AWS Security Logging and Detection Quiz

1. True or False: VPC Flow Logs can be sent to CloudWatch Logs or S3 but not both simultaneously.

True

False

2. True or False: VPC Flow Logs include payload data from network packets.

True

False

3. Which metric would indicate a potential brute-force attack when reviewing CloudWatch Logs?

Multiple failed authentication attempts

High network latency

Increased CPU utilization

Database connection timeout

4. What is the primary benefit of enabling MFA Delete on a CloudTrail S3 bucket?

Prevents accidental or intentional log deletion

Encrypts logs automatically

Improves query performance

Reduces storage costs

5. True or False: GuardDuty requires you to enable CloudTrail to detect API-based threats.

True

False

6. Which log type would you use to investigate unauthorized API calls to DynamoDB?

VPC Flow Logs

CloudTrail management events

CloudWatch metrics

GuardDuty findings only

7. What is a primary advantage of using CloudWatch Log Groups with retention policies?

Automatic encryption of logs

Cost optimization through automated deletion

Real-time threat detection

Integration with IAM

8. True or False: CloudTrail Insights can automatically detect unusual API activity patterns.

True

False

9. Which AWS service integrates with GuardDuty to provide automated response capabilities?

CloudFormation

Lambda and EventBridge

Systems Manager

Trusted Advisor

10. What does the 'REJECT' action in VPC Flow Logs indicate?

Traffic accepted by security group

Traffic denied by network ACL or security group

Traffic forwarded to NAT gateway

Traffic encrypted in transit

11. Which AWS service records API calls and account activity across your AWS infrastructure?

CloudTrail

CloudWatch

VPC Flow Logs

GuardDuty

12. Which CloudTrail event type captures data plane activities like S3 object uploads?

Management events

Data events

API events

Insight events

13. What is the minimum log retention period for CloudTrail in S3?

7 days

30 days

User-defined

90 days

14. True or False: GuardDuty requires manual configuration of detection rules for each threat type.

True

False

15. Which log source provides visibility into denied network connections at the VPC level?

CloudTrail management events

VPC Flow Logs reject traffic

GuardDuty findings

CloudWatch metrics

16. What does CloudWatch Logs Insights allow you to do?

Query and analyze log data in real time

Launch EC2 instances

Manage S3 buckets

Configure security groups

17. True or False: CloudTrail can be configured to send logs to multiple AWS regions simultaneously.

True

False

18. Which service provides intelligent threat detection and continuous monitoring for AWS accounts?

CloudTrail

GuardDuty

Config

Inspector

19. CloudTrail logs are stored in which AWS service by default?

CloudWatch Logs

Amazon S3

Amazon RDS

Amazon DynamoDB

20. What is the primary purpose of VPC Flow Logs?

Monitor API calls

Capture network traffic information

Detect malware

Manage IAM policies

AWS Security Specialty Security Logging and Detection Quiz

1. True or False: VPC Flow Logs can be sent to CloudWatch Logs or S3 but not both simultaneously.

2.

What first name or nickname would you like us to use?

2. True or False: VPC Flow Logs include payload data from network packets.

3. Which metric would indicate a potential brute-force attack when reviewing CloudWatch Logs?

4. What is the primary benefit of enabling MFA Delete on a CloudTrail S3 bucket?

5. True or False: GuardDuty requires you to enable CloudTrail to detect API-based threats.

6. Which log type would you use to investigate unauthorized API calls to DynamoDB?

7. What is a primary advantage of using CloudWatch Log Groups with retention policies?

8. True or False: CloudTrail Insights can automatically detect unusual API activity patterns.

9. Which AWS service integrates with GuardDuty to provide automated response capabilities?

10. What does the 'REJECT' action in VPC Flow Logs indicate?

11. Which AWS service records API calls and account activity across your AWS infrastructure?

12. Which CloudTrail event type captures data plane activities like S3 object uploads?

13. What is the minimum log retention period for CloudTrail in S3?

14. True or False: GuardDuty requires manual configuration of detection rules for each threat type.

15. Which log source provides visibility into denied network connections at the VPC level?

16. What does CloudWatch Logs Insights allow you to do?

17. True or False: CloudTrail can be configured to send logs to multiple AWS regions simultaneously.

18. Which service provides intelligent threat detection and continuous monitoring for AWS accounts?

19. CloudTrail logs are stored in which AWS service by default?

20. What is the primary purpose of VPC Flow Logs?