Task 1.3: Troubleshoot Security Monitoring, Logging, and Alerting Solutions SCS-C03 Practice Questions (Page 3)

Questions 11–13

1. 11foundation · medium

   The CloudWatch Agent is running on an EC2 instance, but it is not sending logs to CloudWatch Logs. The agent's configuration file is correct. What should be checked NEXT to troubleshoot the issue?

   • AThe IAM role attached to the EC2 instance has permissions for logs:PutLogEvents and logs:CreateLogStream.
   • BThe EC2 instance's security group allows inbound traffic on port 443.
   • CThe EC2 instance has enough disk space to store the agent's log buffer.
   • DThe CloudWatch Logs log group has a subscription filter that is blocking the logs.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company uses an Application Load Balancer (ALB) to route traffic to a fleet of EC2 instances. The security team notices that the ALB health checks are failing for all instances, even though the instances are healthy and serving traffic. The health check is configured to use HTTP on port 80 with a path of /health. What should the security engineer do to troubleshoot the issue?

   • AVerify that the security group for the instances allows inbound traffic from the ALB's security group on port 80.
   • BEnsure that the instances have a public IP address so the ALB can reach them.
   • CConfigure the health check to use HTTPS on port 443 instead of HTTP.
   • DCheck the ALB's access logs to see if the health check requests are reaching the instances.
   Reveal Solution Discussion Select an answer first
3. 13foundation · medium

   An API Gateway REST API is not producing execution logs in CloudWatch Logs. The API has been deployed and invoked. Which configuration is REQUIRED to enable execution logging?

   • AAdd a resource policy to the API Gateway that allows CloudWatch Logs to write to the log group.
   • BEnable the 'Log full requests/responses data' toggle in the API Gateway console and set a log group ARN.
   • CCreate a CloudWatch Logs log group with the name 'API-Gateway-Execution-Logs' in the same region as the API.
   • DAttach an IAM role to the API Gateway that has permissions to write to CloudWatch Logs.
   Reveal Solution Discussion Select an answer first