SCS-C03 Incident Response — All Questions With Answers

Question 1

A security analyst suspects an EC2 instance is compromised and being used for command and control (C2) communication. Which TWO actions should be performed to preserve evidence while containing the threat?

Accepted Answer

Create a snapshot of the instance's attached EBS volumes for forensic analysis.. To preserve evidence while containing the threat, modifying the security group to block all inbound and outbound traffic (Option C) stops malicious communication while keeping the instance running for memory acquisition. Creating a snapshot of the EBS volumes (Option B) preserves the disk state for later forensic analysis. Terminating or rebooting the instance (Options A and D) destroys volatile memory data (RAM) before it can be captured.

Answer

Terminate the EC2 instance immediately to stop the malicious traffic.

Answer

Reboot the instance to clear any malicious processes running in the background.

Answer

Delete all snapshots to prevent the attacker from accessing them.

Question 2

Which THREE AWS services are critical for automating an incident response plan for detecting and containing unauthorized IAM credential usage?

Accepted Answer

AWS CloudTrail. Integrating AWS CloudTrail, Amazon GuardDuty, and AWS Lambda creates an automated loop: CloudTrail logs the activity, GuardDuty detects the anomaly (unauthorized IAM use), and Lambda executes the remediation (e.g., attaching an inline deny policy). This trifecta is essential for meeting the 'Respond' function of the NIST framework within AWS, as it enables rapid, scalable intervention without requiring human intervention for common, well-defined security threats in the cloud.

Answer

AWS Glue

Answer

AWS Direct Connect

Question 3

An incident responder is investigating a potential data breach where an attacker accessed an S3 bucket. The responder wants to confirm the identity that performed the suspicious GetObject calls. Which log source should be reviewed first?

Accepted Answer

AWS CloudTrail Data Events. CloudTrail Data Events provide the necessary visibility into object-level API activity. While management events track bucket-level changes, they do not capture the specific GetObject calls made by an identity on individual files. Reviewing Data Events allows the responder to map the exact user identity, the source IP address, and the specific object accessed, which is critical for determining the scope and impact of the data exfiltration attempt.

Answer

AWS CloudTrail Management Events

Answer

VPC Flow Logs for the S3 interface endpoint

Answer

AWS Config compliance history

Question 4

Following a successful incident response, the team is performing a lessons-learned activity. Which action is most important to ensure the same vulnerability is not exploited again?

Accepted Answer

Write a report detailing the attacker's identity and share it with the police.. Updating the Incident Response Plan and implementing automated preventive controls is the core of the 'Lessons Learned' phase. By analyzing the root cause and applying infrastructure-as-code updates or service control policies (SCPs), the team ensures that the environment is hardened against similar vectors. This closes the loop on the incident, transforming reactive response into proactive security posture, which is essential for maintaining long-term compliance and risk management in a dynamic cloud environment.

Answer

Delete all IAM users and recreate them with complex passwords.

Answer

Increase the logging level for all services to capture more data.

Answer

Provide additional training to all employees on phishing prevention.

Question 5

Refer to the exhibit. An administrator accidentally applied this bucket policy. What is the immediate impact on the ability to manage the S3 bucket?

Accepted Answer

Only the root user can still delete the bucket.. While an explicit Deny in a bucket policy overrides Allow statements, the AWS root user account is an exception. The root user can still perform actions on an S3 bucket even if a bucket policy denies access, provided the root user removes or modifies the bucket policy itself. The statement that the root user is locked out is technically inaccurate regarding the root user's inherent ability to modify bucket policies.

Answer

No user, including the root user, can delete the bucket.

Answer

The policy is invalid because a Deny statement requires an explicit Condition block.

Answer

Users can still delete the bucket if they have an Allow policy in their IAM user.

Question 6

During an incident, a security responder realizes that an attacker has gained persistence by modifying an IAM role. What is the first step to remediate this threat?

Accepted Answer

Revert the IAM role policy to a known-good configuration.. While reverting the policy is a remediation step, it does not immediately stop an attacker who already has active sessions using the compromised credentials. The first step to stop the threat is to revoke active sessions (e.g., using the 'iam:RevokeSessions' policy or updating the policy to deny all actions) before reverting the configuration.

Answer

Terminate all EC2 instances attached to the role.

Answer

Delete the IAM role and recreate it with the original permissions.

Answer

Enable Multi-Factor Authentication (MFA) for the IAM role.

Question 7

An organization detects unauthorized access to their AWS account. They want to ensure they have an audit trail that cannot be tampered with by the attacker. Which configuration provides the highest level of integrity for CloudTrail logs?

Accepted Answer

Enabling CloudTrail log file integrity validation.. While CloudTrail log file integrity validation detects tampering, it does not prevent it. To ensure logs cannot be tampered with (deleted or modified) by an attacker, S3 Object Lock in Compliance mode should be used. If the question implies preventing tampering, the current answer is insufficient.

Answer

Storing logs in an S3 bucket with public access enabled.

Answer

Encrypting the S3 bucket with a default AWS-managed KMS key.

Answer

Using an S3 bucket in a different region than the logs.

Question 8

An incident responder receives an alert about a potential brute-force attack on an IAM user. What is the most immediate action to contain the threat?

Accepted Answer

Disable the IAM user account immediately.. Disabling the IAM user immediately revokes all access for that user, effectively containing the brute-force attack by preventing further authentication attempts. This is the most direct and immediate containment action.

Answer

Increase the password complexity requirements for all users.

Answer

Configure a CloudWatch alarm to notify the security team.

Answer

Delete the IAM group the user belongs to.

Question 9

Which THREE actions are essential for a post-incident review (PIR) to ensure continuous improvement in an AWS environment?

Accepted Answer

Analyze CloudTrail and VPC Flow Logs to reconstruct the attack timeline.. A PIR is meant to identify root causes, document findings, and update preventive measures. Reviewing logs to understand the attack path, updating security policies based on the findings, and refining automated alerts are the three pillars of turning a crisis into a stronger security posture. These steps ensure that the organization learns from the incident and proactively hardens its infrastructure against future threats of a similar nature.

Answer

Notify the media about the incident to maintain transparency.

Answer

Rotate all root account passwords for all AWS accounts.

Question 10

An organization suspects that an attacker has gained access to their environment via an overly permissive IAM role. They need to identify which resources have been accessed by this role. Which tool provides the most direct view of this activity?

Accepted Answer

AWS IAM Access Analyzer. AWS CloudTrail is the primary service for logging and tracking API calls and resource access in AWS. (Note: If CloudTrail is missing from the options, this question contains invalid options).

Answer

AWS Config timeline view

Answer

Amazon GuardDuty summary page

Answer

AWS Trusted Advisor

Question 11

A security operations team is designing an automated incident response pipeline for compromised IAM credentials. When an alert triggers, the automation must immediately revoke existing sessions and secure the affected user account. Which TWO actions should be included in the automated remediation workflow? (Choose two.)

Accepted Answer

Attach an inline policy to the IAM user with an explicit Deny effect for all actions across all resources to block subsequent API requests.. While attaching an explicit Deny policy (Option A) is correct, updating an IAM user password does not revoke existing temporary security credentials (session tokens) generated via STS. To revoke active sessions for an IAM user, one must attach an inline policy with a Deny effect that includes a condition for 'aws:TokenIssueTime' or simply deny all actions. Option C is partially correct regarding access keys, but the explanation incorrectly claims password rotation invalidates active sessions.

Answer

Delete the IAM user and recreate it with identical permissions once the incident has been successfully resolved and validated.

Answer

Modify the IAM user's assigned group memberships to remove administrative privileges without altering direct inline policies.

Answer

Enable AWS CloudTrail Lake event data stores to capture future API activities originating from the compromised principal.

Question 12

Refer to the exhibit. An organization uses this bucket policy to restrict S3 access to their internal network. During an incident, the security team notices that an IAM role with AdministratorAccess can still access the bucket from an external network. Why?

Accepted Answer

The policy is missing an Allow statement for the internal network.. The correct reason an AdministratorAccess role can bypass a bucket policy Deny is that the bucket policy likely contains a condition that excludes the IAM role (e.g., 'StringNotLike' with an 'aws:PrincipalArn' condition) or the policy is not actually denying the Administrator role. AWS services do not 'ignore' Deny policies. The provided explanation is technically inaccurate regarding AWS service behavior.

Answer

AdministratorAccess policies override bucket policy Deny statements.

Answer

The request is coming from an AWS service, which ignores the Deny policy.

Answer

The Condition block only applies to the root user.

Question 13

An organization experiences a ransomware attack on an EC2-based application. The incident response plan requires restoring from backups stored in an S3 bucket in a separate 'backup' AWS account. How can this be done securely while adhering to the principle of least privilege?

Accepted Answer

Use S3 bucket policies in the backup account to grant the production role access.. While S3 bucket policies are necessary, they are not sufficient on their own. The production account's IAM role must also have a corresponding IAM policy that grants permission to access the S3 bucket in the backup account. The explanation should clarify that both resource-based policies (bucket policy) and identity-based policies (IAM policy) are required for cross-account access.

Answer

Create a cross-account IAM role in the backup account and share the credentials.

Answer

Enable public read access on the backup bucket during the recovery process.

Answer

Merge the production and backup accounts into a single account.

Question 14

Your organization uses AWS GuardDuty to monitor for threats. During an incident, you see a 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration' finding. What is the most immediate action the incident response team should take?

Accepted Answer

Revoke active IAM sessions associated with the compromised credentials.. While revoking sessions is the correct goal, AWS IAM does not have a single 'revoke all sessions' button for temporary credentials. The standard remediation for 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration' involves attaching an inline policy to the IAM role (or user) with an 'aws:TokenIssueTime' condition to deny all actions, effectively invalidating the existing temporary security credentials. The explanation should reflect this specific remediation step.

Answer

Update the security group of the instance to block all egress traffic.

Answer

Delete the IAM user associated with the instance role.

Answer

Disable the GuardDuty service to stop the alerts.

Question 15

Your organization is performing post-incident analysis on a compromised EC2 instance. The security team needs to verify if the instance was part of a botnet. Which service allows you to inspect network traffic patterns for evidence of malicious communication?

Accepted Answer

VPC Traffic Mirroring. VPC Traffic Mirroring is indeed the correct answer for deep packet inspection. However, VPC Flow Logs are also a standard tool for identifying botnet patterns (e.g., beaconing, unusual port activity, or high-volume traffic to known malicious IPs). The explanation should clarify that while Flow Logs provide metadata, Traffic Mirroring is required for the full payload analysis requested.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 16

An incident responder must rotate compromised access keys across 500 AWS accounts. Manually doing this is infeasible. What is the most efficient, programmatic way to automate this rotation while minimizing risk?

Accepted Answer

Use AWS Systems Manager Automation documents.. AWS Systems Manager (SSM) Automation documents, when combined with AWS Organizations and delegated administrator capabilities, provide the most scalable and secure way to execute cross-account incident response. Using SSM Automation allows for centralized execution across the organization without needing to manually configure individual Lambda triggers in every account.

Answer

Write a local Bash script and run it from your laptop.

Answer

Use an S3 bucket to share a list of compromised keys.

Answer

Use CloudWatch Events to trigger Lambda functions in every account.

Question 17

An organization detects unauthorized access to an Amazon S3 bucket containing sensitive customer data. The Security team needs to immediately isolate the bucket while ensuring logs are preserved for forensic analysis. Which action should the team take first?

Accepted Answer

Apply a bucket policy that denies all 's3:*' actions for all users except the security incident response role.. Immediately restricting access via a restrictive bucket policy is the most effective way to stop data exfiltration while keeping the bucket available for investigation. Unlike deleting the bucket, which destroys evidence, a policy change enforces least privilege while maintaining the integrity of the data store for future forensics. This approach aligns with the containment phase of the AWS incident response lifecycle, prioritizing the cessation of malicious activity before proceeding to deeper investigation.

Answer

Delete the S3 bucket to prevent further unauthorized data access.

Answer

Disable AWS CloudTrail logging to stop generating potentially malicious log entries.

Answer

Revoke all IAM user credentials globally to lock down the entire AWS account.

Question 18

Refer to the exhibit. An incident responder observes that an attacker bypassed this S3 bucket policy and accessed objects from an IP address outside the 192.0.2.0/24 range. What is the most likely reason for this access?

Accepted Answer

The policy uses 'Allow' instead of 'Deny', allowing bypass by any identity with broad IAM permissions.. The bucket policy is a resource-based policy that only grants permissions; it does not explicitly deny access from other IP addresses. In AWS, if an IAM user or role has an identity-based policy allowing 's3:GetObject' on that bucket, the resource-based policy will not restrict them unless it contains an explicit Deny. This behavior highlights the importance of using explicit Deny statements when enforcing network-based access controls on sensitive resources.

Answer

The bucket policy must include a Principal element to restrict access to specific identities.

Answer

The S3 bucket is configured with a public access block that is too permissive.

Answer

The 'aws:SourceIp' condition does not function for requests made through an AWS service like CloudFront.

Question 19

An organization experiences a ransomware attack that encrypts data across several EBS volumes. The team needs to restore operations as quickly as possible. Which strategy minimizes the impact of the incident while ensuring data integrity?

Accepted Answer

Restore the affected volumes from the latest pre-incident EBS snapshots.. Restoring from the most recent known-good EBS snapshot allows for the rapid recovery of data in a clean state. By leveraging snapshots, the team bypasses the need to decrypt the ransomware-affected data, which is time-consuming and often impossible without the attacker's key. This method is the standard recovery procedure for persistent storage threats in AWS, providing a clear path back to service availability after containment is complete.

Answer

Attempt to brute-force the ransomware decryption key using high-performance compute instances.

Answer

Copy the encrypted volumes to a new account and run a vulnerability scan.

Answer

Format the EBS volumes and manually copy data from the underlying S3 logs.

Question 20

An organization wants to improve their ability to respond to security incidents. Which TWO of the following services provide centralized visibility and management for security findings?

Accepted Answer

AWS Security Hub. AWS Security Hub and Amazon Detective are designed to aggregate, manage, and investigate security data. Security Hub acts as the central pane of glass for findings from various AWS services, while Detective provides the visualization tools needed to investigate the root cause of those findings. Together, they streamline the identification and triage process, allowing responders to move quickly from alert to conclusion during a security incident.

Answer

Amazon CloudWatch

Answer

AWS Artifact

Answer

AWS Systems Manager

SCS-C03 Incident Response — All Questions With Answers

A security analyst suspects an EC2 instance is compromised and being used for command and control (C2) communication. Which TWO actions should be performed to preserve evidence while containing the threat?

Which THREE AWS services are critical for automating an incident response plan for detecting and containing unauthorized IAM credential usage?

An incident responder is investigating a potential data breach where an attacker accessed an S3 bucket. The responder wants to confirm the identity that performed the suspicious GetObject calls. Which log source should be reviewed first?

Following a successful incident response, the team is performing a lessons-learned activity. Which action is most important to ensure the same vulnerability is not exploited again?

Refer to the exhibit. An administrator accidentally applied this bucket policy. What is the immediate impact on the ability to manage the S3 bucket?

Exhibit

During an incident, a security responder realizes that an attacker has gained persistence by modifying an IAM role. What is the first step to remediate this threat?

An organization detects unauthorized access to their AWS account. They want to ensure they have an audit trail that cannot be tampered with by the attacker. Which configuration provides the highest level of integrity for CloudTrail logs?

An incident responder receives an alert about a potential brute-force attack on an IAM user. What is the most immediate action to contain the threat?

Which THREE actions are essential for a post-incident review (PIR) to ensure continuous improvement in an AWS environment?

An organization suspects that an attacker has gained access to their environment via an overly permissive IAM role. They need to identify which resources have been accessed by this role. Which tool provides the most direct view of this activity?

Refer to the exhibit. An organization uses this bucket policy to restrict S3 access to their internal network. During an incident, the security team notices that an IAM role with AdministratorAccess can still access the bucket from an external network. Why?

Exhibit

An organization experiences a ransomware attack on an EC2-based application. The incident response plan requires restoring from backups stored in an S3 bucket in a separate 'backup' AWS account. How can this be done securely while adhering to the principle of least privilege?

Your organization uses AWS GuardDuty to monitor for threats. During an incident, you see a 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration' finding. What is the most immediate action the incident response team should take?

Your organization is performing post-incident analysis on a compromised EC2 instance. The security team needs to verify if the instance was part of a botnet. Which service allows you to inspect network traffic patterns for evidence of malicious communication?

An incident responder must rotate compromised access keys across 500 AWS accounts. Manually doing this is infeasible. What is the most efficient, programmatic way to automate this rotation while minimizing risk?

An organization detects unauthorized access to an Amazon S3 bucket containing sensitive customer data. The Security team needs to immediately isolate the bucket while ensuring logs are preserved for forensic analysis. Which action should the team take first?

Refer to the exhibit. An incident responder observes that an attacker bypassed this S3 bucket policy and accessed objects from an IP address outside the 192.0.2.0/24 range. What is the most likely reason for this access?

Exhibit

An organization experiences a ransomware attack that encrypts data across several EBS volumes. The team needs to restore operations as quickly as possible. Which strategy minimizes the impact of the incident while ensuring data integrity?

An organization wants to improve their ability to respond to security incidents. Which TWO of the following services provide centralized visibility and management for security findings?

An organization is preparing for a potential incident and wants to ensure that responders can quickly access logs across multiple accounts. Which architecture is recommended for centralized log management?

An incident response team discovers an unauthorized IAM user created an access key in a production environment. The team must identify the exact time of key creation and the IP address used for the call. Which AWS service provides this forensic detail?

A security incident indicates an EC2 instance is likely compromised and communicating with a C2 server. The security team needs to perform memory forensics and isolate the instance while preserving evidence. Which TWO actions should the team perform?

During a security incident involving suspected data exfiltration from an S3 bucket, which THREE sources provide the most relevant telemetry to determine what files were accessed?

Refer to the exhibit. An incident responder needs to access the production-data bucket to investigate a breach. They apply this policy to their IAM user, but get 'Access Denied' when running 'aws s3 ls s3://production-data'. Why?

Exhibit

SCS-C03 Incident Response — All Questions With Answers

A security analyst suspects an EC2 instance is compromised and being used for command and control (C2) communication. Which TWO actions should be performed to preserve evidence while containing the threat?

Which THREE AWS services are critical for automating an incident response plan for detecting and containing unauthorized IAM credential usage?

An incident responder is investigating a potential data breach where an attacker accessed an S3 bucket. The responder wants to confirm the identity that performed the suspicious GetObject calls. Which log source should be reviewed first?

Following a successful incident response, the team is performing a lessons-learned activity. Which action is most important to ensure the same vulnerability is not exploited again?

Refer to the exhibit. An administrator accidentally applied this bucket policy. What is the immediate impact on the ability to manage the S3 bucket?

Exhibit

During an incident, a security responder realizes that an attacker has gained persistence by modifying an IAM role. What is the first step to remediate this threat?

An organization detects unauthorized access to their AWS account. They want to ensure they have an audit trail that cannot be tampered with by the attacker. Which configuration provides the highest level of integrity for CloudTrail logs?

An incident responder receives an alert about a potential brute-force attack on an IAM user. What is the most immediate action to contain the threat?

Which THREE actions are essential for a post-incident review (PIR) to ensure continuous improvement in an AWS environment?

An organization suspects that an attacker has gained access to their environment via an overly permissive IAM role. They need to identify which resources have been accessed by this role. Which tool provides the most direct view of this activity?

Refer to the exhibit. An organization uses this bucket policy to restrict S3 access to their internal network. During an incident, the security team notices that an IAM role with AdministratorAccess can still access the bucket from an external network. Why?

Exhibit

An organization experiences a ransomware attack on an EC2-based application. The incident response plan requires restoring from backups stored in an S3 bucket in a separate 'backup' AWS account. How can this be done securely while adhering to the principle of least privilege?

Your organization uses AWS GuardDuty to monitor for threats. During an incident, you see a 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration' finding. What is the most immediate action the incident response team should take?

Your organization is performing post-incident analysis on a compromised EC2 instance. The security team needs to verify if the instance was part of a botnet. Which service allows you to inspect network traffic patterns for evidence of malicious communication?

An incident responder must rotate compromised access keys across 500 AWS accounts. Manually doing this is infeasible. What is the most efficient, programmatic way to automate this rotation while minimizing risk?

An organization detects unauthorized access to an Amazon S3 bucket containing sensitive customer data. The Security team needs to immediately isolate the bucket while ensuring logs are preserved for forensic analysis. Which action should the team take first?

Refer to the exhibit. An incident responder observes that an attacker bypassed this S3 bucket policy and accessed objects from an IP address outside the 192.0.2.0/24 range. What is the most likely reason for this access?

Exhibit

An organization experiences a ransomware attack that encrypts data across several EBS volumes. The team needs to restore operations as quickly as possible. Which strategy minimizes the impact of the incident while ensuring data integrity?

An organization wants to improve their ability to respond to security incidents. Which TWO of the following services provide centralized visibility and management for security findings?

An organization is preparing for a potential incident and wants to ensure that responders can quickly access logs across multiple accounts. Which architecture is recommended for centralized log management?

An incident response team discovers an unauthorized IAM user created an access key in a production environment. The team must identify the exact time of key creation and the IP address used for the call. Which AWS service provides this forensic detail?

A security incident indicates an EC2 instance is likely compromised and communicating with a C2 server. The security team needs to perform memory forensics and isolate the instance while preserving evidence. Which TWO actions should the team perform?

During a security incident involving suspected data exfiltration from an S3 bucket, which THREE sources provide the most relevant telemetry to determine what files were accessed?

Refer to the exhibit. An incident responder needs to access the production-data bucket to investigate a breach. They apply this policy to their IAM user, but get 'Access Denied' when running 'aws s3 ls s3://production-data'. Why?

Exhibit