SCS-C03 Detection — 10 Questions

Question 1

A security engineer needs to detect unauthorized API calls originating from an EC2 instance that has an attached IAM role. Which service provides the most granular visibility into the identity and the specific API actions performed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable AWS CloudTrail management and data events for the account.. While CloudTrail is the correct service, the explanation should explicitly mention that CloudTrail captures API calls made by the IAM role attached to the EC2 instance. It should also clarify that 'Data events' are specifically required to capture certain API actions (like S3 object-level operations) that are not included in management events.

Answer

Enable VPC Flow Logs to monitor all inbound and outbound traffic patterns.

Answer

Deploy AWS GuardDuty to monitor network traffic and DNS queries.

Answer

Configure AWS Config to record resource configuration changes.

Question 2

Refer to the exhibit. A security engineer discovers that an IAM user is successfully accessing data in the 'sensitive-data' bucket despite no explicit Allow rule in their IAM policy for that bucket. Which detective control can identify the source of this permission?

Accepted Answer

Enable AWS CloudTrail and analyze the 'userIdentity' field in logs.. IAM Access Analyzer is a tool used to analyze resource-based policies to identify if they grant access to external entities (preventative/analysis). CloudTrail is the primary detective control used to identify the source of an action and the specific credentials/policies used to authorize it. If a user is accessing a bucket without an explicit IAM policy, the permission is likely granted via a resource-based policy (bucket policy) or an inherited SCP. CloudTrail logs the 'eventSource' and 'userIdentity', which allows the engineer to trace the authorization path.

Answer

Use IAM Access Analyzer to validate the resource-based policy.

Answer

Review AWS Config rules for IAM policy compliance violations.

Answer

Run an AWS Trusted Advisor report on IAM role permissions.

Question 3

A company is concerned about sensitive data being accidentally exposed via S3 buckets. Which THREE actions should the security team take to improve detection of such risks?

Accepted Answer

Enable Amazon Macie to discover sensitive data in S3 buckets.. The explanation incorrectly describes S3 Block Public Access as a detection mechanism. S3 Block Public Access is a preventative control, not a detection mechanism. The correct options (A, C, D) focus on discovery, monitoring, and logging, which are detection-oriented.

Answer

Enable S3 Block Public Access at the account level.

Answer

Enable AWS Shield to protect the S3 bucket endpoints.

Question 4

A security auditor needs to track all configuration changes made to VPC Security Groups over the last year. Which service provides a comprehensive, historical audit trail of these changes?

Accepted Answer

AWS Config.. While AWS Config is the correct answer for tracking configuration history and state changes, CloudTrail is the service that records the 'who' (the API caller). AWS Config relies on CloudTrail to provide the identity information for configuration changes. The explanation should clarify that Config provides the resource state history, while CloudTrail provides the event history.

Answer

AWS CloudTrail.

Answer

AWS CloudWatch Logs.

Answer

AWS Trusted Advisor.

Question 5

A company wants to detect potential insider threats involving unauthorized data access to S3. They already have CloudTrail enabled. What is the next logical step to enhance detection?

Accepted Answer

Enable Amazon GuardDuty with S3 Protection.. Amazon GuardDuty S3 Protection analyzes CloudTrail data events and S3 data plane logs (such as GetObject, ListObjects, and DeleteObject) using machine learning and threat intelligence to detect suspicious behavior, such as unusual data access patterns indicative of an insider threat or compromised credentials. GuardDuty acts as the automated threat detection layer built on top of existing CloudTrail logs.

Answer

Implement AWS WAF on S3 buckets.

Answer

Deploy AWS Inspector to the S3 buckets.

Answer

Enable AWS Config for all S3 buckets.

Question 6

Which THREE of the following are considered 'Detective' controls within the AWS security framework?

Accepted Answer

AWS CloudTrail.. Detective controls are essential for visibility and incident response, allowing security teams to understand what is happening within their environment. By using CloudTrail for auditing, GuardDuty for threat detection, and Config for compliance monitoring, organizations can effectively identify, investigate, and respond to threats. These controls provide the empirical data necessary to prove compliance and to refine preventive measures, ensuring that the overall security posture is resilient against evolving threats.

Answer

VPC Security Groups.

Answer

IAM User Permissions.

Question 7

Refer to the exhibit. This CloudTrail event indicates a bucket policy change. Which service could have alerted the team to this change in near real-time?

Accepted Answer

Amazon EventBridge.. Changes to bucket policies are high-risk events that could lead to unauthorized data exposure. Using Amazon EventBridge (formerly CloudWatch Events) to trigger a Lambda function or an SNS notification upon the 'PutBucketPolicy' event provides the rapid alerting necessary for immediate manual or automated verification. This capability is crucial for maintaining security integrity, as it allows teams to respond instantly if a policy change is suspected to be malicious.

Answer

AWS Trusted Advisor.

Answer

AWS Inspector.

Answer

AWS Config.

Question 8

A company requires a detective control to ensure that all EBS volumes are encrypted at rest. Which service is best suited to provide continuous monitoring and remediation of this policy?

Accepted Answer

AWS Config.. AWS Config is the correct service for continuous monitoring of resource configurations. The 'ec2-ebs-encryption-by-default' rule allows for the detection of non-compliant volumes. While remediation can be automated via Systems Manager or Lambda, the core function described for compliance monitoring is the primary capability of AWS Config.

Answer

AWS CloudTrail.

Answer

Amazon GuardDuty.

Answer

AWS WAF.

Question 9

Which AWS service is best suited for detecting and analyzing malicious network traffic directed at an EC2 instance?

Accepted Answer

Amazon GuardDuty.. Amazon GuardDuty provides automated, continuous network monitoring and threat detection. It analyzes VPC Flow Logs to identify anomalous traffic patterns, such as communication with known malicious IPs, port scanning, or unauthorized data exfiltration. This is critical for cloud security because it provides an intelligent layer of detection that does not rely on static rules, enabling teams to quickly identify and isolate compromised instances within the VPC.

Answer

AWS CloudTrail.

Answer

AWS Config.

Answer

AWS WAF.

Question 10

A security engineer needs to centralize GuardDuty findings for a multi-account organization. The goal is to ensure that all current and future accounts in the 'Production' OU have GuardDuty enabled automatically and report to the security account. What is the most efficient way to achieve this?

Accepted Answer

Designate the security account as the GuardDuty delegated administrator and enable 'Auto-enable' for the organization.. While designating a delegated administrator is correct, GuardDuty 'Auto-enable' in an AWS Organization applies to the entire organization, not specifically to a single OU. The security engineer must use the delegated administrator account to enable GuardDuty for the organization, which covers all accounts. The explanation implies it can be scoped to an OU, which is not a native feature of the GuardDuty 'Auto-enable' setting.

Answer

Enable GuardDuty manually in each account and use an S3 bucket in the security account as a finding export destination.

Answer

Use an IAM role in the master account to invite each member account to a GuardDuty master-member relationship.

Answer

Deploy a CloudFormation StackSet to all accounts in the Production OU that enables GuardDuty and sets a custom publishing frequency.