SCS-C02 Threat Detection and Incident Response — 40 Questions

Question 1

During an incident response, a security engineer needs to collect memory and disk forensics from a running EC2 Windows instance without causing the instance to crash. The engineer has AWS Systems Manager SSM Agent installed. Which method should the engineer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an EBS snapshot of the root volume.. An EBS snapshot provides a forensic copy of the root volume but cannot capture volatile memory (RAM). To collect memory forensics, the engineer must run a memory dump tool via SSM Run Command before taking the snapshot. Since none of the options include a memory capture method, the question should be revised to either ask specifically for disk forensics or add an option for memory capture. As written, the question is invalid.

Answer

Create an AMI of the instance.

Answer

Use AWS Systems Manager Inventory to collect memory and disk information.

Answer

Use AWS Backup to create a backup of the instance.

Question 2

A security engineer is investigating a potential data exfiltration incident. The engineer notices large volumes of data being transferred from an Amazon S3 bucket to an external IP address. Which AWS services can be used to detect and alert on such behavior? (Choose THREE.)

Accepted Answer

Amazon CloudWatch Logs with S3 access log analysis.. Amazon CloudWatch Logs with S3 access log analysis (A) is correct because S3 server access logs record every request made to a bucket, including the requester's IP address and bytes sent, and CloudWatch Logs metric filters and alarms can detect and alert on unusually large data transfers to external IPs. AWS CloudTrail with S3 data event logging (B) is correct because data events capture object-level operations such as GetObject, and CloudTrail can deliver these events to CloudWatch Logs or EventBridge for anomaly-based alerting on suspicious exfiltration patterns. Amazon GuardDuty with anomaly detection (C) is correct because GuardDuty continuously analyzes CloudTrail management and data events, VPC Flow Logs, and DNS logs using machine learning and threat intelligence to generate findings such as Exfiltration:S3/AnomalousBehavior or UnauthorizedAccess. AWS Config with compliance rules (D) is not correct because Config evaluates resource configuration compliance against rules and does not detect or alert on live data-transfer behavior. VPC Flow Logs (E) is not correct because it captures IP traffic metadata for network interfaces and cannot inspect S3 object-level API activity or identify data exfiltration from a bucket.

Answer

AWS Config with compliance rules.

Answer

VPC Flow Logs.

Question 3

A company runs a critical web application on a fleet of EC2 instances behind an Application Load Balancer (ALB). The application uses an Aurora MySQL database. The security team receives an alert from Amazon GuardDuty that a specific EC2 instance is exhibiting behavior consistent with a cryptocurrency mining attack, including outbound connections to known mining pools. The instance is part of an Auto Scaling group that uses a launch template with a security group that allows outbound HTTPS traffic to 0.0.0.0/0. The security engineer needs to contain the incident while minimizing downtime for the application. The engineer has already taken a forensic snapshot of the instance's EBS volume. Which course of action should the engineer take next?

Accepted Answer

Detach the instance from the Auto Scaling group and isolate it by removing all security group rules.. The correct course of action is to isolate the compromised instance without disrupting the rest of the fleet. Detaching the instance from the Auto Scaling group removes it from management and triggers a replacement to maintain capacity. Removing or replacing its security group rules (or attaching a quarantine security group) halts all traffic, including outbound communication to mining pools. This contains the threat while minimizing downtime. Option A is wrong because the security group is defined in the launch template and is shared across all instances; modifying it would block outbound traffic for the entire application, causing a full outage. Option D is less ideal because immediate termination loses the ability to conduct further live forensics (though a snapshot exists) and may be hasty without first isolating the instance.

Answer

Modify the security group attached to the instance to deny all outbound traffic, and let Auto Scaling launch a replacement instance.

Answer

SSH into the instance and run a script to kill the mining process.

Answer

Immediately terminate the compromised EC2 instance and allow Auto Scaling to launch a new instance.

Question 4

Match each AWS IAM policy type to its description.

Accepted Answer

Identity-based policy: Attached to an IAM user, group, or role to define permissions. The correct matches are: Identity-based policies are attached to users, groups, or roles; Resource-based policies are attached to resources; Permissions boundaries limit maximum permissions; Session policies are passed during role assumption. Common confusions include swapping identity-based and resource-based definitions.

Answer

Identity-based policy: Attached to a resource and defines which principals can access it

Answer

Resource-based policy: Attached to an IAM user, group, or role

Question 5

A company wants to ensure that any deleted CloudTrail logs are detected and alerted within minutes. Which approach should they use?

Accepted Answer

Configure CloudTrail to send logs to CloudWatch Logs, create a metric filter for DeleteTrail events, and set a CloudWatch alarm to send an SNS notification.. CloudTrail management events (including DeleteTrail) are delivered to CloudWatch Logs, where a metric filter can match the exact event name. A CloudWatch alarm on that metric triggers an SNS notification within minutes, meeting the detection and alerting requirement. This approach directly monitors the CloudTrail API call that deletes the trail itself, not just the log files.

Answer

Enable S3 event notifications on the CloudTrail bucket for DELETE events.

Answer

Use AWS Config to track CloudTrail configuration changes and trigger a Lambda function.

Answer

Enable Amazon GuardDuty to monitor CloudTrail management events.

Question 6

During incident response, a security engineer needs to capture network traffic from an EC2 instance for forensic analysis. The instance is part of an Auto Scaling group. Which action preserves the most evidence while minimizing disruption?

Accepted Answer

Enable VPC Flow Logs for the subnet and analyze the logs.. VPC Flow Logs capture metadata (IP addresses, ports, protocols, packet sizes) of all traffic to/from the EC2 instance at the subnet level, preserving a forensic record without any disruption to the running instance or Auto Scaling group. This approach avoids stopping, terminating, or modifying the instance, ensuring the incident environment remains intact for further investigation.

Answer

Take an EBS snapshot and analyze network logs from the snapshot.

Answer

Use AWS Traffic Mirroring to mirror traffic to a monitoring appliance.

Answer

Terminate the instance and launch a new one to capture network logs.

Question 7

A security engineer is investigating a potential data exfiltration incident. The engineer suspects that an EC2 instance is sending data to an external IP address. Which TWO AWS services can provide evidence of outbound data transfer? (Select TWO.)

Accepted Answer

S3 server access logs. VPC Flow Logs (C) capture IP traffic information for network interfaces in a VPC, including source/destination IP addresses, ports, protocol, and bytes/packets transferred, so they can directly show an EC2 instance's outbound traffic to an external IP. S3 server access logs (A) record detailed requests made to S3 buckets, including the requester's IP and bytes sent, which can reveal data being uploaded to or downloaded from S3 as part of exfiltration. AWS Config (B) tracks resource configuration changes and compliance, not network traffic. AWS CloudTrail (D) logs API activity and management events, not the actual data-plane packet flows. AWS Trusted Advisor (E) provides best-practice checks and recommendations, not traffic evidence.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 8

A company has enabled AWS CloudTrail and wants to receive real-time notifications when specific API calls, such as DeleteTrail, are made. Which service should be used to trigger an alert based on CloudTrail log events?

Accepted Answer

Amazon CloudWatch Events / Amazon EventBridge. Amazon CloudWatch Events (now part of Amazon EventBridge) is the correct service to trigger real-time alerts based on CloudTrail log events. You can create a rule that matches specific API calls, such as DeleteTrail, and route the event to a target like an SNS topic or Lambda function for immediate notification. CloudTrail delivers log events to CloudWatch Logs, and EventBridge can directly consume those events for pattern matching and alerting.

Answer

AWS CloudTrail console notifications

Answer

Amazon VPC Flow Logs

Answer

Amazon S3 event notifications

Question 9

A company wants to ensure that all API calls made to AWS are logged for security analysis. Which TWO services can be used to achieve this? (Choose two.)

Accepted Answer

Amazon S3 server access logs. AWS CloudTrail (B) is correct because it records API activity across AWS services, capturing the identity of the caller, the time, source IP, request parameters, and response elements for every API call, which is exactly what is needed for security analysis of API calls. Amazon S3 server access logs (A) is also correct because it logs detailed records of requests made to an S3 bucket, including the requester, bucket name, request time, request action, and response status, so API-level access to S3 objects and buckets is captured for auditing. Amazon VPC Flow Logs (C) is not correct because it captures IP traffic metadata (source/destination IP, ports, protocol, bytes) at the ENI, subnet, or VPC level, not API calls. Amazon CloudWatch Logs (D) is not correct because it is a general log storage and monitoring service that only contains API-related data if something explicitly sends it there; it does not itself record AWS API calls. AWS Config (E) is not correct because it records resource configuration changes and compliance state over time, not the full set of API calls made to AWS services.

Answer

Amazon VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 10

Refer to the exhibit. A security engineer reviews an S3 bucket policy that is intended to allow the root user of account 123456789012 to get objects only from the 10.0.0.0/24 IP range. However, the policy is not working as expected. What is the MOST likely reason?

Accepted Answer

The condition should use 'aws:VpcSourceIp' instead of 'aws:SourceIp' when requests come through a VPC endpoint.. When requests to an S3 bucket originate from a VPC endpoint (such as a gateway VPC endpoint for S3), the source IP address is translated to the private IP of the VPC endpoint, and the `aws:SourceIp` condition key cannot be used to evaluate the original client IP. Instead, you must use the `aws:VpcSourceIp` condition key to restrict access based on the IP address of the VPC endpoint. The policy as written would fail to match any requests coming through the VPC endpoint, causing the intended restriction to not work.

Answer

The principal is set to root, which cannot be used in bucket policies.

Answer

The resource ARN is incorrect because it should include the bucket name without /*.

Answer

The condition key 'aws:SourceIp' is not supported for S3 bucket policies.

Question 11

During an incident response, a security engineer needs to collect memory and disk forensics from a running EC2 Windows instance without causing the instance to crash. The engineer has AWS Systems Manager SSM Agent installed. Which method should the engineer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

aws ssm start-session --target i-1234567890abcdef0 --document-name AWS-StartInteractiveCommand. AWS Systems Manager Session Manager with the AWS-StartInteractiveCommand document allows the security engineer to establish an interactive shell session to the EC2 instance without requiring direct internet access, SSH keys, or a bastion host. From this interactive session, the engineer can run native Linux commands like 'cat /proc/meminfo' or 'ps aux' to capture volatile memory and process information directly, which is the appropriate method for collecting volatile data during incident response.

Answer

aws ec2 get-console-output --instance-id i-1234567890abcdef0

Answer

aws ssm send-command --instance-ids i-1234567890abcdef0 --document-name AWS-RunShellScript --parameters commands='volatility -f /dev/mem imageinfo'

Answer

aws ec2-instance-connect send-ssh-public-key --instance-id i-1234567890abcdef0 --instance-os-user ec2-user --ssh-public-key file://key.pub

Question 12

Refer to the exhibit. A security engineer is reviewing a resource-based policy attached to an AWS Lambda function. The engineer notices that the policy allows any Lambda function in the account to invoke the function. Which security concern should the engineer address?

Accepted Answer

The policy allows invocation from any Lambda function across all AWS accounts.. The resource-based policy on the Lambda function uses a principal of `*` without any condition key (such as `aws:SourceAccount` or `aws:SourceArn`) to restrict invocation to only the same account. This means any Lambda function in any AWS account can invoke this function, which is a security concern as it allows cross-account invocation without authorization.

Answer

The policy grants excessive permissions by allowing all actions.

Answer

The policy does not specify a resource ARN, so it applies to all functions.

Answer

The policy allows the Lambda service to modify the function code.

Question 13

A security engineer is reviewing CloudTrail logs and notices API calls from an unknown IP address. The engineer needs to immediately block the IP address and receive alerts for any future suspicious activity. Which combination of actions should the engineer take?

Accepted Answer

Add the IP address to a VPC NACL with a DENY rule and update a CloudWatch metric filter to create an alarm on the IP address.. VPC Network ACLs (NACLs) are stateless and can explicitly deny traffic from a specific IP address at the subnet level, providing immediate blocking without affecting existing security group rules. A CloudWatch metric filter on CloudTrail logs can trigger an alarm for any future API calls from that IP, enabling proactive alerting. This combination addresses both the immediate blocking and ongoing monitoring requirements.

Answer

Create an AWS WAF IP set and associate it with the CloudFront distribution. Configure CloudFront to block the IP.

Answer

Add the IP address to a security group with a DENY rule and enable AWS Security Hub to send alerts.

Answer

Revoke IAM permissions for the user associated with the IP and enable GuardDuty for alerting.

Question 14

A company uses AWS Organizations and has GuardDuty enabled in all accounts. The security team wants to suppress low-severity findings that are known false positives for a specific member account. How can this be achieved with minimal administrative overhead?

Accepted Answer

In the member account, create a suppression rule in GuardDuty for the specific finding types.. GuardDuty supports suppression rules that can be created at the member account level to automatically archive low-severity findings that are known false positives. This approach allows the member account to manage its own findings without requiring changes to the GuardDuty configuration in the management account or other accounts, minimizing administrative overhead.

Answer

Disable GuardDuty for that member account and rely on other accounts.

Answer

Use AWS Security Hub insights to filter out those findings from the aggregated view.

Answer

Ask the delegated administrator to add a suppression rule in the GuardDuty console for that account.

Question 15

A security engineer is designing an incident response plan for a compromised S3 bucket. Which TWO actions should be taken to contain the incident? (Choose TWO.)

Accepted Answer

Enable CloudTrail data events for the bucket to log all object-level operations.. Option C is correct because enabling CloudTrail data events (S3 object-level logging) captures GetObject, PutObject, and DeleteObject API calls on the bucket, which is essential for scoping the compromise and preserving forensic evidence during containment. Option D is correct because applying a bucket policy that explicitly denies all principals (including the compromised credentials) immediately blocks further access to the bucket, effectively isolating it while the investigation proceeds. Option A is wrong because deleting the bucket destroys forensic evidence and is not a containment action. Option B is wrong because MFA Delete only protects against accidental or unauthorized version deletions and does not contain an active compromise. Option E is wrong because default encryption protects data at rest but does nothing to stop an ongoing intrusion.

Answer

Delete the bucket and recreate it.

Answer

Enable MFA Delete on the bucket.

Answer

Enable default encryption for the bucket.

Question 16

An organization is using Amazon EKS for container workloads. The security team wants to detect container escape attempts. Which THREE AWS services or features should be enabled? (Choose THREE.)

Accepted Answer

AWS Security Hub. AWS Security Hub (B) is correct because it aggregates and correlates findings from services like GuardDuty, including EKS runtime and container-escape detections, into a centralized dashboard with security standards checks. Amazon GuardDuty with EKS Runtime Monitoring (D) is correct because it deploys the GuardDuty security agent to EKS nodes and uses eBPF-based runtime threat detection to identify container escape attempts, privilege escalation, and suspicious process activity at the pod level. AWS CloudTrail (E) is correct because it records EKS control plane API activity (e.g., CreateCluster, UpdateClusterConfig, and Kubernetes API calls via EKS audit logs) that can reveal attempts to modify workloads or escalate privileges as part of an escape chain. AWS WAF (A) is not correct because it protects HTTP/S web traffic at the application layer and has no visibility into container runtime or host-level escape behavior. VPC Flow Logs (C) is not correct because it only captures IP traffic metadata for network interfaces and cannot detect process-level container escape attempts.

Answer

AWS WAF

Answer

VPC Flow Logs

Question 17

A company's security team is configuring Amazon GuardDuty to detect crypto-mining activities on EC2 instances. Which THREE indicators should the team monitor? (Choose 3.)

Accepted Answer

Outbound connections to IP addresses on port 3333.. Option A is correct because port 3333 is a common Stratum mining-protocol port used by crypto-mining pools, so GuardDuty flags outbound connections to such IPs as a CryptoCurrency:EC2/BitcoinTool.B finding. Option B is correct because sustained, unusually high CPU utilization is a hallmark of resource-hijacking crypto-miners, and GuardDuty correlates this behavior with other signals to raise findings. Option D is correct because DNS queries to known mining pools (e.g., domains resolving to mining endpoints) are a strong indicator that an instance has been compromised for mining, and GuardDuty monitors DNS activity for these lookups. Option C is not a primary crypto-mining indicator since mining traffic is typically low-volume outbound, and inbound traffic spikes are more associated with DDoS or scanning. Option E is not a typical mining indicator because crypto-mining is CPU/GPU-intensive rather than disk-I/O-intensive, so high disk I/O is not one of the three monitored indicators.

Answer

High volume of inbound network traffic.

Answer

High disk I/O operations.

Question 18

A security engineer notices that an EC2 instance is sending outbound traffic to a known malicious IP address. The instance is part of an Auto Scaling group behind an Application Load Balancer. The engineer needs to immediately stop the exfiltration while preserving forensic evidence. What is the BEST course of action?

Accepted Answer

Remove the instance from the target group and apply a security group that denies all traffic.. Removing the instance from the target group immediately stops new traffic from the Application Load Balancer to the instance, while applying a security group that denies all outbound traffic (e.g., a custom security group with no outbound rules) halts any ongoing exfiltration without destroying the instance or its attached EBS volumes. This preserves the forensic evidence (memory, disk, logs) for later analysis, unlike termination or shutdown which could lose volatile data.

Answer

Detach the EBS volume from the instance.

Answer

Terminate the EC2 instance immediately.

Answer

Shut down the instance from within the OS.

Question 19

A company uses AWS CloudTrail to log all API calls. The security team notices a series of `UpdateTrail` API calls from a user in the Security account, disabling logging on a multi-region trail. The user has a policy that allows `cloudtrail:UpdateTrail` only on trails with a specific tag. However, the trail does not have that tag. What is the MOST likely reason the call succeeded?

Accepted Answer

The trail did not have the required tag at the time of the API call due to a race condition.. AWS IAM policies are evaluated based on the resource's tags at the time of the API call. If the `UpdateTrail` API call was made while the trail's tag was being removed or added, a race condition could cause the trail to temporarily lack the required tag, allowing the action to succeed despite the policy's intent. This is a known edge case in IAM tag-based authorization, where eventual consistency of tag changes can lead to unintended access.

Answer

The trail had an explicit deny in the same policy that was overridden by a separate allow.

Answer

The user's permissions were granted through a service control policy (SCP) that allowed the action.

Answer

CloudTrail API calls are not logged and bypass IAM policies.

Question 20

A security team is setting up incident response automation. Which TWO steps should be taken to ensure that a compromised EC2 instance is isolated while preserving forensic data? (Choose TWO.)

Accepted Answer

Remove the instance from any Auto Scaling group or load balancer target group.. Option C is correct because detaching the instance from Auto Scaling groups and load balancer target groups prevents the automation from replacing or deregistering it in ways that could destroy evidence, and it stops the instance from continuing to serve traffic or be terminated by scaling policies. Option D is correct because creating an EBS snapshot of the root volume captures a point-in-time, read-only copy of the disk for forensic analysis before any further changes are made. Option A is not ideal because a security group that denies all inbound and outbound traffic can block the forensic tooling and management access needed to investigate the instance, and it does not preserve data. Option B is wrong because shutting down from the OS can alter volatile memory and filesystem state, and it may not be possible if the instance is compromised. Option E is wrong because terminating the instance destroys the instance store and may delete volumes depending on the DeleteOnTermination setting, eliminating forensic evidence.

Answer

Assign a new security group that denies all inbound and outbound traffic.

Answer

Shut down the instance from the OS.

Answer

Terminate the instance.