SCS-C02 Threat Detection and Incident Response Practice Test 1 — 15 Questions

Question 1

During an incident response, a security engineer needs to collect memory and disk forensics from a running EC2 Windows instance without causing the instance to crash. The engineer has AWS Systems Manager SSM Agent installed. Which method should the engineer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an EBS snapshot of the root volume.. An EBS snapshot provides a forensic copy of the root volume but cannot capture volatile memory (RAM). To collect memory forensics, the engineer must run a memory dump tool via SSM Run Command before taking the snapshot. Since none of the options include a memory capture method, the question should be revised to either ask specifically for disk forensics or add an option for memory capture. As written, the question is invalid.

Answer

Create an AMI of the instance.

Answer

Use AWS Systems Manager Inventory to collect memory and disk information.

Answer

Use AWS Backup to create a backup of the instance.

Question 2

A security engineer is investigating a potential data exfiltration incident. The engineer notices large volumes of data being transferred from an Amazon S3 bucket to an external IP address. Which AWS services can be used to detect and alert on such behavior? (Choose THREE.)

Accepted Answer

Amazon CloudWatch Logs with S3 access log analysis.. Amazon CloudWatch Logs with S3 access log analysis (A) is correct because S3 server access logs record every request made to a bucket, including the requester's IP address and bytes sent, and CloudWatch Logs metric filters and alarms can detect and alert on unusually large data transfers to external IPs. AWS CloudTrail with S3 data event logging (B) is correct because data events capture object-level operations such as GetObject, and CloudTrail can deliver these events to CloudWatch Logs or EventBridge for anomaly-based alerting on suspicious exfiltration patterns. Amazon GuardDuty with anomaly detection (C) is correct because GuardDuty continuously analyzes CloudTrail management and data events, VPC Flow Logs, and DNS logs using machine learning and threat intelligence to generate findings such as Exfiltration:S3/AnomalousBehavior or UnauthorizedAccess. AWS Config with compliance rules (D) is not correct because Config evaluates resource configuration compliance against rules and does not detect or alert on live data-transfer behavior. VPC Flow Logs (E) is not correct because it captures IP traffic metadata for network interfaces and cannot inspect S3 object-level API activity or identify data exfiltration from a bucket.

Answer

AWS Config with compliance rules.

Answer

VPC Flow Logs.

Question 3

A company runs a critical web application on a fleet of EC2 instances behind an Application Load Balancer (ALB). The application uses an Aurora MySQL database. The security team receives an alert from Amazon GuardDuty that a specific EC2 instance is exhibiting behavior consistent with a cryptocurrency mining attack, including outbound connections to known mining pools. The instance is part of an Auto Scaling group that uses a launch template with a security group that allows outbound HTTPS traffic to 0.0.0.0/0. The security engineer needs to contain the incident while minimizing downtime for the application. The engineer has already taken a forensic snapshot of the instance's EBS volume. Which course of action should the engineer take next?

Accepted Answer

Detach the instance from the Auto Scaling group and isolate it by removing all security group rules.. The correct course of action is to isolate the compromised instance without disrupting the rest of the fleet. Detaching the instance from the Auto Scaling group removes it from management and triggers a replacement to maintain capacity. Removing or replacing its security group rules (or attaching a quarantine security group) halts all traffic, including outbound communication to mining pools. This contains the threat while minimizing downtime. Option A is wrong because the security group is defined in the launch template and is shared across all instances; modifying it would block outbound traffic for the entire application, causing a full outage. Option D is less ideal because immediate termination loses the ability to conduct further live forensics (though a snapshot exists) and may be hasty without first isolating the instance.

Answer

Modify the security group attached to the instance to deny all outbound traffic, and let Auto Scaling launch a replacement instance.

Answer

SSH into the instance and run a script to kill the mining process.

Answer

Immediately terminate the compromised EC2 instance and allow Auto Scaling to launch a new instance.

Question 4

Match each AWS IAM policy type to its description.

Accepted Answer

Identity-based policy: Attached to an IAM user, group, or role to define permissions. The correct matches are: Identity-based policies are attached to users, groups, or roles; Resource-based policies are attached to resources; Permissions boundaries limit maximum permissions; Session policies are passed during role assumption. Common confusions include swapping identity-based and resource-based definitions.

Answer

Identity-based policy: Attached to a resource and defines which principals can access it

Answer

Resource-based policy: Attached to an IAM user, group, or role

Question 5

A company wants to ensure that any deleted CloudTrail logs are detected and alerted within minutes. Which approach should they use?

Accepted Answer

Configure CloudTrail to send logs to CloudWatch Logs, create a metric filter for DeleteTrail events, and set a CloudWatch alarm to send an SNS notification.. CloudTrail management events (including DeleteTrail) are delivered to CloudWatch Logs, where a metric filter can match the exact event name. A CloudWatch alarm on that metric triggers an SNS notification within minutes, meeting the detection and alerting requirement. This approach directly monitors the CloudTrail API call that deletes the trail itself, not just the log files.

Answer

Enable S3 event notifications on the CloudTrail bucket for DELETE events.

Answer

Use AWS Config to track CloudTrail configuration changes and trigger a Lambda function.

Answer

Enable Amazon GuardDuty to monitor CloudTrail management events.

Question 6

During incident response, a security engineer needs to capture network traffic from an EC2 instance for forensic analysis. The instance is part of an Auto Scaling group. Which action preserves the most evidence while minimizing disruption?

Accepted Answer

Enable VPC Flow Logs for the subnet and analyze the logs.. VPC Flow Logs capture metadata (IP addresses, ports, protocols, packet sizes) of all traffic to/from the EC2 instance at the subnet level, preserving a forensic record without any disruption to the running instance or Auto Scaling group. This approach avoids stopping, terminating, or modifying the instance, ensuring the incident environment remains intact for further investigation.

Answer

Take an EBS snapshot and analyze network logs from the snapshot.

Answer

Use AWS Traffic Mirroring to mirror traffic to a monitoring appliance.

Answer

Terminate the instance and launch a new one to capture network logs.

Question 7

A security engineer is investigating a potential data exfiltration incident. The engineer suspects that an EC2 instance is sending data to an external IP address. Which TWO AWS services can provide evidence of outbound data transfer? (Select TWO.)

Accepted Answer

S3 server access logs. VPC Flow Logs (C) capture IP traffic information for network interfaces in a VPC, including source/destination IP addresses, ports, protocol, and bytes/packets transferred, so they can directly show an EC2 instance's outbound traffic to an external IP. S3 server access logs (A) record detailed requests made to S3 buckets, including the requester's IP and bytes sent, which can reveal data being uploaded to or downloaded from S3 as part of exfiltration. AWS Config (B) tracks resource configuration changes and compliance, not network traffic. AWS CloudTrail (D) logs API activity and management events, not the actual data-plane packet flows. AWS Trusted Advisor (E) provides best-practice checks and recommendations, not traffic evidence.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 8

A company has enabled AWS CloudTrail and wants to receive real-time notifications when specific API calls, such as DeleteTrail, are made. Which service should be used to trigger an alert based on CloudTrail log events?

Accepted Answer

Amazon CloudWatch Events / Amazon EventBridge. Amazon CloudWatch Events (now part of Amazon EventBridge) is the correct service to trigger real-time alerts based on CloudTrail log events. You can create a rule that matches specific API calls, such as DeleteTrail, and route the event to a target like an SNS topic or Lambda function for immediate notification. CloudTrail delivers log events to CloudWatch Logs, and EventBridge can directly consume those events for pattern matching and alerting.

Answer

AWS CloudTrail console notifications

Answer

Amazon VPC Flow Logs

Answer

Amazon S3 event notifications

Question 9

A company wants to ensure that all API calls made to AWS are logged for security analysis. Which TWO services can be used to achieve this? (Choose two.)

Accepted Answer

Amazon S3 server access logs. AWS CloudTrail (B) is correct because it records API activity across AWS services, capturing the identity of the caller, the time, source IP, request parameters, and response elements for every API call, which is exactly what is needed for security analysis of API calls. Amazon S3 server access logs (A) is also correct because it logs detailed records of requests made to an S3 bucket, including the requester, bucket name, request time, request action, and response status, so API-level access to S3 objects and buckets is captured for auditing. Amazon VPC Flow Logs (C) is not correct because it captures IP traffic metadata (source/destination IP, ports, protocol, bytes) at the ENI, subnet, or VPC level, not API calls. Amazon CloudWatch Logs (D) is not correct because it is a general log storage and monitoring service that only contains API-related data if something explicitly sends it there; it does not itself record AWS API calls. AWS Config (E) is not correct because it records resource configuration changes and compliance state over time, not the full set of API calls made to AWS services.

Answer

Amazon VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 10

Refer to the exhibit. A security engineer reviews an S3 bucket policy that is intended to allow the root user of account 123456789012 to get objects only from the 10.0.0.0/24 IP range. However, the policy is not working as expected. What is the MOST likely reason?

Accepted Answer

The condition should use 'aws:VpcSourceIp' instead of 'aws:SourceIp' when requests come through a VPC endpoint.. When requests to an S3 bucket originate from a VPC endpoint (such as a gateway VPC endpoint for S3), the source IP address is translated to the private IP of the VPC endpoint, and the `aws:SourceIp` condition key cannot be used to evaluate the original client IP. Instead, you must use the `aws:VpcSourceIp` condition key to restrict access based on the IP address of the VPC endpoint. The policy as written would fail to match any requests coming through the VPC endpoint, causing the intended restriction to not work.

Answer

The principal is set to root, which cannot be used in bucket policies.

Answer

The resource ARN is incorrect because it should include the bucket name without /*.

Answer

The condition key 'aws:SourceIp' is not supported for S3 bucket policies.

Question 11

During an incident response, a security engineer needs to collect memory and disk forensics from a running EC2 Windows instance without causing the instance to crash. The engineer has AWS Systems Manager SSM Agent installed. Which method should the engineer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

aws ssm start-session --target i-1234567890abcdef0 --document-name AWS-StartInteractiveCommand. AWS Systems Manager Session Manager with the AWS-StartInteractiveCommand document allows the security engineer to establish an interactive shell session to the EC2 instance without requiring direct internet access, SSH keys, or a bastion host. From this interactive session, the engineer can run native Linux commands like 'cat /proc/meminfo' or 'ps aux' to capture volatile memory and process information directly, which is the appropriate method for collecting volatile data during incident response.

Answer

aws ec2 get-console-output --instance-id i-1234567890abcdef0

Answer

aws ssm send-command --instance-ids i-1234567890abcdef0 --document-name AWS-RunShellScript --parameters commands='volatility -f /dev/mem imageinfo'

Answer

aws ec2-instance-connect send-ssh-public-key --instance-id i-1234567890abcdef0 --instance-os-user ec2-user --ssh-public-key file://key.pub

Question 12

Refer to the exhibit. A security engineer is reviewing a resource-based policy attached to an AWS Lambda function. The engineer notices that the policy allows any Lambda function in the account to invoke the function. Which security concern should the engineer address?

Accepted Answer

The policy allows invocation from any Lambda function across all AWS accounts.. The resource-based policy on the Lambda function uses a principal of `*` without any condition key (such as `aws:SourceAccount` or `aws:SourceArn`) to restrict invocation to only the same account. This means any Lambda function in any AWS account can invoke this function, which is a security concern as it allows cross-account invocation without authorization.

Answer

The policy grants excessive permissions by allowing all actions.

Answer

The policy does not specify a resource ARN, so it applies to all functions.

Answer

The policy allows the Lambda service to modify the function code.

Question 13

A security engineer is reviewing CloudTrail logs and notices API calls from an unknown IP address. The engineer needs to immediately block the IP address and receive alerts for any future suspicious activity. Which combination of actions should the engineer take?

Accepted Answer

Add the IP address to a VPC NACL with a DENY rule and update a CloudWatch metric filter to create an alarm on the IP address.. VPC Network ACLs (NACLs) are stateless and can explicitly deny traffic from a specific IP address at the subnet level, providing immediate blocking without affecting existing security group rules. A CloudWatch metric filter on CloudTrail logs can trigger an alarm for any future API calls from that IP, enabling proactive alerting. This combination addresses both the immediate blocking and ongoing monitoring requirements.

Answer

Create an AWS WAF IP set and associate it with the CloudFront distribution. Configure CloudFront to block the IP.

Answer

Add the IP address to a security group with a DENY rule and enable AWS Security Hub to send alerts.

Answer

Revoke IAM permissions for the user associated with the IP and enable GuardDuty for alerting.

Question 14

A company uses AWS Organizations and has GuardDuty enabled in all accounts. The security team wants to suppress low-severity findings that are known false positives for a specific member account. How can this be achieved with minimal administrative overhead?

Accepted Answer

In the member account, create a suppression rule in GuardDuty for the specific finding types.. GuardDuty supports suppression rules that can be created at the member account level to automatically archive low-severity findings that are known false positives. This approach allows the member account to manage its own findings without requiring changes to the GuardDuty configuration in the management account or other accounts, minimizing administrative overhead.

Answer

Disable GuardDuty for that member account and rely on other accounts.

Answer

Use AWS Security Hub insights to filter out those findings from the aggregated view.

Answer

Ask the delegated administrator to add a suppression rule in the GuardDuty console for that account.

Question 15

A security engineer is designing an incident response plan for a compromised S3 bucket. Which TWO actions should be taken to contain the incident? (Choose TWO.)

Accepted Answer

Enable CloudTrail data events for the bucket to log all object-level operations.. Option C is correct because enabling CloudTrail data events (S3 object-level logging) captures GetObject, PutObject, and DeleteObject API calls on the bucket, which is essential for scoping the compromise and preserving forensic evidence during containment. Option D is correct because applying a bucket policy that explicitly denies all principals (including the compromised credentials) immediately blocks further access to the bucket, effectively isolating it while the investigation proceeds. Option A is wrong because deleting the bucket destroys forensic evidence and is not a containment action. Option B is wrong because MFA Delete only protects against accidental or unauthorized version deletions and does not contain an active compromise. Option E is wrong because default encryption protects data at rest but does nothing to stop an ongoing intrusion.

Answer

Delete the bucket and recreate it.

Answer

Enable MFA Delete on the bucket.

Answer

Enable default encryption for the bucket.