Task 1.3: Troubleshoot Security Monitoring, Logging, and Alerting Solutions SCS-C03 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · medium

   A security engineer is investigating why a Lambda function's logs are not appearing in the expected CloudWatch Logs log group. The function has been invoked successfully. Which action should the engineer take FIRST to verify the function has the necessary permissions to write logs?

   • AConfirm that the Lambda function's timeout is set to at least 15 minutes to allow log delivery.
   • BEnsure that the Lambda function's memory size is set to at least 512 MB to enable logging.
   • CVerify that the Lambda function's VPC configuration includes a route to a NAT gateway for internet access.
   • DCheck the Lambda function's execution role for the logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents permissions.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company uses the CloudWatch Agent on an EC2 instance to collect application logs. The agent is installed and running, but the logs are not appearing in CloudWatch Logs. The agent's configuration file specifies a log file path that exists. What should the security engineer check first?

   • AVerify that the log group exists in CloudWatch Logs.
   • BCheck that the CloudWatch Agent is running as the root user.
   • CEnsure that the EC2 instance has a public IP address.
   • DVerify that the IAM role attached to the EC2 instance has the logs:PutLogEvents permission.
   Reveal Solution Discussion Select an answer first
4. 8foundation · medium

   A CloudFront distribution has standard logging enabled, but no log files are appearing in the S3 bucket. The bucket exists and is in the same region as the distribution. What is the MOST likely cause?

   • AThe CloudFront distribution is not configured with a default root object.
   • BThe S3 bucket is not versioned, so CloudFront cannot write logs.
   • CThe S3 bucket has a lifecycle policy that deletes objects before they are delivered.
   • DThe S3 bucket's bucket policy does not grant CloudFront permission to write objects.
   Reveal Solution Discussion Select an answer first
5. 9foundation · medium

   A security engineer notices that a new Amazon CloudWatch Logs log group is not receiving log events from an application that uses the CloudWatch agent on an Amazon EC2 instance. The agent is installed and the process is running. The agent configuration file references the correct log file path and the correct log group name. Which remediation is MOST likely to resolve the missing logs?

   • AVerify that the IAM role attached to the EC2 instance grants the logs:PutLogEvents, logs:CreateLogStream, and logs:DescribeLogStreams permissions, and that the role is attached to the instance profile.
   • BRestart the CloudWatch agent by running 'sudo systemctl restart amazon-cloudwatch-agent' on the EC2 instance.
   • CChange the log group retention policy from 1 day to 30 days so that the log events are not deleted before they can be viewed.
   • DRecreate the log group in the same AWS Region as the EC2 instance to ensure the agent can discover it.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company uses Amazon CloudFront to distribute content. The security team wants to enable standard logging (access logs) for the distribution. They have enabled logging in the CloudFront distribution settings and specified an S3 bucket, but no log files are being delivered. What is the most likely cause?

   • AThe S3 bucket does not have the correct bucket policy that grants CloudFront permission to write objects.
   • BThe S3 bucket is in a different AWS Region than the CloudFront distribution.
   • CThe CloudFront distribution is not using a custom origin.
   • DThe CloudFront distribution has caching disabled.
   Reveal Solution Discussion Select an answer first