SCS-C02 Mock Exam 89 — 25 Questions

Question 1

A company's security policy requires that all S3 bucket access logs be delivered to a central S3 bucket in the security account. A security engineer notices that some buckets are not delivering logs. The engineer needs to identify which buckets are not logging and ensure compliance. Which service should the engineer use to continuously monitor and report on S3 bucket logging?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired policies. By using an AWS Config managed rule like `s3-bucket-logging-enabled`, the security engineer can automatically detect S3 buckets that do not have logging enabled and receive compliance notifications, ensuring ongoing adherence to the security policy.

Answer

Amazon Macie

Answer

Amazon S3 Inventory

Answer

AWS CloudTrail

Question 2

Refer to the exhibit. A security engineer is analyzing VPC Flow Logs and notices a pattern of outbound traffic from an EC2 instance to an external IP on port 22 (SSH). The engineer wants to identify which instances are initiating SSH connections to the internet. Which field in the flow log record indicates the source of the connection?

Accepted Answer

The first IP address in the log entry (srcaddr). In VPC Flow Logs, the `srcaddr` field records the source IP address of the traffic. Since the engineer is looking for which EC2 instances are initiating outbound SSH connections (port 22), the source IP in the flow log entry (srcaddr) directly identifies the instance that started the connection. The direction of the traffic is determined by the source and destination fields, not by the port numbers alone.

Answer

The second IP address (dstaddr)

Answer

The first port number (srcport)

Answer

The second port number (dstport)

Question 3

A security engineer is investigating a potential compromise of an EC2 instance. The engineer wants to capture volatile memory data and create a forensic image of the instance's EBS volumes. Which TWO actions should the engineer take? (Choose 2.)

Accepted Answer

Use AWS Systems Manager Run Command to execute a memory capture script.. Option B is correct because AWS Systems Manager Run Command allows you to remotely execute scripts on EC2 instances without needing SSH access, which is critical during incident response to capture volatile memory data before the instance is compromised further. Option D is correct because creating an EBS snapshot provides a point-in-time forensic image of the root volume that can be analyzed offline without altering the original evidence.

Answer

Enable AWS CloudTrail for the instance.

Answer

Use AWS Backup to create a backup of the instance.

Answer

Use Amazon Inspector to scan the instance for vulnerabilities.

Question 4

Refer to the exhibit. A security engineer reviews an S3 bucket policy that is intended to allow the root user of account 123456789012 to get objects only from the 10.0.0.0/24 IP range. However, the policy is not working as expected. What is the MOST likely reason?

Accepted Answer

The condition should use 'aws:VpcSourceIp' instead of 'aws:SourceIp' when requests come through a VPC endpoint.. Option C is correct because when requests to an S3 bucket originate from a VPC endpoint (such as a gateway VPC endpoint for S3), the source IP address is translated to the private IP of the VPC endpoint, and the `aws:SourceIp` condition key cannot be used to evaluate the original client IP. Instead, you must use the `aws:VpcSourceIp` condition key to restrict access based on the IP address of the VPC endpoint. The policy as written would fail to match any requests coming through the VPC endpoint, causing the intended restriction to not work.

Answer

The principal is set to root, which cannot be used in bucket policies.

Answer

The resource ARN is incorrect because it should include the bucket name without /*.

Answer

The condition key 'aws:SourceIp' is not supported for S3 bucket policies.

Question 5

During a security incident, a security engineer needs to capture network traffic between an EC2 instance and an attacker's IP address for forensic analysis. The engineer has already identified the attacker's IP from CloudTrail logs. Which action captures the traffic without affecting the instance?

Accepted Answer

Create a VPC Traffic Mirroring session targeting the instance's ENI and mirror the traffic to a Network Load Balancer for capture.. Option D is correct because VPC Traffic Mirroring captures all network traffic at the Elastic Network Interface (ENI) level without any performance impact or configuration change on the EC2 instance itself. It copies the traffic to a Network Load Balancer (NLB) or another target for capture and analysis, making it ideal for forensic investigation without disrupting the running instance.

Answer

Update the network ACL to log all traffic to and from the attacker's IP.

Answer

Enable VPC Flow Logs on the subnet and query logs for the attacker's IP.

Answer

SSH into the instance and run tcpdump with a filter for the attacker's IP.

Question 6

A company's security team is configuring Amazon GuardDuty to detect crypto-mining activities on EC2 instances. Which THREE indicators should the team monitor? (Choose 3.)

Accepted Answer

Outbound connections to IP addresses on port 3333.. Option A is correct because crypto-mining malware often uses port 3333 for communication with mining pools or command-and-control servers. GuardDuty can detect outbound connections to known malicious IP addresses on this port as part of its threat intelligence feeds, which include indicators of compromise (IOCs) associated with crypto-mining activity.

Answer

High volume of inbound network traffic.

Answer

High disk I/O operations.

Question 7

A security engineer is investigating a potential compromise of an EC2 instance. The engineer wants to capture memory and disk forensics without shutting down the instance. Which service should the engineer use?

Accepted Answer

AWS Systems Manager. AWS Systems Manager (SSM) is the correct service because it provides the capability to perform forensic data collection on a running EC2 instance without shutting it down. Specifically, SSM Automation documents like AWS-RunShellScript or AWS-GatherEC2InstanceInfo can execute commands to capture memory (e.g., using LiME or fmem) and disk forensics (e.g., dd or volume snapshots) via the SSM Agent, which runs as a system service and does not require instance termination.

Answer

AWS Config

Answer

EC2 Instance Connect

Answer

Amazon CloudWatch Logs

Question 8

A company has a serverless application using AWS Lambda functions that process sensitive data. The security team wants to detect potential data exfiltration via DNS queries from the Lambda functions. Which service should be enabled to monitor DNS requests?

Accepted Answer

Amazon Route 53 Resolver DNS Firewall. Amazon Route 53 Resolver DNS Firewall is the correct choice because it provides DNS-layer filtering for outbound DNS queries from VPCs, including those made by Lambda functions. It can log and block DNS requests to known malicious domains, enabling detection of data exfiltration attempts that use DNS tunneling or command-and-control (C2) communication. This service integrates with VPC flow logs and CloudWatch to monitor DNS query patterns specifically.

Answer

AWS WAF

Answer

Amazon CloudWatch Logs

Answer

AWS GuardDuty

Question 9

A company is designing an incident response plan for AWS. The plan must include the ability to collect forensic data from EC2 instances without requiring SSH key pairs. Which TWO AWS services can be used to acquire forensic data from EC2 instances without remote access? (Choose 2.)

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Run Command allows you to run scripts or commands on EC2 instances via the SSM Agent, without requiring SSH keys or direct network access. This enables forensic data collection (e.g., memory dumps, log files) by executing commands remotely through the AWS Systems Manager service, using IAM roles for authentication.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 10

A company uses AWS CloudTrail to log all API activity. The security team needs to retain the logs for 7 years and ensure they are tamper-proof. Additionally, the team must be able to query the logs for investigations. Which solution meets these requirements?

Accepted Answer

Store logs in an Amazon S3 bucket with S3 Object Lock enabled and query using Amazon Athena.. Option D is correct because Amazon S3 Object Lock provides a write-once-read-many (WORM) model that prevents logs from being deleted or overwritten, ensuring tamper-proof retention for 7 years. Amazon Athena allows querying the logs directly in S3 using standard SQL, meeting the investigation requirement without needing to move data.

Answer

Store logs in AWS CloudTrail Lake and use the built-in query feature.

Answer

Store logs in Amazon CloudWatch Logs with a retention policy of 7 years.

Answer

Store logs in an Amazon S3 bucket with standard settings and use Amazon S3 Select for querying.

Question 11

During an incident response, a security engineer needs to collect volatile data from an EC2 instance running Linux. The instance is in a private subnet with no direct internet access. The engineer has IAM permissions to use AWS Systems Manager Session Manager. Which command should the engineer use to capture memory and process information?

Accepted Answer

aws ssm start-session --target i-1234567890abcdef0 --document-name AWS-StartInteractiveCommand. Option D is correct because AWS Systems Manager Session Manager with the AWS-StartInteractiveCommand document allows the security engineer to establish an interactive shell session to the EC2 instance without requiring direct internet access, SSH keys, or a bastion host. From this interactive session, the engineer can run native Linux commands like 'cat /proc/meminfo' or 'ps aux' to capture volatile memory and process information directly, which is the appropriate method for collecting volatile data during incident response.

Answer

aws ec2 get-console-output --instance-id i-1234567890abcdef0

Answer

aws ssm send-command --instance-ids i-1234567890abcdef0 --document-name AWS-RunShellScript --parameters commands='volatility -f /dev/mem imageinfo'

Answer

aws ec2-instance-connect send-ssh-public-key --instance-id i-1234567890abcdef0 --instance-os-user ec2-user --ssh-public-key file://key.pub

Question 12

Refer to the exhibit. A security engineer is reviewing an S3 bucket policy. The policy is intended to allow access only from the corporate network (10.0.0.0/8). What is a potential security issue with this policy?

Accepted Answer

The policy allows anonymous access from the specified IP range.. Option A is correct because the policy's `Principal: "*"` element allows anonymous access from any IP address, and the `Condition` block only restricts the source IP to 10.0.0.0/8. This means any unauthenticated request originating from within the corporate network (10.0.0.0/8) is permitted, effectively granting anonymous access to the S3 bucket. The intended goal of restricting access to authenticated corporate users is not achieved, as no `aws:userid` or `aws:username` condition is enforced.

Answer

The policy grants access to all actions, not just GetObject.

Answer

The policy resource is incorrect; it should be the bucket ARN without the /*.

Answer

The policy does not include a condition to require MFA.

Question 13

A company uses Amazon GuardDuty and AWS Security Hub. The security team wants to automatically remediate high-severity GuardDuty findings that indicate an EC2 instance is communicating with a known command and control (C&C) server. The remediation should isolate the instance by modifying the security group to deny all inbound and outbound traffic. Which solution is the most efficient?

Accepted Answer

Send Security Hub findings to Amazon EventBridge, which triggers a Lambda function to modify the security group.. Option B is correct because it leverages Security Hub as a central aggregation point for GuardDuty findings, then uses EventBridge to trigger a Lambda function that modifies the security group. This is the most efficient architecture as Security Hub normalizes findings from multiple sources, and EventBridge provides reliable, low-latency event routing to Lambda for custom remediation logic without requiring direct GuardDuty-to-security-group integration.

Answer

Use Amazon CloudWatch Events to directly modify the security group when a GuardDuty finding is published.

Answer

Configure GuardDuty to automatically update the security group when a finding is generated.

Answer

Create an AWS Config rule that triggers a Lambda function when a security group change is detected.

Question 14

Refer to the exhibit. A security engineer runs the AWS CLI command to look up console login events. The output shows two successful login events for user1 within 5 minutes. What should the engineer suspect?

Accepted Answer

The user's credentials may be compromised.. Two successful console login events for the same user within 5 minutes, especially from different source IP addresses or user agents, is a strong indicator of credential compromise. An attacker who has obtained the user's password can log in while the legitimate user is also active, creating overlapping sessions. AWS CloudTrail records the `ConsoleLogin` event with details like `sourceIPAddress` and `userAgent`, which the engineer should examine to confirm whether the logins originated from different locations or devices.

Answer

The user created a new access key.

Answer

The user's account is being used by multiple users.

Answer

The user has disabled multi-factor authentication (MFA).

Question 15

A security engineer is analyzing a potential security incident involving an Amazon RDS for MySQL database. The engineer suspects that a SQL injection attack was successful. Which AWS service can the engineer use to review the actual SQL queries that were executed against the database?

Accepted Answer

Amazon RDS Audit Logs. Amazon RDS for MySQL supports audit logs that capture detailed records of database activities, including the actual SQL queries executed. By enabling the `audit_log` plugin and configuring the `server_audit_events` parameter, the engineer can review the exact SQL statements that were run, which is essential for identifying a SQL injection attack. This is the only AWS service that provides query-level visibility into RDS database operations.

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 16

A security engineer is reviewing CloudTrail logs and notices API calls from an unknown IP address. The engineer needs to immediately block the IP address and receive alerts for any future suspicious activity. Which combination of actions should the engineer take?

Accepted Answer

Add the IP address to a VPC NACL with a DENY rule and update a CloudWatch metric filter to create an alarm on the IP address.. Option D is correct because VPC Network ACLs (NACLs) are stateless and can explicitly deny traffic from a specific IP address at the subnet level, providing immediate blocking without affecting existing security group rules. A CloudWatch metric filter on CloudTrail logs can trigger an alarm for any future API calls from that IP, enabling proactive alerting. This combination addresses both the immediate blocking and ongoing monitoring requirements.

Answer

Create an AWS WAF IP set and associate it with the CloudFront distribution. Configure CloudFront to block the IP.

Answer

Add the IP address to a security group with a DENY rule and enable AWS Security Hub to send alerts.

Answer

Revoke IAM permissions for the user associated with the IP and enable GuardDuty for alerting.

Question 17

A company uses Amazon GuardDuty to detect threats. The security team wants to be alerted when GuardDuty generates a finding with a severity level of HIGH or CRITICAL. Which AWS service should the team use to send notifications based on GuardDuty findings?

Accepted Answer

Amazon EventBridge and Amazon Simple Notification Service (SNS). Amazon EventBridge can capture GuardDuty findings as events using a rule that matches the 'GuardDuty Finding' event type. The rule can then invoke an SNS topic to send email or SMS notifications. This is the recommended pattern because EventBridge provides native integration with GuardDuty and supports filtering by finding severity using event patterns, while SNS handles the actual notification delivery.

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Lambda

Answer

Amazon CloudWatch Logs and Amazon Simple Notification Service (SNS)

Question 18

A security engineer needs to detect suspicious API calls across multiple AWS accounts. The engineer has enabled AWS CloudTrail in each account and is sending logs to a central S3 bucket. Which additional step should the engineer take to analyze the logs for potential threats?

Accepted Answer

Enable Amazon GuardDuty in each account.. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, including suspicious API calls, by analyzing CloudTrail management and data events, VPC Flow Logs, and DNS logs. By enabling GuardDuty in each account, the security engineer can automatically detect potential threats across all accounts without manual log analysis. This directly addresses the need to analyze CloudTrail logs for suspicious API calls at scale.

Answer

Enable AWS Config rules to monitor CloudTrail configuration.

Answer

Enable AWS Trusted Advisor in the management account.

Answer

Enable VPC Flow Logs in each account.

Question 19

A company's incident response team is using AWS Systems Manager to run commands on EC2 instances for forensic analysis. The team needs to ensure that the commands are run with minimal latency and that the results are stored securely. Which Systems Manager capability should the team use?

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Run Command is the correct capability because it allows the incident response team to execute commands on EC2 instances with minimal latency by using the SSM Agent to run scripts or commands directly, and it can store command output in Amazon S3 or CloudWatch Logs for secure, durable storage. This meets the requirement for low-latency execution and secure result storage without requiring interactive sessions or complex automation workflows.

Answer

AWS Systems Manager Automation

Answer

AWS Systems Manager Session Manager

Answer

AWS Systems Manager Patch Manager

Question 20

A security engineer discovers an Amazon GuardDuty finding of type 'UnauthorizedAccess:EC2/SSHBruteForce' for an EC2 instance. The instance is part of an Auto Scaling group and has a public IP address. What is the MOST effective immediate step to mitigate the threat?

Accepted Answer

Detach the instance from the Auto Scaling group and terminate it.. Option D is correct because the instance is compromised and part of an Auto Scaling group. Detaching it first prevents the Auto Scaling group from immediately replacing it with a new instance that might inherit the same vulnerability, allowing for forensic analysis. Terminating it after detachment stops the SSH brute force attack at its source without risking automatic re-provisioning of a similarly exposed instance.

Answer

Modify the network ACL to block SSH traffic from the attacker's IP.

Answer

Terminate the instance without detaching it from the Auto Scaling group.

Answer

Update the security group to restrict SSH access to known IP addresses.