SCS-C03 Detection — All Questions With Answers

Question 1

A security engineer needs to detect unauthorized API calls originating from an EC2 instance that has an attached IAM role. Which service provides the most granular visibility into the identity and the specific API actions performed?

Accepted Answer

Enable AWS CloudTrail management and data events for the account.. While CloudTrail is the correct service, the explanation should explicitly mention that CloudTrail captures API calls made by the IAM role attached to the EC2 instance. It should also clarify that 'Data events' are specifically required to capture certain API actions (like S3 object-level operations) that are not included in management events.

Answer

Enable VPC Flow Logs to monitor all inbound and outbound traffic patterns.

Answer

Deploy AWS GuardDuty to monitor network traffic and DNS queries.

Answer

Configure AWS Config to record resource configuration changes.

Question 2

Refer to the exhibit. A security engineer discovers that an IAM user is successfully accessing data in the 'sensitive-data' bucket despite no explicit Allow rule in their IAM policy for that bucket. Which detective control can identify the source of this permission?

Accepted Answer

Enable AWS CloudTrail and analyze the 'userIdentity' field in logs.. IAM Access Analyzer is a tool used to analyze resource-based policies to identify if they grant access to external entities (preventative/analysis). CloudTrail is the primary detective control used to identify the source of an action and the specific credentials/policies used to authorize it. If a user is accessing a bucket without an explicit IAM policy, the permission is likely granted via a resource-based policy (bucket policy) or an inherited SCP. CloudTrail logs the 'eventSource' and 'userIdentity', which allows the engineer to trace the authorization path.

Answer

Use IAM Access Analyzer to validate the resource-based policy.

Answer

Review AWS Config rules for IAM policy compliance violations.

Answer

Run an AWS Trusted Advisor report on IAM role permissions.

Question 3

A company is concerned about sensitive data being accidentally exposed via S3 buckets. Which THREE actions should the security team take to improve detection of such risks?

Accepted Answer

Enable Amazon Macie to discover sensitive data in S3 buckets.. The explanation incorrectly describes S3 Block Public Access as a detection mechanism. S3 Block Public Access is a preventative control, not a detection mechanism. The correct options (A, C, D) focus on discovery, monitoring, and logging, which are detection-oriented.

Answer

Enable S3 Block Public Access at the account level.

Answer

Enable AWS Shield to protect the S3 bucket endpoints.

Question 4

A security auditor needs to track all configuration changes made to VPC Security Groups over the last year. Which service provides a comprehensive, historical audit trail of these changes?

Accepted Answer

AWS Config.. While AWS Config is the correct answer for tracking configuration history and state changes, CloudTrail is the service that records the 'who' (the API caller). AWS Config relies on CloudTrail to provide the identity information for configuration changes. The explanation should clarify that Config provides the resource state history, while CloudTrail provides the event history.

Answer

AWS CloudTrail.

Answer

AWS CloudWatch Logs.

Answer

AWS Trusted Advisor.

Question 5

A company wants to detect potential insider threats involving unauthorized data access to S3. They already have CloudTrail enabled. What is the next logical step to enhance detection?

Accepted Answer

Enable Amazon GuardDuty with S3 Protection.. Amazon GuardDuty S3 Protection analyzes CloudTrail data events and S3 data plane logs (such as GetObject, ListObjects, and DeleteObject) using machine learning and threat intelligence to detect suspicious behavior, such as unusual data access patterns indicative of an insider threat or compromised credentials. GuardDuty acts as the automated threat detection layer built on top of existing CloudTrail logs.

Answer

Implement AWS WAF on S3 buckets.

Answer

Deploy AWS Inspector to the S3 buckets.

Answer

Enable AWS Config for all S3 buckets.

Question 6

Which THREE of the following are considered 'Detective' controls within the AWS security framework?

Accepted Answer

AWS CloudTrail.. Detective controls are essential for visibility and incident response, allowing security teams to understand what is happening within their environment. By using CloudTrail for auditing, GuardDuty for threat detection, and Config for compliance monitoring, organizations can effectively identify, investigate, and respond to threats. These controls provide the empirical data necessary to prove compliance and to refine preventive measures, ensuring that the overall security posture is resilient against evolving threats.

Answer

VPC Security Groups.

Answer

IAM User Permissions.

Question 7

Refer to the exhibit. This CloudTrail event indicates a bucket policy change. Which service could have alerted the team to this change in near real-time?

Accepted Answer

Amazon EventBridge.. Changes to bucket policies are high-risk events that could lead to unauthorized data exposure. Using Amazon EventBridge (formerly CloudWatch Events) to trigger a Lambda function or an SNS notification upon the 'PutBucketPolicy' event provides the rapid alerting necessary for immediate manual or automated verification. This capability is crucial for maintaining security integrity, as it allows teams to respond instantly if a policy change is suspected to be malicious.

Answer

AWS Trusted Advisor.

Answer

AWS Inspector.

Answer

AWS Config.

Question 8

A company requires a detective control to ensure that all EBS volumes are encrypted at rest. Which service is best suited to provide continuous monitoring and remediation of this policy?

Accepted Answer

AWS Config.. AWS Config is the correct service for continuous monitoring of resource configurations. The 'ec2-ebs-encryption-by-default' rule allows for the detection of non-compliant volumes. While remediation can be automated via Systems Manager or Lambda, the core function described for compliance monitoring is the primary capability of AWS Config.

Answer

AWS CloudTrail.

Answer

Amazon GuardDuty.

Answer

AWS WAF.

Question 9

Which AWS service is best suited for detecting and analyzing malicious network traffic directed at an EC2 instance?

Accepted Answer

Amazon GuardDuty.. Amazon GuardDuty provides automated, continuous network monitoring and threat detection. It analyzes VPC Flow Logs to identify anomalous traffic patterns, such as communication with known malicious IPs, port scanning, or unauthorized data exfiltration. This is critical for cloud security because it provides an intelligent layer of detection that does not rely on static rules, enabling teams to quickly identify and isolate compromised instances within the VPC.

Answer

AWS CloudTrail.

Answer

AWS Config.

Answer

AWS WAF.

Question 10

A security engineer needs to centralize GuardDuty findings for a multi-account organization. The goal is to ensure that all current and future accounts in the 'Production' OU have GuardDuty enabled automatically and report to the security account. What is the most efficient way to achieve this?

Accepted Answer

Designate the security account as the GuardDuty delegated administrator and enable 'Auto-enable' for the organization.. While designating a delegated administrator is correct, GuardDuty 'Auto-enable' in an AWS Organization applies to the entire organization, not specifically to a single OU. The security engineer must use the delegated administrator account to enable GuardDuty for the organization, which covers all accounts. The explanation implies it can be scoped to an OU, which is not a native feature of the GuardDuty 'Auto-enable' setting.

Answer

Enable GuardDuty manually in each account and use an S3 bucket in the security account as a finding export destination.

Answer

Use an IAM role in the master account to invite each member account to a GuardDuty master-member relationship.

Answer

Deploy a CloudFormation StackSet to all accounts in the Production OU that enables GuardDuty and sets a custom publishing frequency.

Question 11

An organization wants to use Amazon Macie to protect sensitive data across their S3 environment. Which TWO tasks can Macie perform to help detect and protect this data?

Accepted Answer

Automatically discover and classify sensitive data like credit card numbers and PII.. Amazon Macie is a data security service that uses machine learning and pattern matching to discover and protect sensitive data in S3. It provides visibility into S3 bucket security (public/encrypted status) and performs automated sensitive data discovery (PII, credentials, etc.). It does not perform active remediation like encryption or access blocking, nor does it monitor VPC Flow Logs.

Answer

Encrypt unencrypted S3 objects automatically upon discovery.

Answer

Block S3 'GetObject' requests if they contain sensitive data.

Answer

Monitor VPC Flow Logs for data exfiltration patterns from EC2.

Question 12

An organization requires centralized detection of malicious activity across multiple AWS accounts. Which architecture is best for managing GuardDuty findings at scale?

Accepted Answer

Use a delegated administrator account via AWS Organizations.. Using AWS Organizations to enable a GuardDuty delegated administrator allows for the centralized aggregation and management of security findings. This design ensures that all member accounts are consistently covered and that security operations teams have a single point of visibility. This centralized model is standard for enterprises as it reduces the overhead of individual account management and ensures that no account remains unmonitored in a sprawling multi-account AWS environment.

Answer

Manually enable GuardDuty in every individual account.

Answer

Forward all GuardDuty findings to a central S3 bucket using cross-account roles.

Answer

Deploy GuardDuty in the management account only.

Question 13

A company wants to detect potential brute-force attacks against their public-facing web applications hosted on EC2 instances. Which TWO measures should the security team implement?

Accepted Answer

Enable AWS WAF rate-based rules to block IPs exceeding request thresholds.. Implementing a multi-layered defense strategy is essential for detecting and mitigating brute-force attacks. By combining network-level blocking through WAF and host-level monitoring via CloudWatch, organizations can ensure that anomalous patterns are detected in real-time. This proactive detection allows for automated responses, such as modifying security group rules, which significantly reduces the window of opportunity for attackers to successfully compromise sensitive workloads and accounts.

Answer

Use AWS Shield Standard to mitigate Layer 7 application attacks.

Answer

Enable AWS Trusted Advisor to monitor for open security groups.

Answer

Implement AWS Inspector to scan for vulnerabilities on the instances.

Question 14

An organization requires centralized monitoring of security findings from multiple AWS accounts. Which service should be used to aggregate these findings into a single dashboard?

Accepted Answer

AWS Security Hub.. AWS Security Hub acts as a central hub for security posture management. By aggregating findings from GuardDuty, Inspector, IAM Access Analyzer, and third-party partners, it provides a unified view of security threats. This consolidation is critical for large-scale environments, as it allows security teams to prioritize alerts effectively, reduce operational overhead, and ensure consistent compliance monitoring across the entire organization via AWS Organizations integration.

Answer

AWS CloudWatch Dashboards.

Answer

AWS Systems Manager OpsCenter.

Answer

AWS Config Advanced Query.

Question 15

Which AWS service uses machine learning to detect unusual activity, such as unauthorized access to S3 buckets or atypical API calls?

Accepted Answer

AWS GuardDuty.. AWS GuardDuty is an intelligent threat detection service that continuously monitors for malicious or unauthorized behavior. It leverages machine learning to analyze CloudTrail events, VPC Flow Logs, and DNS logs. This is essential for organizations because it identifies threats without requiring the management of complex rule sets, helping teams respond quickly to compromised accounts or malicious instances within the environment.

Answer

AWS Macie.

Answer

AWS WAF.

Answer

AWS CloudTrail.

Question 16

Refer to the exhibit. The log entry shows a denied 'DeleteTable' attempt. Which service, if configured, would have automatically triggered an alert based on this specific log entry?

Accepted Answer

Amazon CloudWatch Metric Filters and Alarms.. This log entry represents an unauthorized attempt to modify critical infrastructure. To alert on this, one must integrate CloudTrail with Amazon CloudWatch Logs and establish a Metric Filter that matches the 'Denied' status and the 'DeleteTable' action. This pattern is essential for incident response, as it allows security teams to distinguish between accidental user error and potential malicious reconnaissance or destructive intent by an insider.

Answer

Amazon GuardDuty.

Answer

AWS Security Hub.

Answer

AWS Trusted Advisor.

Question 17

A security engineer needs to detect if any EC2 instances in an account have been launched with a public IP address. Which service should be used to automate this detection?

Accepted Answer

AWS Config.. AWS Config is a powerful tool for enforcing compliance with infrastructure policies. By using managed rules like 'ec2-instance-no-public-ip', the engineer can automatically flag any instance that violates the policy. This is a critical detective control for preventing unauthorized network exposure, enabling the team to remediate the violation before a security incident occurs, which is essential for maintaining a hardened, private-by-default cloud environment.

Answer

AWS CloudTrail.

Answer

Amazon GuardDuty.

Answer

AWS Systems Manager.

Question 18

A security team needs to identify which IAM users have not used their credentials for more than 90 days. Which service should be used to provide this information?

Accepted Answer

IAM Credential Report.. IAM credential reports are the standard way to audit account security. They provide a comprehensive, comma-separated file that contains information about all users in the account and the status of their credentials, including password, access keys, and MFA status. This is critical for security hygiene and compliance, as it allows administrators to proactively disable or remove stale accounts, reducing the risk of unauthorized access via forgotten credentials.

Answer

AWS CloudTrail.

Answer

AWS Config.

Answer

AWS Trusted Advisor.

Question 19

A company wants to aggregate security findings from AWS GuardDuty, AWS Inspector, and AWS Macie into a single dashboard for prioritized viewing. Which service should be used to provide this consolidated view of security alerts?

Accepted Answer

AWS Security Hub. AWS Security Hub is the primary service for aggregating, organizing, and prioritizing security findings from multiple AWS services. It provides a comprehensive view of the security state of an AWS environment by collecting data from GuardDuty, Inspector, Macie, and third-party products, facilitating a more effective incident response and compliance monitoring process.

Answer

Amazon CloudWatch ServiceLens

Answer

AWS Trusted Advisor

Answer

AWS Config Aggregator

Question 20

An organization is running critical workloads on Amazon EKS and wants to detect suspicious activity at the container runtime level, such as unauthorized process execution or unexpected file access. Which GuardDuty feature should be enabled to achieve this level of visibility?

Accepted Answer

GuardDuty Runtime Monitoring. GuardDuty Runtime Monitoring for EKS provides deep visibility into container-level activities. It uses a lightweight agent (GuardDuty security agent) deployed as a DaemonSet to monitor system calls and process execution. This allows GuardDuty to detect threats that occur within the container itself, which standard VPC Flow Logs or CloudTrail cannot see.

Answer

GuardDuty EKS Audit Log Monitoring

Answer

Amazon Inspector Container Scanning

Answer

VPC Traffic Mirroring for EKS Worker Nodes

SCS-C03 Detection — All Questions With Answers

A security engineer needs to detect unauthorized API calls originating from an EC2 instance that has an attached IAM role. Which service provides the most granular visibility into the identity and the specific API actions performed?

Refer to the exhibit. A security engineer discovers that an IAM user is successfully accessing data in the 'sensitive-data' bucket despite no explicit Allow rule in their IAM policy for that bucket. Which detective control can identify the source of this permission?

Exhibit

A company is concerned about sensitive data being accidentally exposed via S3 buckets. Which THREE actions should the security team take to improve detection of such risks?

A security auditor needs to track all configuration changes made to VPC Security Groups over the last year. Which service provides a comprehensive, historical audit trail of these changes?

A company wants to detect potential insider threats involving unauthorized data access to S3. They already have CloudTrail enabled. What is the next logical step to enhance detection?

Which THREE of the following are considered 'Detective' controls within the AWS security framework?

Refer to the exhibit. This CloudTrail event indicates a bucket policy change. Which service could have alerted the team to this change in near real-time?

Exhibit

A company requires a detective control to ensure that all EBS volumes are encrypted at rest. Which service is best suited to provide continuous monitoring and remediation of this policy?

Which AWS service is best suited for detecting and analyzing malicious network traffic directed at an EC2 instance?

A security engineer needs to centralize GuardDuty findings for a multi-account organization. The goal is to ensure that all current and future accounts in the 'Production' OU have GuardDuty enabled automatically and report to the security account. What is the most efficient way to achieve this?

An organization wants to use Amazon Macie to protect sensitive data across their S3 environment. Which TWO tasks can Macie perform to help detect and protect this data?

An organization requires centralized detection of malicious activity across multiple AWS accounts. Which architecture is best for managing GuardDuty findings at scale?

A company wants to detect potential brute-force attacks against their public-facing web applications hosted on EC2 instances. Which TWO measures should the security team implement?

An organization requires centralized monitoring of security findings from multiple AWS accounts. Which service should be used to aggregate these findings into a single dashboard?

Which AWS service uses machine learning to detect unusual activity, such as unauthorized access to S3 buckets or atypical API calls?

Refer to the exhibit. The log entry shows a denied 'DeleteTable' attempt. Which service, if configured, would have automatically triggered an alert based on this specific log entry?

Exhibit

A security engineer needs to detect if any EC2 instances in an account have been launched with a public IP address. Which service should be used to automate this detection?

A security team needs to identify which IAM users have not used their credentials for more than 90 days. Which service should be used to provide this information?

A company wants to aggregate security findings from AWS GuardDuty, AWS Inspector, and AWS Macie into a single dashboard for prioritized viewing. Which service should be used to provide this consolidated view of security alerts?

An organization is running critical workloads on Amazon EKS and wants to detect suspicious activity at the container runtime level, such as unauthorized process execution or unexpected file access. Which GuardDuty feature should be enabled to achieve this level of visibility?

An organization wants to improve its vulnerability management posture by ensuring that all Amazon EC2 instances are regularly scanned for software vulnerabilities and unintended network exposure. Which TWO features of Amazon Inspector help achieve this?

Which THREE of the following resource types are currently supported by IAM Access Analyzer to identify potential public or cross-account access?

Refer to the exhibit. This GuardDuty finding indicates that malware was detected on an EC2 instance. What is the process GuardDuty used to perform this scan without installing an agent on the instance?

Exhibit

A security engineer wants to enable manual remediation of Security Hub findings directly from the AWS console. They want to be able to select a finding and trigger a specific Lambda function to isolate an instance. What is the correct way to configure this?

A security team needs to perform deep packet inspection (DPI) on traffic entering and leaving a specific EC2 instance to look for complex attack signatures that VPC Flow Logs cannot detect. Which AWS feature should they use to facilitate this?

A security analyst needs to detect potential exfiltration of sensitive data from an S3 bucket that has public access blocked. Which Amazon GuardDuty feature should be configured to detect anomalous data access patterns by internal IAM users?

A company wants to detect when an IAM user executes a command from a suspicious IP address. Which tool can analyze historical CloudTrail data to establish a baseline of normal behavior and trigger alerts upon deviations?

Which TWO actions should be taken to ensure that Amazon GuardDuty has the necessary data to detect unauthorized cryptocurrency mining instances?

An organization is concerned about detecting potential SQL injection attacks against their web application hosted on Application Load Balancer. Which service provides the best native detection capability?

A security engineer needs to detect when an EC2 instance is launched with an unapproved Amazon Machine Image (AMI). Which AWS service should be used to automate this detection?

SCS-C03 Detection — All Questions With Answers

A security engineer needs to detect unauthorized API calls originating from an EC2 instance that has an attached IAM role. Which service provides the most granular visibility into the identity and the specific API actions performed?

Refer to the exhibit. A security engineer discovers that an IAM user is successfully accessing data in the 'sensitive-data' bucket despite no explicit Allow rule in their IAM policy for that bucket. Which detective control can identify the source of this permission?

Exhibit

A company is concerned about sensitive data being accidentally exposed via S3 buckets. Which THREE actions should the security team take to improve detection of such risks?

A security auditor needs to track all configuration changes made to VPC Security Groups over the last year. Which service provides a comprehensive, historical audit trail of these changes?

A company wants to detect potential insider threats involving unauthorized data access to S3. They already have CloudTrail enabled. What is the next logical step to enhance detection?

Which THREE of the following are considered 'Detective' controls within the AWS security framework?

Refer to the exhibit. This CloudTrail event indicates a bucket policy change. Which service could have alerted the team to this change in near real-time?

Exhibit

A company requires a detective control to ensure that all EBS volumes are encrypted at rest. Which service is best suited to provide continuous monitoring and remediation of this policy?

Which AWS service is best suited for detecting and analyzing malicious network traffic directed at an EC2 instance?

A security engineer needs to centralize GuardDuty findings for a multi-account organization. The goal is to ensure that all current and future accounts in the 'Production' OU have GuardDuty enabled automatically and report to the security account. What is the most efficient way to achieve this?

An organization wants to use Amazon Macie to protect sensitive data across their S3 environment. Which TWO tasks can Macie perform to help detect and protect this data?

An organization requires centralized detection of malicious activity across multiple AWS accounts. Which architecture is best for managing GuardDuty findings at scale?

A company wants to detect potential brute-force attacks against their public-facing web applications hosted on EC2 instances. Which TWO measures should the security team implement?

An organization requires centralized monitoring of security findings from multiple AWS accounts. Which service should be used to aggregate these findings into a single dashboard?

Which AWS service uses machine learning to detect unusual activity, such as unauthorized access to S3 buckets or atypical API calls?

Refer to the exhibit. The log entry shows a denied 'DeleteTable' attempt. Which service, if configured, would have automatically triggered an alert based on this specific log entry?

Exhibit

A security engineer needs to detect if any EC2 instances in an account have been launched with a public IP address. Which service should be used to automate this detection?

A security team needs to identify which IAM users have not used their credentials for more than 90 days. Which service should be used to provide this information?

A company wants to aggregate security findings from AWS GuardDuty, AWS Inspector, and AWS Macie into a single dashboard for prioritized viewing. Which service should be used to provide this consolidated view of security alerts?

An organization is running critical workloads on Amazon EKS and wants to detect suspicious activity at the container runtime level, such as unauthorized process execution or unexpected file access. Which GuardDuty feature should be enabled to achieve this level of visibility?

An organization wants to improve its vulnerability management posture by ensuring that all Amazon EC2 instances are regularly scanned for software vulnerabilities and unintended network exposure. Which TWO features of Amazon Inspector help achieve this?

Which THREE of the following resource types are currently supported by IAM Access Analyzer to identify potential public or cross-account access?

Refer to the exhibit. This GuardDuty finding indicates that malware was detected on an EC2 instance. What is the process GuardDuty used to perform this scan without installing an agent on the instance?

Exhibit

A security engineer wants to enable manual remediation of Security Hub findings directly from the AWS console. They want to be able to select a finding and trigger a specific Lambda function to isolate an instance. What is the correct way to configure this?

A security team needs to perform deep packet inspection (DPI) on traffic entering and leaving a specific EC2 instance to look for complex attack signatures that VPC Flow Logs cannot detect. Which AWS feature should they use to facilitate this?

A security analyst needs to detect potential exfiltration of sensitive data from an S3 bucket that has public access blocked. Which Amazon GuardDuty feature should be configured to detect anomalous data access patterns by internal IAM users?

A company wants to detect when an IAM user executes a command from a suspicious IP address. Which tool can analyze historical CloudTrail data to establish a baseline of normal behavior and trigger alerts upon deviations?

Which TWO actions should be taken to ensure that Amazon GuardDuty has the necessary data to detect unauthorized cryptocurrency mining instances?

An organization is concerned about detecting potential SQL injection attacks against their web application hosted on Application Load Balancer. Which service provides the best native detection capability?

A security engineer needs to detect when an EC2 instance is launched with an unapproved Amazon Machine Image (AMI). Which AWS service should be used to automate this detection?