SCS-C03 Incident Response — 15 Questions

Question 1

A security analyst suspects an EC2 instance is compromised and being used for command and control (C2) communication. Which TWO actions should be performed to preserve evidence while containing the threat?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a snapshot of the instance's attached EBS volumes for forensic analysis.. To preserve evidence while containing the threat, modifying the security group to block all inbound and outbound traffic (Option C) stops malicious communication while keeping the instance running for memory acquisition. Creating a snapshot of the EBS volumes (Option B) preserves the disk state for later forensic analysis. Terminating or rebooting the instance (Options A and D) destroys volatile memory data (RAM) before it can be captured.

Answer

Terminate the EC2 instance immediately to stop the malicious traffic.

Answer

Reboot the instance to clear any malicious processes running in the background.

Answer

Delete all snapshots to prevent the attacker from accessing them.

Question 2

Which THREE AWS services are critical for automating an incident response plan for detecting and containing unauthorized IAM credential usage?

Accepted Answer

AWS CloudTrail. Integrating AWS CloudTrail, Amazon GuardDuty, and AWS Lambda creates an automated loop: CloudTrail logs the activity, GuardDuty detects the anomaly (unauthorized IAM use), and Lambda executes the remediation (e.g., attaching an inline deny policy). This trifecta is essential for meeting the 'Respond' function of the NIST framework within AWS, as it enables rapid, scalable intervention without requiring human intervention for common, well-defined security threats in the cloud.

Answer

AWS Glue

Answer

AWS Direct Connect

Question 3

An incident responder is investigating a potential data breach where an attacker accessed an S3 bucket. The responder wants to confirm the identity that performed the suspicious GetObject calls. Which log source should be reviewed first?

Accepted Answer

AWS CloudTrail Data Events. CloudTrail Data Events provide the necessary visibility into object-level API activity. While management events track bucket-level changes, they do not capture the specific GetObject calls made by an identity on individual files. Reviewing Data Events allows the responder to map the exact user identity, the source IP address, and the specific object accessed, which is critical for determining the scope and impact of the data exfiltration attempt.

Answer

AWS CloudTrail Management Events

Answer

VPC Flow Logs for the S3 interface endpoint

Answer

AWS Config compliance history

Question 4

Following a successful incident response, the team is performing a lessons-learned activity. Which action is most important to ensure the same vulnerability is not exploited again?

Accepted Answer

Write a report detailing the attacker's identity and share it with the police.. Updating the Incident Response Plan and implementing automated preventive controls is the core of the 'Lessons Learned' phase. By analyzing the root cause and applying infrastructure-as-code updates or service control policies (SCPs), the team ensures that the environment is hardened against similar vectors. This closes the loop on the incident, transforming reactive response into proactive security posture, which is essential for maintaining long-term compliance and risk management in a dynamic cloud environment.

Answer

Delete all IAM users and recreate them with complex passwords.

Answer

Increase the logging level for all services to capture more data.

Answer

Provide additional training to all employees on phishing prevention.

Question 5

Refer to the exhibit. An administrator accidentally applied this bucket policy. What is the immediate impact on the ability to manage the S3 bucket?

Accepted Answer

Only the root user can still delete the bucket.. While an explicit Deny in a bucket policy overrides Allow statements, the AWS root user account is an exception. The root user can still perform actions on an S3 bucket even if a bucket policy denies access, provided the root user removes or modifies the bucket policy itself. The statement that the root user is locked out is technically inaccurate regarding the root user's inherent ability to modify bucket policies.

Answer

No user, including the root user, can delete the bucket.

Answer

The policy is invalid because a Deny statement requires an explicit Condition block.

Answer

Users can still delete the bucket if they have an Allow policy in their IAM user.

Question 6

During an incident, a security responder realizes that an attacker has gained persistence by modifying an IAM role. What is the first step to remediate this threat?

Accepted Answer

Revert the IAM role policy to a known-good configuration.. While reverting the policy is a remediation step, it does not immediately stop an attacker who already has active sessions using the compromised credentials. The first step to stop the threat is to revoke active sessions (e.g., using the 'iam:RevokeSessions' policy or updating the policy to deny all actions) before reverting the configuration.

Answer

Terminate all EC2 instances attached to the role.

Answer

Delete the IAM role and recreate it with the original permissions.

Answer

Enable Multi-Factor Authentication (MFA) for the IAM role.

Question 7

An organization detects unauthorized access to their AWS account. They want to ensure they have an audit trail that cannot be tampered with by the attacker. Which configuration provides the highest level of integrity for CloudTrail logs?

Accepted Answer

Enabling CloudTrail log file integrity validation.. While CloudTrail log file integrity validation detects tampering, it does not prevent it. To ensure logs cannot be tampered with (deleted or modified) by an attacker, S3 Object Lock in Compliance mode should be used. If the question implies preventing tampering, the current answer is insufficient.

Answer

Storing logs in an S3 bucket with public access enabled.

Answer

Encrypting the S3 bucket with a default AWS-managed KMS key.

Answer

Using an S3 bucket in a different region than the logs.

Question 8

An incident responder receives an alert about a potential brute-force attack on an IAM user. What is the most immediate action to contain the threat?

Accepted Answer

Disable the IAM user account immediately.. Disabling the IAM user immediately revokes all access for that user, effectively containing the brute-force attack by preventing further authentication attempts. This is the most direct and immediate containment action.

Answer

Increase the password complexity requirements for all users.

Answer

Configure a CloudWatch alarm to notify the security team.

Answer

Delete the IAM group the user belongs to.

Question 9

Which THREE actions are essential for a post-incident review (PIR) to ensure continuous improvement in an AWS environment?

Accepted Answer

Analyze CloudTrail and VPC Flow Logs to reconstruct the attack timeline.. A PIR is meant to identify root causes, document findings, and update preventive measures. Reviewing logs to understand the attack path, updating security policies based on the findings, and refining automated alerts are the three pillars of turning a crisis into a stronger security posture. These steps ensure that the organization learns from the incident and proactively hardens its infrastructure against future threats of a similar nature.

Answer

Notify the media about the incident to maintain transparency.

Answer

Rotate all root account passwords for all AWS accounts.

Question 10

An organization suspects that an attacker has gained access to their environment via an overly permissive IAM role. They need to identify which resources have been accessed by this role. Which tool provides the most direct view of this activity?

Accepted Answer

AWS IAM Access Analyzer. AWS CloudTrail is the primary service for logging and tracking API calls and resource access in AWS. (Note: If CloudTrail is missing from the options, this question contains invalid options).

Answer

AWS Config timeline view

Answer

Amazon GuardDuty summary page

Answer

AWS Trusted Advisor

Question 11

A security operations team is designing an automated incident response pipeline for compromised IAM credentials. When an alert triggers, the automation must immediately revoke existing sessions and secure the affected user account. Which TWO actions should be included in the automated remediation workflow? (Choose two.)

Accepted Answer

Attach an inline policy to the IAM user with an explicit Deny effect for all actions across all resources to block subsequent API requests.. While attaching an explicit Deny policy (Option A) is correct, updating an IAM user password does not revoke existing temporary security credentials (session tokens) generated via STS. To revoke active sessions for an IAM user, one must attach an inline policy with a Deny effect that includes a condition for 'aws:TokenIssueTime' or simply deny all actions. Option C is partially correct regarding access keys, but the explanation incorrectly claims password rotation invalidates active sessions.

Answer

Delete the IAM user and recreate it with identical permissions once the incident has been successfully resolved and validated.

Answer

Modify the IAM user's assigned group memberships to remove administrative privileges without altering direct inline policies.

Answer

Enable AWS CloudTrail Lake event data stores to capture future API activities originating from the compromised principal.

Question 12

Refer to the exhibit. An organization uses this bucket policy to restrict S3 access to their internal network. During an incident, the security team notices that an IAM role with AdministratorAccess can still access the bucket from an external network. Why?

Accepted Answer

The policy is missing an Allow statement for the internal network.. The correct reason an AdministratorAccess role can bypass a bucket policy Deny is that the bucket policy likely contains a condition that excludes the IAM role (e.g., 'StringNotLike' with an 'aws:PrincipalArn' condition) or the policy is not actually denying the Administrator role. AWS services do not 'ignore' Deny policies. The provided explanation is technically inaccurate regarding AWS service behavior.

Answer

AdministratorAccess policies override bucket policy Deny statements.

Answer

The request is coming from an AWS service, which ignores the Deny policy.

Answer

The Condition block only applies to the root user.

Question 13

An organization experiences a ransomware attack on an EC2-based application. The incident response plan requires restoring from backups stored in an S3 bucket in a separate 'backup' AWS account. How can this be done securely while adhering to the principle of least privilege?

Accepted Answer

Use S3 bucket policies in the backup account to grant the production role access.. While S3 bucket policies are necessary, they are not sufficient on their own. The production account's IAM role must also have a corresponding IAM policy that grants permission to access the S3 bucket in the backup account. The explanation should clarify that both resource-based policies (bucket policy) and identity-based policies (IAM policy) are required for cross-account access.

Answer

Create a cross-account IAM role in the backup account and share the credentials.

Answer

Enable public read access on the backup bucket during the recovery process.

Answer

Merge the production and backup accounts into a single account.

Question 14

Your organization uses AWS GuardDuty to monitor for threats. During an incident, you see a 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration' finding. What is the most immediate action the incident response team should take?

Accepted Answer

Revoke active IAM sessions associated with the compromised credentials.. While revoking sessions is the correct goal, AWS IAM does not have a single 'revoke all sessions' button for temporary credentials. The standard remediation for 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration' involves attaching an inline policy to the IAM role (or user) with an 'aws:TokenIssueTime' condition to deny all actions, effectively invalidating the existing temporary security credentials. The explanation should reflect this specific remediation step.

Answer

Update the security group of the instance to block all egress traffic.

Answer

Delete the IAM user associated with the instance role.

Answer

Disable the GuardDuty service to stop the alerts.

Question 15

Your organization is performing post-incident analysis on a compromised EC2 instance. The security team needs to verify if the instance was part of a botnet. Which service allows you to inspect network traffic patterns for evidence of malicious communication?

Accepted Answer

VPC Traffic Mirroring. VPC Traffic Mirroring is indeed the correct answer for deep packet inspection. However, VPC Flow Logs are also a standard tool for identifying botnet patterns (e.g., beaconing, unusual port activity, or high-volume traffic to known malicious IPs). The explanation should clarify that while Flow Logs provide metadata, Traffic Mirroring is required for the full payload analysis requested.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

Amazon Inspector