SCS-C02 Practice Test 14 — 15 Questions

Question 1

A company uses AWS CloudTrail to log API calls in all accounts. The security team wants to be notified immediately when an IAM user creates a new access key for another user. Which combination of services should the team use?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Logs, and Amazon Simple Notification Service (SNS).. Option D is correct because it uses CloudTrail to capture the CreateAccessKey API call, sends those logs to CloudWatch Logs, and then triggers a CloudWatch alarm that publishes to an SNS topic for immediate notification. This combination provides real-time alerting on the specific IAM event without requiring additional services.

Answer

AWS Config and Amazon Simple Email Service (SES).

Answer

Amazon GuardDuty and Amazon Simple Notification Service (SNS).

Answer

Amazon Macie and AWS Lambda.

Question 2

A security team is setting up incident response automation. Which TWO steps should be taken to ensure that a compromised EC2 instance is isolated while preserving forensic data? (Choose TWO.)

Accepted Answer

Remove the instance from any Auto Scaling group or load balancer target group.. Option C is correct because removing the instance from Auto Scaling groups or load balancer target groups stops new traffic from being routed to it, effectively isolating it from application traffic without destroying the instance. Option D is correct because creating an EBS snapshot preserves the root volume's data for forensic analysis before any changes occur. Together, these steps ensure the instance is isolated for investigation while retaining evidence.

Answer

Assign a new security group that denies all inbound and outbound traffic.

Answer

Shut down the instance from the OS.

Answer

Terminate the instance.

Question 3

Refer to the exhibit. A security engineer is reviewing a resource-based policy attached to an AWS Lambda function. The engineer notices that the policy allows any Lambda function in the account to invoke the function. Which security concern should the engineer address?

Accepted Answer

The policy allows invocation from any Lambda function across all AWS accounts.. Option C is correct because the resource-based policy on the Lambda function uses a principal of `*` without any condition key (such as `aws:SourceAccount` or `aws:SourceArn`) to restrict invocation to only the same account. This means any Lambda function in any AWS account can invoke this function, which is a security concern as it allows cross-account invocation without authorization.

Answer

The policy grants excessive permissions by allowing all actions.

Answer

The policy does not specify a resource ARN, so it applies to all functions.

Answer

The policy allows the Lambda service to modify the function code.

Question 4

During an incident response, a security engineer needs to collect memory forensics from a running EC2 instance without shutting it down. The instance is running Amazon Linux 2. Which tool is MOST appropriate?

Accepted Answer

LiME (Linux Memory Extractor). LiME (Linux Memory Extractor) is the most appropriate tool for capturing volatile memory from a running Amazon Linux 2 EC2 instance without shutting it down. It is specifically designed to dump RAM contents to a file or over a network, minimizing the footprint on the target system and ensuring the integrity of the forensic acquisition.

Answer

tcpdump

Answer

Volatility

Answer

dd command to capture /dev/mem

Question 5

A security engineer notices that an EC2 instance is sending outbound traffic to a known malicious IP address. The instance is part of an Auto Scaling group behind an Application Load Balancer. The engineer needs to immediately stop the exfiltration while preserving forensic evidence. What is the BEST course of action?

Accepted Answer

Remove the instance from the target group and apply a security group that denies all traffic.. Option D is correct because removing the instance from the target group immediately stops new traffic from the Application Load Balancer to the instance, while applying a security group that denies all outbound traffic (e.g., a custom security group with no outbound rules) halts any ongoing exfiltration without destroying the instance or its attached EBS volumes. This preserves the forensic evidence (memory, disk, logs) for later analysis, unlike termination or shutdown which could lose volatile data.

Answer

Detach the EBS volume from the instance.

Answer

Terminate the EC2 instance immediately.

Answer

Shut down the instance from within the OS.

Question 6

A company uses AWS Organizations and has GuardDuty enabled in all accounts. The security team wants to suppress low-severity findings that are known false positives for a specific member account. How can this be achieved with minimal administrative overhead?

Accepted Answer

In the member account, create a suppression rule in GuardDuty for the specific finding types.. Option B is correct because GuardDuty supports suppression rules that can be created at the member account level to automatically archive low-severity findings that are known false positives. This approach allows the member account to manage its own findings without requiring changes to the GuardDuty configuration in the management account or other accounts, minimizing administrative overhead.

Answer

Disable GuardDuty for that member account and rely on other accounts.

Answer

Use AWS Security Hub insights to filter out those findings from the aggregated view.

Answer

Ask the delegated administrator to add a suppression rule in the GuardDuty console for that account.

Question 7

A company uses AWS CloudTrail to log all API calls. The security team notices a series of `UpdateTrail` API calls from a user in the Security account, disabling logging on a multi-region trail. The user has a policy that allows `cloudtrail:UpdateTrail` only on trails with a specific tag. However, the trail does not have that tag. What is the MOST likely reason the call succeeded?

Accepted Answer

The trail did not have the required tag at the time of the API call due to a race condition.. Option A is correct because AWS IAM policies are evaluated based on the resource's tags at the time of the API call. If the `UpdateTrail` API call was made while the trail's tag was being removed or added, a race condition could cause the trail to temporarily lack the required tag, allowing the action to succeed despite the policy's intent. This is a known edge case in IAM tag-based authorization, where eventual consistency of tag changes can lead to unintended access.

Answer

The trail had an explicit deny in the same policy that was overridden by a separate allow.

Answer

The user's permissions were granted through a service control policy (SCP) that allowed the action.

Answer

CloudTrail API calls are not logged and bypass IAM policies.

Question 8

A security engineer is designing an incident response plan for a compromised S3 bucket. Which TWO actions should be taken to contain the incident? (Choose TWO.)

Accepted Answer

Enable CloudTrail data events for the bucket to log all object-level operations.. Enabling CloudTrail data events for the S3 bucket (Option C) is a critical detective control that logs all object-level operations (e.g., GetObject, PutObject, DeleteObject). This allows the security engineer to perform forensic analysis, identify the scope of the compromise, and understand the attacker's actions, which is essential for containment and remediation. While not a direct containment action, it is a necessary step to gather evidence before or during containment.

Answer

Delete the bucket and recreate it.

Answer

Enable MFA Delete on the bucket.

Answer

Enable default encryption for the bucket.

Question 9

A security analyst needs to detect and alert on suspicious API calls in real time. Which combination of AWS services should be used?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Logs, and Amazon EventBridge.. AWS CloudTrail captures API calls and delivers log files to Amazon CloudWatch Logs, where you can define metric filters to detect suspicious patterns. Amazon EventBridge then consumes those filtered log events to trigger real-time alerts or automated remediation actions. This combination provides the end-to-end pipeline needed for real-time detection and alerting on API activity.

Answer

Amazon Inspector and AWS CloudTrail.

Answer

Amazon GuardDuty and AWS Lambda.

Answer

AWS Config and Amazon SNS.

Question 10

An organization is using Amazon EKS for container workloads. The security team wants to detect container escape attempts. Which THREE AWS services or features should be enabled? (Choose THREE.)

Accepted Answer

AWS Security Hub. Amazon GuardDuty with EKS Runtime Monitoring (Option D) detects container escape attempts by monitoring Kubernetes audit logs and runtime behavior at the host and container level. AWS CloudTrail (Option E) records API calls to EKS, including suspicious actions like unauthorized pod creation or privilege escalation. AWS Security Hub (Option B) aggregates findings from GuardDuty and CloudTrail, providing a centralized view of container escape alerts and enabling automated incident response workflows.

Answer

AWS WAF

Answer

VPC Flow Logs

Question 11

A company uses AWS Organizations with multiple accounts. The security team wants to centrally collect and analyze VPC Flow Logs from all accounts. What is the MOST efficient way to achieve this?

Accepted Answer

Configure VPC Flow Logs to deliver to a central S3 bucket in the security account, and use a bucket policy that grants the source accounts permission to write.. Option C is correct because it uses a central S3 bucket in the security account with a bucket policy that grants the PutObject permission to the VPC Flow Logs delivery service from each source account. This is the most efficient approach as it avoids per-account configuration overhead, eliminates the need for cross-account replication, and provides a single location for centralized analysis using services like Amazon Athena or Amazon QuickSight.

Answer

Use AWS Firewall Manager to deploy VPC Flow Logs and aggregate logs in a single account.

Answer

Configure VPC Flow Logs to deliver to a central CloudWatch Logs log group in the management account.

Answer

Set up VPC Flow Logs in each account to deliver to local S3 buckets, then use S3 replication to copy to a central bucket.

Question 12

A company has a multi-account AWS environment with hundreds of accounts. The security team needs to ensure that all security findings from GuardDuty, Security Hub, and Detective are centrally collected and correlated. Which architecture is the MOST scalable and cost-effective?

Accepted Answer

Enable AWS Security Hub as the central aggregator, with GuardDuty and Detective integrated. Use Security Hub cross-account aggregation.. Option B is correct because AWS Security Hub natively supports cross-account aggregation via a delegated administrator, allowing findings from GuardDuty, Security Hub, and Detective to be centrally collected without custom code. This architecture is both scalable (handles hundreds of accounts without polling or custom infrastructure) and cost-effective (no additional Lambda, DynamoDB, or S3 query costs), leveraging built-in integrations and consolidated findings views.

Answer

Deploy a central Lambda function that polls each account's GuardDuty, Security Hub, and Detective APIs and stores findings in DynamoDB.

Answer

Configure each account to send findings to a central CloudWatch Logs log group and use CloudWatch Logs Insights to correlate.

Answer

Stream all findings from all services to a central Amazon S3 bucket and use Amazon Athena to query them.

Question 13

Your organization uses AWS Organizations with 50 member accounts. You are the security administrator for the root account. You have enabled AWS CloudTrail in all accounts and centralized the logs in an S3 bucket in the root account. You also enabled Amazon GuardDuty in the root account and have delegated an administrator account. Recently, you received an alert from GuardDuty about a potential credential compromise in a member account. The finding indicates that an IAM user in that account made an API call from an unusual IP address. You need to quickly gather all CloudTrail events for that user from the last 30 days across all accounts. The logs are stored in a single S3 bucket with a prefix structure like 'AWSLogs//CloudTrail////'. What is the MOST efficient way to query these logs?

Accepted Answer

Use Amazon Athena to query the CloudTrail logs by creating a table partitioned by account, region, and date.. Amazon Athena is the most efficient way to query CloudTrail logs stored in S3 because it allows you to run SQL queries directly on the data without moving or downloading it. By creating a table partitioned by account, region, and date, you can quickly filter for the specific IAM user's events across all 50 accounts for the last 30 days, leveraging partition pruning to scan only the relevant log files. This approach minimizes data scanned and cost, while providing near-instant results.

Answer

Enable AWS CloudTrail Lake and create a new event data store that includes the historical logs.

Answer

Download all log files from the S3 bucket for the last 30 days and parse them locally.

Answer

Use Amazon CloudWatch Logs Insights to query the logs from the member account.

Question 14

A security engineer is configuring an automated response to a GuardDuty finding that indicates a compromised EC2 instance. The engineer wants to isolate the instance by changing its security group to a 'quarantine' group. Which AWS service is BEST suited to automate this response?

Accepted Answer

Amazon EventBridge. Amazon EventBridge is the best choice because it can directly receive GuardDuty findings as events and trigger an automated response, such as invoking a Lambda function or Systems Manager Automation runbook to change the EC2 instance's security group to a quarantine group. EventBridge provides native integration with GuardDuty via its default event bus, enabling real-time, event-driven automation without additional orchestration overhead.

Answer

AWS Step Functions

Answer

AWS Config

Answer

AWS Systems Manager Automation

Question 15

A company's security team is designing an incident response plan for AWS resources. They want to ensure that when a security incident is detected in a production account, a pre-defined runbook is executed automatically. The runbook includes steps to isolate the compromised resource and collect forensic evidence. Which combination of services should the team use to implement this automation?

Accepted Answer

AWS Systems Manager Incident Manager and AWS Systems Manager Automation. AWS Systems Manager Incident Manager provides the incident management lifecycle, including automated response plans that trigger runbooks when an incident is detected. AWS Systems Manager Automation runbooks contain predefined steps (e.g., isolating EC2 instances, capturing memory dumps, and collecting logs) that can be executed automatically. This combination directly meets the requirement for a pre-defined runbook that isolates the compromised resource and collects forensic evidence.

Answer

Amazon EventBridge and AWS Lambda

Answer

AWS Config and Amazon EC2 Auto Scaling

Answer

AWS Step Functions and AWS Lambda