SCS-C03 Detection Practice Test 1 — 15 Questions

Question 1

A security engineer needs to detect unauthorized API calls originating from an EC2 instance that has an attached IAM role. Which service provides the most granular visibility into the identity and the specific API actions performed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable AWS CloudTrail management and data events for the account.. While CloudTrail is the correct service, the explanation should explicitly mention that CloudTrail captures API calls made by the IAM role attached to the EC2 instance. It should also clarify that 'Data events' are specifically required to capture certain API actions (like S3 object-level operations) that are not included in management events.

Answer

Enable VPC Flow Logs to monitor all inbound and outbound traffic patterns.

Answer

Deploy AWS GuardDuty to monitor network traffic and DNS queries.

Answer

Configure AWS Config to record resource configuration changes.

Question 2

Refer to the exhibit. A security engineer discovers that an IAM user is successfully accessing data in the 'sensitive-data' bucket despite no explicit Allow rule in their IAM policy for that bucket. Which detective control can identify the source of this permission?

Accepted Answer

Enable AWS CloudTrail and analyze the 'userIdentity' field in logs.. IAM Access Analyzer is a tool used to analyze resource-based policies to identify if they grant access to external entities (preventative/analysis). CloudTrail is the primary detective control used to identify the source of an action and the specific credentials/policies used to authorize it. If a user is accessing a bucket without an explicit IAM policy, the permission is likely granted via a resource-based policy (bucket policy) or an inherited SCP. CloudTrail logs the 'eventSource' and 'userIdentity', which allows the engineer to trace the authorization path.

Answer

Use IAM Access Analyzer to validate the resource-based policy.

Answer

Review AWS Config rules for IAM policy compliance violations.

Answer

Run an AWS Trusted Advisor report on IAM role permissions.

Question 3

A company is concerned about sensitive data being accidentally exposed via S3 buckets. Which THREE actions should the security team take to improve detection of such risks?

Accepted Answer

Enable Amazon Macie to discover sensitive data in S3 buckets.. The explanation incorrectly describes S3 Block Public Access as a detection mechanism. S3 Block Public Access is a preventative control, not a detection mechanism. The correct options (A, C, D) focus on discovery, monitoring, and logging, which are detection-oriented.

Answer

Enable S3 Block Public Access at the account level.

Answer

Enable AWS Shield to protect the S3 bucket endpoints.

Question 4

A security auditor needs to track all configuration changes made to VPC Security Groups over the last year. Which service provides a comprehensive, historical audit trail of these changes?

Accepted Answer

AWS Config.. While AWS Config is the correct answer for tracking configuration history and state changes, CloudTrail is the service that records the 'who' (the API caller). AWS Config relies on CloudTrail to provide the identity information for configuration changes. The explanation should clarify that Config provides the resource state history, while CloudTrail provides the event history.

Answer

AWS CloudTrail.

Answer

AWS CloudWatch Logs.

Answer

AWS Trusted Advisor.

Question 5

A company wants to detect potential insider threats involving unauthorized data access to S3. They already have CloudTrail enabled. What is the next logical step to enhance detection?

Accepted Answer

Enable Amazon GuardDuty with S3 Protection.. Amazon GuardDuty S3 Protection analyzes CloudTrail data events and S3 data plane logs (such as GetObject, ListObjects, and DeleteObject) using machine learning and threat intelligence to detect suspicious behavior, such as unusual data access patterns indicative of an insider threat or compromised credentials. GuardDuty acts as the automated threat detection layer built on top of existing CloudTrail logs.

Answer

Implement AWS WAF on S3 buckets.

Answer

Deploy AWS Inspector to the S3 buckets.

Answer

Enable AWS Config for all S3 buckets.

Question 6

Which THREE of the following are considered 'Detective' controls within the AWS security framework?

Accepted Answer

AWS CloudTrail.. Detective controls are essential for visibility and incident response, allowing security teams to understand what is happening within their environment. By using CloudTrail for auditing, GuardDuty for threat detection, and Config for compliance monitoring, organizations can effectively identify, investigate, and respond to threats. These controls provide the empirical data necessary to prove compliance and to refine preventive measures, ensuring that the overall security posture is resilient against evolving threats.

Answer

VPC Security Groups.

Answer

IAM User Permissions.

Question 7

Refer to the exhibit. This CloudTrail event indicates a bucket policy change. Which service could have alerted the team to this change in near real-time?

Accepted Answer

Amazon EventBridge.. Changes to bucket policies are high-risk events that could lead to unauthorized data exposure. Using Amazon EventBridge (formerly CloudWatch Events) to trigger a Lambda function or an SNS notification upon the 'PutBucketPolicy' event provides the rapid alerting necessary for immediate manual or automated verification. This capability is crucial for maintaining security integrity, as it allows teams to respond instantly if a policy change is suspected to be malicious.

Answer

AWS Trusted Advisor.

Answer

AWS Inspector.

Answer

AWS Config.

Question 8

A company requires a detective control to ensure that all EBS volumes are encrypted at rest. Which service is best suited to provide continuous monitoring and remediation of this policy?

Accepted Answer

AWS Config.. AWS Config is the correct service for continuous monitoring of resource configurations. The 'ec2-ebs-encryption-by-default' rule allows for the detection of non-compliant volumes. While remediation can be automated via Systems Manager or Lambda, the core function described for compliance monitoring is the primary capability of AWS Config.

Answer

AWS CloudTrail.

Answer

Amazon GuardDuty.

Answer

AWS WAF.

Question 9

Which AWS service is best suited for detecting and analyzing malicious network traffic directed at an EC2 instance?

Accepted Answer

Amazon GuardDuty.. Amazon GuardDuty provides automated, continuous network monitoring and threat detection. It analyzes VPC Flow Logs to identify anomalous traffic patterns, such as communication with known malicious IPs, port scanning, or unauthorized data exfiltration. This is critical for cloud security because it provides an intelligent layer of detection that does not rely on static rules, enabling teams to quickly identify and isolate compromised instances within the VPC.

Answer

AWS CloudTrail.

Answer

AWS Config.

Answer

AWS WAF.

Question 10

A security engineer needs to centralize GuardDuty findings for a multi-account organization. The goal is to ensure that all current and future accounts in the 'Production' OU have GuardDuty enabled automatically and report to the security account. What is the most efficient way to achieve this?

Accepted Answer

Designate the security account as the GuardDuty delegated administrator and enable 'Auto-enable' for the organization.. While designating a delegated administrator is correct, GuardDuty 'Auto-enable' in an AWS Organization applies to the entire organization, not specifically to a single OU. The security engineer must use the delegated administrator account to enable GuardDuty for the organization, which covers all accounts. The explanation implies it can be scoped to an OU, which is not a native feature of the GuardDuty 'Auto-enable' setting.

Answer

Enable GuardDuty manually in each account and use an S3 bucket in the security account as a finding export destination.

Answer

Use an IAM role in the master account to invite each member account to a GuardDuty master-member relationship.

Answer

Deploy a CloudFormation StackSet to all accounts in the Production OU that enables GuardDuty and sets a custom publishing frequency.

Question 11

An organization wants to use Amazon Macie to protect sensitive data across their S3 environment. Which TWO tasks can Macie perform to help detect and protect this data?

Accepted Answer

Automatically discover and classify sensitive data like credit card numbers and PII.. Amazon Macie is a data security service that uses machine learning and pattern matching to discover and protect sensitive data in S3. It provides visibility into S3 bucket security (public/encrypted status) and performs automated sensitive data discovery (PII, credentials, etc.). It does not perform active remediation like encryption or access blocking, nor does it monitor VPC Flow Logs.

Answer

Encrypt unencrypted S3 objects automatically upon discovery.

Answer

Block S3 'GetObject' requests if they contain sensitive data.

Answer

Monitor VPC Flow Logs for data exfiltration patterns from EC2.

Question 12

An organization requires centralized detection of malicious activity across multiple AWS accounts. Which architecture is best for managing GuardDuty findings at scale?

Accepted Answer

Use a delegated administrator account via AWS Organizations.. Using AWS Organizations to enable a GuardDuty delegated administrator allows for the centralized aggregation and management of security findings. This design ensures that all member accounts are consistently covered and that security operations teams have a single point of visibility. This centralized model is standard for enterprises as it reduces the overhead of individual account management and ensures that no account remains unmonitored in a sprawling multi-account AWS environment.

Answer

Manually enable GuardDuty in every individual account.

Answer

Forward all GuardDuty findings to a central S3 bucket using cross-account roles.

Answer

Deploy GuardDuty in the management account only.

Question 13

A company wants to detect potential brute-force attacks against their public-facing web applications hosted on EC2 instances. Which TWO measures should the security team implement?

Accepted Answer

Enable AWS WAF rate-based rules to block IPs exceeding request thresholds.. Implementing a multi-layered defense strategy is essential for detecting and mitigating brute-force attacks. By combining network-level blocking through WAF and host-level monitoring via CloudWatch, organizations can ensure that anomalous patterns are detected in real-time. This proactive detection allows for automated responses, such as modifying security group rules, which significantly reduces the window of opportunity for attackers to successfully compromise sensitive workloads and accounts.

Answer

Use AWS Shield Standard to mitigate Layer 7 application attacks.

Answer

Enable AWS Trusted Advisor to monitor for open security groups.

Answer

Implement AWS Inspector to scan for vulnerabilities on the instances.

Question 14

An organization requires centralized monitoring of security findings from multiple AWS accounts. Which service should be used to aggregate these findings into a single dashboard?

Accepted Answer

AWS Security Hub.. AWS Security Hub acts as a central hub for security posture management. By aggregating findings from GuardDuty, Inspector, IAM Access Analyzer, and third-party partners, it provides a unified view of security threats. This consolidation is critical for large-scale environments, as it allows security teams to prioritize alerts effectively, reduce operational overhead, and ensure consistent compliance monitoring across the entire organization via AWS Organizations integration.

Answer

AWS CloudWatch Dashboards.

Answer

AWS Systems Manager OpsCenter.

Answer

AWS Config Advanced Query.

Question 15

Which AWS service uses machine learning to detect unusual activity, such as unauthorized access to S3 buckets or atypical API calls?

Accepted Answer

AWS GuardDuty.. AWS GuardDuty is an intelligent threat detection service that continuously monitors for malicious or unauthorized behavior. It leverages machine learning to analyze CloudTrail events, VPC Flow Logs, and DNS logs. This is essential for organizations because it identifies threats without requiring the management of complex rule sets, helping teams respond quickly to compromised accounts or malicious instances within the environment.

Answer

AWS Macie.

Answer

AWS WAF.

Answer

AWS CloudTrail.