SCS-C02 Threat Detection and Incident Response Practice Test 1 — 15 Questions

Question 1

A security engineer is configuring an AWS environment to detect and respond to potential security threats. Which AWS service can be used to automate the remediation of unwanted access to Amazon S3 buckets by invoking AWS Lambda functions?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads. It can integrate with AWS Lambda functions via CloudWatch Events to automate remediation actions, such as blocking unwanted access to S3 buckets by updating bucket policies or removing public access. This makes GuardDuty the correct choice for detecting and automatically responding to security threats against S3 resources.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS WAF

Question 2

A security team suspects that an attacker has compromised an EC2 instance and is using it to launch outbound DDoS attacks. The team needs to quickly isolate the instance while preserving forensic data. Which combination of actions should the team take? (Choose TWO.)

Accepted Answer

Apply a restrictive security group that blocks all outbound traffic.. Option A is correct because applying a restrictive security group that blocks all outbound traffic immediately stops the EC2 instance from sending any network packets, including DDoS traffic, without terminating the instance. This preserves the running state and allows forensic data collection from the instance's memory and disk. Security groups act as a stateful virtual firewall at the instance level, so blocking outbound traffic effectively isolates the instance from the network.

Answer

Modify the network ACL for the subnet to deny all outbound traffic.

Answer

Detach the instance from the Auto Scaling group.

Answer

Terminate the EC2 instance immediately.

Question 3

During an incident response, a security engineer needs to collect memory and disk forensics from a running EC2 Windows instance without causing the instance to crash. The engineer has AWS Systems Manager SSM Agent installed. Which method should the engineer use?

Accepted Answer

Use AWS Systems Manager Inventory to collect memory and disk information.. Option B is correct because AWS Systems Manager Inventory can collect both memory and disk forensics from a running EC2 Windows instance without causing it to crash. The SSM Agent, already installed, allows Inventory to gather metadata such as running processes (memory) and file system details (disk) via the AWS-CollectInventory document, which is designed for live data collection without rebooting or halting the instance.

Answer

Create an AMI of the instance.

Answer

Use AWS Backup to create a backup of the instance.

Answer

Create an EBS snapshot of the root volume.

Question 4

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all API calls in the organization are logged and retained for at least one year. Which AWS services or features should be used to meet these requirements? (Choose TWO.)

Accepted Answer

Amazon S3 lifecycle policy to transition logs to S3 Glacier after one year.. Option C is correct because an Amazon S3 lifecycle policy can automatically transition CloudTrail log objects from S3 Standard to S3 Glacier after one year, meeting the retention requirement cost-effectively. Option E is correct because AWS CloudTrail with an organization trail logs all API calls across all accounts in the AWS Organization, ensuring comprehensive logging.

Answer

Amazon GuardDuty with threat detection enabled.

Answer

AWS Config with recording enabled for all resources.

Answer

VPC Flow Logs for all VPCs.

Question 5

A security engineer is investigating a potential data exfiltration incident. The engineer notices large volumes of data being transferred from an Amazon S3 bucket to an external IP address. Which AWS services can be used to detect and alert on such behavior? (Choose THREE.)

Accepted Answer

Amazon CloudWatch Logs with S3 access log analysis.. Amazon CloudWatch Logs can ingest and analyze S3 access logs, which record detailed information about requests made to an S3 bucket, including the source IP address, request type, and bytes transferred. By analyzing these logs with CloudWatch Logs Insights or metric filters, you can detect large data transfers to external IPs and trigger alerts via CloudWatch Alarms, making it a valid detection and alerting mechanism for data exfiltration.

Answer

AWS Config with compliance rules.

Answer

VPC Flow Logs.

Question 6

A security engineer reviews the CloudTrail log entry in the exhibit. The engineer notices that an EC2 instance was launched using an AdminRole. Which additional information would help determine if this is a legitimate action or a potential compromise?

Accepted Answer

The source IP address 203.0.113.50 is from an unexpected geographic location not associated with the company.. The source IP address 203.0.113.50 is from an unexpected geographic location not associated with the company. In CloudTrail, the `sourceIPAddress` field records the originating IP of the API call. If an AdminRole is used from an IP outside the company's known CIDR ranges or geographic regions, it strongly indicates a potential compromise—such as stolen credentials or an attacker using the role from an unauthorized network. This is a key indicator of anomalous behavior in threat detection.

Answer

The AMI ID ami-0abcdef1234567890 is not a standard Amazon-provided AMI.

Answer

The instance type m5.xlarge is unusually large compared to previous launches.

Answer

The security group sg-0123456789abcdef0 allows inbound SSH from 0.0.0.0/0.

Question 7

A security engineer is analyzing the VPC Flow Logs entry in the exhibit. The log shows traffic from an internal IP to an external IP. Which potential security concern should the engineer investigate?

Accepted Answer

An EC2 instance is attempting to connect to an external host on port 3389 (RDP).. The VPC Flow Logs entry shows outbound traffic from an internal IP to an external IP on destination port 3389, which is the default port for Remote Desktop Protocol (RDP). RDP outbound from an EC2 instance to an external host is a security concern because it could indicate an attacker using the instance as a pivot point to connect to an external command-and-control server or to exfiltrate data via an RDP tunnel. The log direction (src internal, dst external) and port 3389 specifically point to an outbound RDP attempt, not inbound scanning or DDoS.

Answer

The instance is participating in a DDoS attack against the external IP.

Answer

An external host is scanning the internal network on port 443.

Answer

The security group allows inbound RDP from 0.0.0.0/0.

Question 8

A company has a security rule that all S3 buckets must have server access logging enabled. A security engineer uses AWS Config to evaluate compliance. The engineer configures a managed rule but notices that the rule does not evaluate all buckets. What is the most likely reason?

Accepted Answer

The rule only evaluates buckets that have a specific tag.. Option B is correct because the AWS Config managed rule `s3-bucket-server-access-logging-enabled` can be configured with a `tag` parameter. When a tag is specified, the rule only evaluates S3 buckets that have that exact tag key-value pair. If the security engineer did not apply the required tag to all buckets, or if the rule was configured with a tag that does not match all buckets, some buckets will be excluded from evaluation, causing the observed behavior.

Answer

The rule only evaluates buckets in the us-east-1 region.

Answer

The rule excludes buckets that have a bucket policy denying access to AWS Config.

Answer

The rule requires the logging target bucket to be in the same account.

Question 9

During a security incident, a security engineer needs to verify whether an EC2 instance's security group allowed inbound SSH from a specific IP address at the time of the incident. Which AWS service or feature should the engineer use to obtain this historical information?

Accepted Answer

AWS Config configuration history.. AWS Config configuration history records changes to security group rules, including the addition or removal of inbound SSH allow rules. By querying the configuration history for the specific security group, the engineer can determine the exact state of the rules at the time of the incident, including whether a specific IP address was allowed. This is the only service that provides a historical record of security group rule configurations.

Answer

Amazon CloudTrail event history.

Answer

AWS Systems Manager Inventory.

Answer

VPC Flow Logs.

Question 10

A security engineer is implementing automated incident response. The engineer wants to use AWS Lambda to automatically remediate GuardDuty findings. What is the recommended pattern to trigger the Lambda function?

Accepted Answer

Configure an Amazon EventBridge rule to match GuardDuty findings and invoke the Lambda function.. Amazon EventBridge is the recommended pattern because it natively integrates with AWS GuardDuty to receive all finding events in near real-time. By configuring an EventBridge rule that matches GuardDuty finding types (e.g., 'UnauthorizedAccess:EC2/SSHBruteForce'), you can directly invoke a Lambda function for automated remediation without polling or intermediate services. This pattern is serverless, event-driven, and follows AWS best practices for decoupled incident response.

Answer

Subscribe the Lambda function to an SNS topic that GuardDuty publishes findings to.

Answer

Use CloudWatch Logs subscription filter to trigger Lambda on GuardDuty log entries.

Answer

Have the Lambda function poll the EC2 instance metadata for threat indicators.

Question 11

A company uses AWS Systems Manager Patch Manager to patch EC2 instances. During a security incident, the security team needs to quickly patch a critical vulnerability across all Windows instances in a specific AWS region. Which steps should the team take? (Choose TWO.)

Accepted Answer

Assign the patch baseline to the instances by specifying a patch group.. Option A is correct because assigning a custom patch baseline to instances via a patch group allows the security team to target specific Windows instances for patching. Patch Manager uses patch groups to associate instances with a specific patch baseline, ensuring only the desired instances receive the critical patch. This approach provides granular control over which instances are patched during an incident.

Answer

Tag all instances with 'PatchGroup=Critical' to include them in the patching.

Answer

Use the AWS-provided default patch baseline for Windows.

Answer

Use SSM Run Command to execute a script that downloads and installs the patch.

Question 12

A company runs a critical web application on a fleet of EC2 instances behind an Application Load Balancer (ALB). The application uses an Aurora MySQL database. The security team receives an alert from Amazon GuardDuty that a specific EC2 instance is exhibiting behavior consistent with a cryptocurrency mining attack, including outbound connections to known mining pools. The instance is part of an Auto Scaling group that uses a launch template with a security group that allows outbound HTTPS traffic to 0.0.0.0/0. The security engineer needs to contain the incident while minimizing downtime for the application. The engineer has already taken a forensic snapshot of the instance's EBS volume. Which course of action should the engineer take next?

Accepted Answer

Modify the security group attached to the instance to deny all outbound traffic, and let Auto Scaling launch a replacement instance.. Option A is correct because modifying the security group to deny all outbound traffic immediately stops the cryptocurrency mining communication to known mining pools without terminating the instance, preserving forensic data. The Auto Scaling group will detect the instance's health check failure (due to the application becoming unreachable) and automatically launch a replacement instance, minimizing downtime. This approach contains the incident while allowing the application to recover through the Auto Scaling group's self-healing mechanism.

Answer

SSH into the instance and run a script to kill the mining process.

Answer

Detach the instance from the Auto Scaling group and isolate it by removing all security group rules.

Answer

Immediately terminate the compromised EC2 instance and allow Auto Scaling to launch a new instance.

Question 13

A security engineer is investigating a potential credential compromise. An IAM user's access key was used to launch EC2 instances in a region where the user has never operated before. The engineer wants to quickly identify all API calls made by this user in the last 24 hours, including the source IP addresses. Which AWS service or feature should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made by IAM users, including the source IP address, user identity, and request details. By querying CloudTrail logs for the specific IAM user's access key over the last 24 hours, the engineer can identify every EC2-related and other API call, along with the originating IP addresses, enabling rapid investigation of the potential credential compromise.

Answer

VPC Flow Logs

Answer

AWS Trusted Advisor

Answer

Amazon CloudWatch Logs

Question 14

A company uses AWS Organizations with multiple accounts and has enabled AWS Security Hub in the management account. The security team wants to automatically remediate a specific finding type that appears in Security Hub. Which combination of services should be used to achieve this?

Accepted Answer

Amazon EventBridge and AWS Lambda. Amazon EventBridge can capture Security Hub findings as events using an event rule that matches the specific finding type. When the rule triggers, it invokes an AWS Lambda function that contains the remediation logic, such as modifying security group rules or disabling access keys. This combination provides a serverless, event-driven architecture for automated response to Security Hub findings.

Answer

AWS Config conformance packs and AWS Systems Manager Automation

Answer

Amazon Inspector and AWS Step Functions

Answer

Amazon GuardDuty and AWS Lambda

Question 15

A security engineer is configuring an automated incident response workflow for Amazon GuardDuty findings. Which TWO actions should the engineer take to ensure that the response is triggered for all current and future GuardDuty findings?

Accepted Answer

Create an Amazon EventBridge rule with an event pattern that matches GuardDuty finding events.. Option B is correct because Amazon EventBridge can capture all GuardDuty findings by using an event pattern that matches the 'GuardDuty Finding' event type. This ensures that both current and future findings automatically trigger the rule without requiring manual updates or additional configuration.

Answer

Enable GuardDuty to export findings to CloudWatch Logs and then create a metric filter.

Answer

Create an Amazon SNS topic and subscribe the Lambda function to it, then configure GuardDuty to publish to SNS.

Answer

Set up a CloudWatch Logs subscription filter to forward GuardDuty logs to the Lambda function.