SCS-C02 Threat Detection and Incident Response — 40 Questions

Question 1

A security engineer is configuring an AWS environment to detect and respond to potential security threats. Which AWS service can be used to automate the remediation of unwanted access to Amazon S3 buckets by invoking AWS Lambda functions?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads. It can integrate with AWS Lambda functions via CloudWatch Events to automate remediation actions, such as blocking unwanted access to S3 buckets by updating bucket policies or removing public access. This makes GuardDuty the correct choice for detecting and automatically responding to security threats against S3 resources.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS WAF

Question 2

A security team suspects that an attacker has compromised an EC2 instance and is using it to launch outbound DDoS attacks. The team needs to quickly isolate the instance while preserving forensic data. Which combination of actions should the team take? (Choose TWO.)

Accepted Answer

Apply a restrictive security group that blocks all outbound traffic.. Applying a restrictive security group that blocks all outbound traffic immediately stops the EC2 instance from sending any network packets, including DDoS traffic, without terminating the instance. This preserves the running state and allows forensic data collection from the instance's memory and disk. Security groups act as a stateful virtual firewall at the instance level, so blocking outbound traffic effectively isolates the instance from the network.

Answer

Modify the network ACL for the subnet to deny all outbound traffic.

Answer

Detach the instance from the Auto Scaling group.

Answer

Terminate the EC2 instance immediately.

Question 3

During an incident response, a security engineer needs to collect memory and disk forensics from a running EC2 Windows instance without causing the instance to crash. The engineer has AWS Systems Manager SSM Agent installed. Which method should the engineer use?

Accepted Answer

Create an EBS snapshot of the root volume.. Creating an EBS snapshot of the root volume captures the disk state without stopping the instance, preserving volatile data on disk. However, memory forensics requires a separate tool (e.g., using SSM Run Command with a memory dump utility). This approach minimizes the risk of crashing the instance while collecting disk evidence.

Answer

Create an AMI of the instance.

Answer

Use AWS Systems Manager Inventory to collect memory and disk information.

Answer

Use AWS Backup to create a backup of the instance.

Question 4

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all API calls in the organization are logged and retained for at least one year. Which AWS services or features should be used to meet these requirements? (Choose TWO.)

Accepted Answer

Amazon S3 lifecycle policy to transition logs to S3 Glacier after one year.. An Amazon S3 lifecycle policy can automatically transition CloudTrail log objects from S3 Standard to S3 Glacier after one year, meeting the retention requirement cost-effectively. Option E is correct because AWS CloudTrail with an organization trail logs all API calls across all accounts in the AWS Organization, ensuring comprehensive logging.

Answer

Amazon GuardDuty with threat detection enabled.

Answer

AWS Config with recording enabled for all resources.

Answer

VPC Flow Logs for all VPCs.

Question 5

A security engineer reviews the CloudTrail log entry in the exhibit. The engineer notices that an EC2 instance was launched using an AdminRole. Which additional information would help determine if this is a legitimate action or a potential compromise?

Accepted Answer

The source IP address 203.0.113.50 is from an unexpected geographic location not associated with the company.. The source IP address 203.0.113.50 is from an unexpected geographic location not associated with the company. In CloudTrail, the `sourceIPAddress` field records the originating IP of the API call. If an AdminRole is used from an IP outside the company's known CIDR ranges or geographic regions, it strongly indicates a potential compromise—such as stolen credentials or an attacker using the role from an unauthorized network. This is a key indicator of anomalous behavior in threat detection.

Answer

The AMI ID ami-0abcdef1234567890 is not a standard Amazon-provided AMI.

Answer

The instance type m5.xlarge is unusually large compared to previous launches.

Answer

The security group sg-0123456789abcdef0 allows inbound SSH from 0.0.0.0/0.

Question 6

A security engineer is analyzing the VPC Flow Logs entry in the exhibit. The log shows traffic from an internal IP to an external IP. Which potential security concern should the engineer investigate?

Accepted Answer

An EC2 instance is attempting to connect to an external host on port 3389 (RDP).. The VPC Flow Logs entry shows outbound traffic from an internal IP to an external IP on destination port 3389, which is the default port for Remote Desktop Protocol (RDP). RDP outbound from an EC2 instance to an external host is a security concern because it could indicate an attacker using the instance as a pivot point to connect to an external command-and-control server or to exfiltrate data via an RDP tunnel. The log direction (src internal, dst external) and port 3389 specifically point to an outbound RDP attempt, not inbound scanning or DDoS.

Answer

The instance is participating in a DDoS attack against the external IP.

Answer

An external host is scanning the internal network on port 443.

Answer

The security group allows inbound RDP from 0.0.0.0/0.

Question 7

A company has a security rule that all S3 buckets must have server access logging enabled. A security engineer uses AWS Config to evaluate compliance. The engineer configures a managed rule but notices that the rule does not evaluate all buckets. What is the most likely reason?

Accepted Answer

The rule only evaluates buckets that have a specific tag.. The AWS Config managed rule `s3-bucket-server-access-logging-enabled` can be configured with a `tag` parameter. When a tag is specified, the rule only evaluates S3 buckets that have that exact tag key-value pair. If the security engineer did not apply the required tag to all buckets, or if the rule was configured with a tag that does not match all buckets, some buckets will be excluded from evaluation, causing the observed behavior.

Answer

The rule only evaluates buckets in the us-east-1 region.

Answer

The rule excludes buckets that have a bucket policy denying access to AWS Config.

Answer

The rule requires the logging target bucket to be in the same account.

Question 8

During a security incident, a security engineer needs to verify whether an EC2 instance's security group allowed inbound SSH from a specific IP address at the time of the incident. Which AWS service or feature should the engineer use to obtain this historical information?

Accepted Answer

AWS Config configuration history.. AWS Config configuration history records changes to security group rules, including the addition or removal of inbound SSH allow rules. By querying the configuration history for the specific security group, the engineer can determine the exact state of the rules at the time of the incident, including whether a specific IP address was allowed. This is the only service that provides a historical record of security group rule configurations.

Answer

Amazon CloudTrail event history.

Answer

AWS Systems Manager Inventory.

Answer

VPC Flow Logs.

Question 9

A security engineer is implementing automated incident response. The engineer wants to use AWS Lambda to automatically remediate GuardDuty findings. What is the recommended pattern to trigger the Lambda function?

Accepted Answer

Configure an Amazon EventBridge rule to match GuardDuty findings and invoke the Lambda function.. Amazon EventBridge is the recommended pattern because it natively integrates with AWS GuardDuty to receive all finding events in near real-time. By configuring an EventBridge rule that matches GuardDuty finding types (e.g., 'UnauthorizedAccess:EC2/SSHBruteForce'), you can directly invoke a Lambda function for automated remediation without polling or intermediate services. This pattern is serverless, event-driven, and follows AWS best practices for decoupled incident response.

Answer

Subscribe the Lambda function to an SNS topic that GuardDuty publishes findings to.

Answer

Use CloudWatch Logs subscription filter to trigger Lambda on GuardDuty log entries.

Answer

Have the Lambda function poll the EC2 instance metadata for threat indicators.

Question 10

A company uses AWS Systems Manager Patch Manager to patch EC2 instances. During a security incident, the security team needs to quickly patch a critical vulnerability across all Windows instances in a specific AWS region. Which steps should the team take? (Choose TWO.)

Accepted Answer

Assign the patch baseline to the instances by specifying a patch group.. Assigning a custom patch baseline to instances via a patch group allows the security team to target specific Windows instances for patching. Patch Manager uses patch groups to associate instances with a specific patch baseline, ensuring only the desired instances receive the critical patch. This approach provides granular control over which instances are patched during an incident.

Answer

Tag all instances with 'PatchGroup=Critical' to include them in the patching.

Answer

Use the AWS-provided default patch baseline for Windows.

Answer

Use SSM Run Command to execute a script that downloads and installs the patch.

Question 11

A company runs a critical web application on a fleet of EC2 instances behind an Application Load Balancer (ALB). The application uses an Aurora MySQL database. The security team receives an alert from Amazon GuardDuty that a specific EC2 instance is exhibiting behavior consistent with a cryptocurrency mining attack, including outbound connections to known mining pools. The instance is part of an Auto Scaling group that uses a launch template with a security group that allows outbound HTTPS traffic to 0.0.0.0/0. The security engineer needs to contain the incident while minimizing downtime for the application. The engineer has already taken a forensic snapshot of the instance's EBS volume. Which course of action should the engineer take next?

Accepted Answer

Modify the security group attached to the instance to deny all outbound traffic, and let Auto Scaling launch a replacement instance.. Modifying the security group to deny all outbound traffic immediately stops the cryptocurrency mining communication to known mining pools without terminating the instance, preserving forensic data. The Auto Scaling group will detect the instance's health check failure (due to the application becoming unreachable) and automatically launch a replacement instance, minimizing downtime. This approach contains the incident while allowing the application to recover through the Auto Scaling group's self-healing mechanism.

Answer

SSH into the instance and run a script to kill the mining process.

Answer

Detach the instance from the Auto Scaling group and isolate it by removing all security group rules.

Answer

Immediately terminate the compromised EC2 instance and allow Auto Scaling to launch a new instance.

Question 12

A security engineer is investigating a potential credential compromise. An IAM user's access key was used to launch EC2 instances in a region where the user has never operated before. The engineer wants to quickly identify all API calls made by this user in the last 24 hours, including the source IP addresses. Which AWS service or feature should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made by IAM users, including the source IP address, user identity, and request details. By querying CloudTrail logs for the specific IAM user's access key over the last 24 hours, the engineer can identify every EC2-related and other API call, along with the originating IP addresses, enabling rapid investigation of the potential credential compromise.

Answer

VPC Flow Logs

Answer

AWS Trusted Advisor

Answer

Amazon CloudWatch Logs

Question 13

A company uses AWS Organizations with multiple accounts and has enabled AWS Security Hub in the management account. The security team wants to automatically remediate a specific finding type that appears in Security Hub. Which combination of services should be used to achieve this?

Accepted Answer

Amazon EventBridge and AWS Lambda. Amazon EventBridge can capture Security Hub findings as events using an event rule that matches the specific finding type. When the rule triggers, it invokes an AWS Lambda function that contains the remediation logic, such as modifying security group rules or disabling access keys. This combination provides a serverless, event-driven architecture for automated response to Security Hub findings.

Answer

AWS Config conformance packs and AWS Systems Manager Automation

Answer

Amazon Inspector and AWS Step Functions

Answer

Amazon GuardDuty and AWS Lambda

Question 14

A security engineer is configuring an automated incident response workflow for Amazon GuardDuty findings. Which TWO actions should the engineer take to ensure that the response is triggered for all current and future GuardDuty findings?

Accepted Answer

Create an Amazon EventBridge rule with an event pattern that matches GuardDuty finding events.. Amazon EventBridge can capture all GuardDuty findings by using an event pattern that matches the 'GuardDuty Finding' event type. This ensures that both current and future findings automatically trigger the rule without requiring manual updates or additional configuration.

Answer

Enable GuardDuty to export findings to CloudWatch Logs and then create a metric filter.

Answer

Create an Amazon SNS topic and subscribe the Lambda function to it, then configure GuardDuty to publish to SNS.

Answer

Set up a CloudWatch Logs subscription filter to forward GuardDuty logs to the Lambda function.

Question 15

A security engineer is reviewing a CloudTrail log entry (exhibit). What is the most immediate security concern indicated by this event?

Accepted Answer

A security group rule was added allowing SSH access from any IP address.. The CloudTrail log shows an AuthorizeSecurityGroupIngress API call that added a security group rule with the CIDR 0.0.0.0/0 for port 22 (SSH). This effectively opens SSH access to the entire internet, creating a severe exposure that could allow any attacker to attempt brute-force or credential-stuffing attacks against any EC2 instance associated with that security group. This is the most immediate security concern because it directly introduces a wide-open attack surface.

Answer

The source IP address 203.0.113.5 is from a known malicious IP range.

Answer

The API call was made from the AWS CLI, which may indicate a compromised access key.

Answer

The user JohnDoe did not use multi-factor authentication (MFA) for this API call.

Question 16

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB) in a VPC. The security team uses Amazon GuardDuty and has enabled Amazon Detective. Recently, GuardDuty raised a 'Recon:EC2/PortProbeUnprotectedPort' finding for one of the instances. The security engineer verified that the ALB security group only allows inbound HTTP/HTTPS from the internet. However, the finding indicates that the instance is receiving probes on port 22 (SSH). Further investigation with Detective shows that the probes originate from multiple IP addresses and are reaching the instance's private IP address. The engineer suspects that the SSH port is exposed despite the security group configuration. What is the MOST likely cause of this exposure?

Accepted Answer

The EC2 instance's security group allows inbound SSH from 0.0.0.0/0.. The GuardDuty finding 'Recon:EC2/PortProbeUnprotectedPort' indicates that an EC2 instance is receiving unsolicited probes on a port that should not be publicly accessible. Since the ALB security group only allows HTTP/HTTPS from the internet, but the probes are reaching the instance's private IP on port 22 (SSH), the most likely cause is that the instance's own security group has an inbound rule allowing SSH from 0.0.0.0/0. This bypasses the ALB's security group because the instance's security group is evaluated independently for direct traffic to the instance's private IP, and if it permits SSH from anywhere, the probes will reach the instance.

Answer

VPC Flow Logs are misconfigured and are inadvertently forwarding traffic to the instance.

Answer

AWS Shield Advanced is causing false positives by marking legitimate traffic as probes.

Answer

The ALB security group has an inbound rule that allows SSH from the internet.

Question 17

A security engineer is investigating a potential compromise. An EC2 instance running Amazon Linux 2 is sending outbound traffic to a known malicious IP address. The engineer needs to capture the network traffic for analysis without alerting the attacker. Which solution meets these requirements?

Accepted Answer

Use VPC Traffic Mirroring to mirror the EC2 instance's ENI traffic to a monitoring appliance in a separate VPC.. VPC Traffic Mirroring captures all network traffic at the packet level from the EC2 instance's Elastic Network Interface (ENI) and forwards it to a monitoring appliance without any inline processing or modification of the traffic. This allows the security engineer to perform deep packet analysis while remaining completely transparent to the attacker, as the mirrored traffic is a copy and does not affect the original flow. Unlike other options, Traffic Mirroring provides full packet capture (including headers and payloads) for forensic analysis, which is essential for investigating a compromise.

Answer

Enable VPC Flow Logs on the ENI and stream to Amazon S3 for analysis.

Answer

Attach a security group to the instance that logs all traffic to CloudWatch Logs.

Answer

Enable AWS Network Firewall on the VPC and configure a rule to log all traffic to the malicious IP.

Question 18

Drag and drop the steps to configure AWS WAF with rate-based rules in the correct order.

Accepted Answer

Create a web ACL, then add a rate-based rule to it, then associate the web ACL with an AWS resource, then test the rate-based rule, then monitor metrics and adjust thresholds.. Rate-based rules require creating a web ACL first, then adding the rule, associating with a resource, testing, and monitoring.

Answer

Add a rate-based rule to a web ACL first, then create the web ACL, then associate with a resource, then test, then monitor.

Answer

Create a web ACL, then associate it with a resource, then add a rate-based rule, then test, then monitor.

Answer

Create a web ACL, then add a rate-based rule, then test the rule, then associate the ACL with a resource, then monitor.

Question 19

A company has an AWS Lambda function that processes sensitive data. The security team wants to ensure that any errors or suspicious behavior are immediately investigated. Which combination of services should be used to send real-time notifications for anomalous function executions?

Accepted Answer

CloudWatch Logs and SNS. CloudWatch Logs can capture Lambda function execution logs, and a CloudWatch Logs metric filter can be configured to detect patterns indicative of errors or suspicious behavior (e.g., 'ERROR', 'Exception', or custom anomaly patterns). When the metric filter triggers a CloudWatch alarm, it can publish a message directly to an Amazon SNS topic, which then sends real-time notifications (e.g., email, SMS, or HTTP endpoint) to the security team for immediate investigation.

Answer

CloudTrail and SNS

Answer

AWS Config and SQS

Answer

Amazon Detective and SES

Question 20

During a security incident, a security engineer needs to preserve forensic evidence from an EC2 instance that may be compromised. The instance is running a critical application. Which approach minimizes data loss while ensuring the integrity of the evidence?

Accepted Answer

Create an EBS snapshot, then isolate the instance by modifying the security group and removing it from the load balancer.. Creating an EBS snapshot preserves the disk state at the point of the incident, capturing forensic evidence without altering the running instance. Isolating the instance by modifying the security group (e.g., removing all inbound/outbound rules) and removing it from the load balancer stops network traffic and prevents further compromise, minimizing data loss while maintaining the integrity of the evidence for later analysis.

Answer

Immediately terminate the instance to stop any ongoing malicious activity.

Answer

SSH into the instance and run forensic tools to capture memory.

Answer

Detach the instance from the Auto Scaling group and leave it running without changes.