SCS-C03 Detection Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. The log entry shows a denied 'DeleteTable' attempt. Which service, if configured, would have automatically triggered an alert based on this specific log entry?

Accepted Answer

Amazon CloudWatch Metric Filters and Alarms.. This log entry represents an unauthorized attempt to modify critical infrastructure. To alert on this, one must integrate CloudTrail with Amazon CloudWatch Logs and establish a Metric Filter that matches the 'Denied' status and the 'DeleteTable' action. This pattern is essential for incident response, as it allows security teams to distinguish between accidental user error and potential malicious reconnaissance or destructive intent by an insider.

Answer

Amazon GuardDuty.

Answer

AWS Security Hub.

Answer

AWS Trusted Advisor.

Question 2

A security engineer needs to detect if any EC2 instances in an account have been launched with a public IP address. Which service should be used to automate this detection?

Accepted Answer

AWS Config.. AWS Config is a powerful tool for enforcing compliance with infrastructure policies. By using managed rules like 'ec2-instance-no-public-ip', the engineer can automatically flag any instance that violates the policy. This is a critical detective control for preventing unauthorized network exposure, enabling the team to remediate the violation before a security incident occurs, which is essential for maintaining a hardened, private-by-default cloud environment.

Answer

AWS CloudTrail.

Answer

Amazon GuardDuty.

Answer

AWS Systems Manager.

Question 3

A security team needs to identify which IAM users have not used their credentials for more than 90 days. Which service should be used to provide this information?

Accepted Answer

IAM Credential Report.. IAM credential reports are the standard way to audit account security. They provide a comprehensive, comma-separated file that contains information about all users in the account and the status of their credentials, including password, access keys, and MFA status. This is critical for security hygiene and compliance, as it allows administrators to proactively disable or remove stale accounts, reducing the risk of unauthorized access via forgotten credentials.

Answer

AWS CloudTrail.

Answer

AWS Config.

Answer

AWS Trusted Advisor.

Question 4

A company wants to aggregate security findings from AWS GuardDuty, AWS Inspector, and AWS Macie into a single dashboard for prioritized viewing. Which service should be used to provide this consolidated view of security alerts?

Accepted Answer

AWS Security Hub. AWS Security Hub is the primary service for aggregating, organizing, and prioritizing security findings from multiple AWS services. It provides a comprehensive view of the security state of an AWS environment by collecting data from GuardDuty, Inspector, Macie, and third-party products, facilitating a more effective incident response and compliance monitoring process.

Answer

Amazon CloudWatch ServiceLens

Answer

AWS Trusted Advisor

Answer

AWS Config Aggregator

Question 5

An organization is running critical workloads on Amazon EKS and wants to detect suspicious activity at the container runtime level, such as unauthorized process execution or unexpected file access. Which GuardDuty feature should be enabled to achieve this level of visibility?

Accepted Answer

GuardDuty Runtime Monitoring. GuardDuty Runtime Monitoring for EKS provides deep visibility into container-level activities. It uses a lightweight agent (GuardDuty security agent) deployed as a DaemonSet to monitor system calls and process execution. This allows GuardDuty to detect threats that occur within the container itself, which standard VPC Flow Logs or CloudTrail cannot see.

Answer

GuardDuty EKS Audit Log Monitoring

Answer

Amazon Inspector Container Scanning

Answer

VPC Traffic Mirroring for EKS Worker Nodes

Question 6

During an investigation into an EC2 instance compromise, a security analyst needs to understand the relationship between different AWS resources, such as which IAM roles were used and which IP addresses interacted with the instance. Which service should the analyst use to perform this graph-based investigation?

Accepted Answer

Amazon Detective. Amazon Detective automatically collects log data from AWS resources and uses machine learning, statistical analysis, and graph theory to build a linked data set. This allows analysts to visualize and investigate the root cause of security findings by exploring the relationships and activities between users, roles, and IP addresses.

Answer

Amazon CloudWatch Logs Insights

Answer

AWS CloudTrail

Answer

AWS Security Hub

Question 7

An organization wants to improve its vulnerability management posture by ensuring that all Amazon EC2 instances are regularly scanned for software vulnerabilities and unintended network exposure. Which TWO features of Amazon Inspector help achieve this?

Accepted Answer

Continuous scanning for software vulnerabilities in installed packages.. Amazon Inspector is an automated vulnerability management service. It continuously scans EC2 instances for software vulnerabilities (using the SSM Agent) and network reachability issues. This dual approach ensures that both internal software flaws and external configuration weaknesses are identified and reported to the security team.

Answer

Automated remediation of insecure Security Group rules.

Answer

Real-time detection of brute-force login attempts.

Answer

Malware scanning for EBS volumes attached to instances.

Question 8

A financial institution requires that all CloudTrail logs be stored for seven years for compliance audits. They also need the ability to run complex SQL queries against these logs to identify specific user actions across all regions. What is the most cost-effective and operationally simple solution?

Accepted Answer

Use CloudTrail Lake to create an event data store with a seven-year retention period.. CloudTrail Lake is a managed data lake that simplifies the storage and analysis of CloudTrail events. It eliminates the need to build complex ETL pipelines between S3, Glue, and Athena. It provides a built-in SQL query engine and supports long-term retention policies suitable for compliance requirements.

Answer

Store logs in an S3 bucket and use Amazon Athena to run SQL queries.

Answer

Stream logs to Amazon OpenSearch Service for real-time indexing and visualization.

Answer

Enable CloudWatch Logs for CloudTrail and use Logs Insights for querying.

Question 9

Which THREE of the following resource types are currently supported by IAM Access Analyzer to identify potential public or cross-account access?

Accepted Answer

Amazon S3 Buckets. IAM Access Analyzer helps identify resources in your organization and accounts that are shared with an external entity. It does this by analyzing resource-based policies. This helps security teams identify unintended access to sensitive data or infrastructure and is a critical part of the 'Detection' domain.

Answer

Amazon DynamoDB Tables

Answer

Amazon EC2 Security Groups

Question 10

Refer to the exhibit. This GuardDuty finding indicates that malware was detected on an EC2 instance. What is the process GuardDuty used to perform this scan without installing an agent on the instance?

Accepted Answer

It takes a snapshot of the EBS volume, restores it to a service-owned account, and scans the volume there.. GuardDuty Malware Protection performs agentless scans of EBS volumes. When a suspicious finding is triggered (like a command-and-control communication), GuardDuty creates a snapshot of the EBS volumes, shares them with a service-linked account, and then attaches them to a scanning instance to perform a malware analysis.

Answer

It uses the AWS Systems Manager (SSM) Agent to run a remote anti-virus script on the instance.

Answer

It performs deep packet inspection (DPI) on the VPC traffic to identify malware being downloaded.

Answer

It uses the GuardDuty Security Agent to perform a memory dump and analyze it for malicious strings.

Question 11

A security engineer wants to enable manual remediation of Security Hub findings directly from the AWS console. They want to be able to select a finding and trigger a specific Lambda function to isolate an instance. What is the correct way to configure this?

Accepted Answer

Create a Security Hub Custom Action and an EventBridge rule that triggers the Lambda function based on the Action ID.. Security Hub Custom Actions allow users to create custom response and remediation workflows. When a custom action is triggered by a user in the console, Security Hub sends the selected finding(s) to Amazon EventBridge. An EventBridge rule then matches the custom action ARN and triggers the associated Lambda function.

Answer

Use the Security Hub 'Auto-Remediate' feature to link a finding type directly to a Lambda function.

Answer

Configure a CloudWatch Alarm to monitor Security Hub findings and trigger an SNS topic for remediation.

Answer

Enable the 'Remediation' standard in Security Hub and select the 'Isolate EC2' managed rule.

Question 12

A security team needs to perform deep packet inspection (DPI) on traffic entering and leaving a specific EC2 instance to look for complex attack signatures that VPC Flow Logs cannot detect. Which AWS feature should they use to facilitate this?

Accepted Answer

VPC Traffic Mirroring. VPC Traffic Mirroring allows you to copy network traffic from an elastic network interface (ENI) of an EC2 instance and send it to a security appliance for inspection. This is essential for deep packet inspection (DPI), as it provides the actual packet payloads, unlike Flow Logs which only provide metadata.

Answer

VPC Flow Logs with custom format fields.

Answer

Amazon GuardDuty Network Monitoring

Answer

AWS Network Firewall with stateless rules.

Question 13

A security analyst needs to detect potential exfiltration of sensitive data from an S3 bucket that has public access blocked. Which Amazon GuardDuty feature should be configured to detect anomalous data access patterns by internal IAM users?

Accepted Answer

Activate S3 Protection in Amazon GuardDuty.. GuardDuty S3 Protection analyzes CloudTrail S3 data events to detect anomalous activities, such as unusual access patterns or data access from unexpected locations. This feature is essential for identifying compromised identities that attempt to mass-download objects. By focusing on data-level events, it provides visibility into malicious behavior that standard API monitoring might miss, ensuring that even authorized users are monitored for activity that deviates from their historical baseline profile.

Answer

Enable VPC Flow Logs analysis within GuardDuty.

Answer

Configure AWS CloudTrail Insights for the S3 management events.

Answer

Deploy Macie to monitor S3 bucket access logs.

Question 14

A company wants to detect when an IAM user executes a command from a suspicious IP address. Which tool can analyze historical CloudTrail data to establish a baseline of normal behavior and trigger alerts upon deviations?

Accepted Answer

Amazon GuardDuty.. Amazon GuardDuty provides automated anomaly detection based on CloudTrail, VPC Flow Logs, and DNS logs. It uses machine learning to profile typical user behavior and detects deviations such as logins from unusual locations or IP addresses associated with known malicious actors. This is crucial for environments where manual rule creation is impossible due to the sheer volume of users, as it identifies threats without requiring static IP allow-lists.

Answer

CloudWatch Contributor Insights.

Answer

AWS CloudTrail Insights.

Answer

AWS Config.

Question 15

Which TWO actions should be taken to ensure that Amazon GuardDuty has the necessary data to detect unauthorized cryptocurrency mining instances?

Accepted Answer

Enable VPC Flow Logs in all regions.. GuardDuty relies on both VPC Flow Logs and DNS logs to identify crypto-mining patterns. Flow logs enable the detection of connections to known mining pool endpoints, while DNS logs reveal attempts to resolve these malicious domain names. Providing these inputs ensures GuardDuty's machine learning models can accurately correlate network activity with known bad actors, which is vital for maintaining the performance and integrity of the compute infrastructure against resource hijacking.

Answer

Configure CloudWatch Logs with metric filters.

Answer

Install the CloudWatch agent on all instances.

Answer

Create an IAM role for GuardDuty to access S3.