver logs?

Attach an IAM role to the CloudFront distribution that has permissions to write to S3.

Enable the 'Standard logging' option in the distribution and provide an S3 bucket with the appropriate permissions.

Enable the 'Real-time logs' option in the distribution and specify a Kinesis Data Stream.

Create a CloudWatch Logs log group and configure CloudFront to send logs to it.

AWSCertified Security - Specialty

Domain 1Objective 3

Task 1.3: Troubleshoot Security Monitoring, Logging, and Alerting Solutions SCS-C03 Practice Questions (Page 1)

Part of the Content Domain 1: Detection domain, which accounts for 16% of the SCS-C03 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 13 practice questions to prepare you well beyond it. (estimate)

13questions here

3free pages

6concepts

16%of the exam

Questions 1–5

1foundation · medium
A Route 53 health check is failing, but the associated resource is healthy. Which log or metric should be examined to troubleshoot the health check configuration?
Select an answer first
2foundation · medium
A security engineer notices that API Gateway access logs are not being delivered to the specified CloudWatch Logs log group. The execution logs are working correctly. What is the MOST likely cause?
Select an answer first
3foundation · medium
The CloudWatch Agent is installed on an EC2 instance, but logs are not appearing in CloudWatch Logs. The agent status shows it is running. Which configuration file should be examined FIRST to troubleshoot the issue?
Select an answer first
4application · medium
A company uses API Gateway to expose a REST API. The security team has enabled execution logging to CloudWatch Logs, but the logs are not showing the request/response data. The logs are appearing, but they only show the execution status (e.g., 200) and not the full request/response. What is the most likely cause?
Select an answer first
5foundation · medium
A security engineer is troubleshooting why Amazon CloudFront is not delivering access logs to the specified S3 bucket. The distribution is working correctly. Which configuration is REQUIRED for CloudFront to deliver logs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCS-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SCS-C03” is a trademark of its owner, used for identification only.