SCS-C02 Threat Detection and Incident Response Practice Test 10 — 15 Questions

Question 1

A company uses Amazon GuardDuty to detect threats. The security team wants to be alerted when GuardDuty generates a finding with a severity level of HIGH or CRITICAL. Which AWS service should the team use to send notifications based on GuardDuty findings?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon EventBridge and Amazon Simple Notification Service (SNS). Amazon EventBridge can capture GuardDuty findings as events using a rule that matches the 'GuardDuty Finding' event type. The rule can then invoke an SNS topic to send email or SMS notifications. This is the recommended pattern because EventBridge provides native integration with GuardDuty and supports filtering by finding severity using event patterns, while SNS handles the actual notification delivery.

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Lambda

Answer

Amazon CloudWatch Logs and Amazon Simple Notification Service (SNS)

Question 2

A company's incident response team is using AWS Systems Manager to run commands on EC2 instances for forensic analysis. The team needs to ensure that the commands are run with minimal latency and that the results are stored securely. Which Systems Manager capability should the team use?

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Run Command is the correct capability because it allows the incident response team to execute commands on EC2 instances with minimal latency by using the SSM Agent to run scripts or commands directly, and it can store command output in Amazon S3 or CloudWatch Logs for secure, durable storage. This meets the requirement for low-latency execution and secure result storage without requiring interactive sessions or complex automation workflows.

Answer

AWS Systems Manager Automation

Answer

AWS Systems Manager Session Manager

Answer

AWS Systems Manager Patch Manager

Question 3

A security engineer is investigating a potential compromise of an EC2 instance. The engineer wants to capture volatile memory data and create a forensic image of the instance's EBS volumes. Which TWO actions should the engineer take? (Choose 2.)

Accepted Answer

Use AWS Systems Manager Run Command to execute a memory capture script.. AWS Systems Manager Run Command allows you to remotely execute scripts on EC2 instances without needing SSH access, which is critical during incident response to capture volatile memory data before the instance is compromised further. Option D is correct because creating an EBS snapshot provides a point-in-time forensic image of the root volume that can be analyzed offline without altering the original evidence.

Answer

Enable AWS CloudTrail for the instance.

Answer

Use AWS Backup to create a backup of the instance.

Answer

Use Amazon Inspector to scan the instance for vulnerabilities.

Question 4

A company is designing an incident response plan for AWS. The plan must include the ability to collect forensic data from EC2 instances without requiring SSH key pairs. Which TWO AWS services can be used to acquire forensic data from EC2 instances without remote access? (Choose 2.)

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Run Command allows you to run scripts or commands on EC2 instances via the SSM Agent, without requiring SSH keys or direct network access. This enables forensic data collection (e.g., memory dumps, log files) by executing commands remotely through the AWS Systems Manager service, using IAM roles for authentication.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 5

Your company has a single AWS account with a production VPC that contains several EC2 instances running a web application. The security team has enabled Amazon GuardDuty and AWS CloudTrail. Recently, GuardDuty reported a finding 'UnauthorizedAccess:EC2/TorClient' for one of the instances. The finding indicates that the instance is making connections to Tor exit nodes. You need to investigate and contain the incident. The instance is critical to the application and cannot be terminated. You have a forensic analysis instance in a separate security group. What should you do FIRST?

Accepted Answer

Isolate the instance by modifying its security group to remove all inbound and outbound rules except for the forensic analysis instance.. The first step in incident response for a compromised instance that cannot be terminated is to contain the threat by isolating it from the network. Modifying the security group to remove all inbound and outbound rules except for a specific forensic analysis instance prevents the compromised EC2 instance from communicating with Tor exit nodes or other external hosts, while still allowing controlled forensic access. This containment is immediate and reversible, aligning with the AWS incident response best practice of 'isolate first, investigate later'.

Answer

Terminate the instance immediately and launch a replacement.

Answer

Take an EBS snapshot of the instance's root volume for analysis.

Answer

Use AWS Systems Manager Run Command to install a forensic agent on the instance.

Question 6

Your organization uses AWS Organizations with 50 member accounts. You are the security administrator for the root account. You have enabled AWS CloudTrail in all accounts and centralized the logs in an S3 bucket in the root account. You also enabled Amazon GuardDuty in the root account and have delegated an administrator account. Recently, you received an alert from GuardDuty about a potential credential compromise in a member account. The finding indicates that an IAM user in that account made an API call from an unusual IP address. You need to quickly gather all CloudTrail events for that user from the last 30 days across all accounts. The logs are stored in a single S3 bucket with a prefix structure like 'AWSLogs//CloudTrail////'. What is the MOST efficient way to query these logs?

Accepted Answer

Use Amazon Athena to query the CloudTrail logs by creating a table partitioned by account, region, and date.. Amazon Athena is the most efficient way to query CloudTrail logs stored in S3 because it allows you to run SQL queries directly on the data without moving or downloading it. By creating a table partitioned by account, region, and date, you can quickly filter for the specific IAM user's events across all 50 accounts for the last 30 days, leveraging partition pruning to scan only the relevant log files. This approach minimizes data scanned and cost, while providing near-instant results.

Answer

Enable AWS CloudTrail Lake and create a new event data store that includes the historical logs.

Answer

Download all log files from the S3 bucket for the last 30 days and parse them locally.

Answer

Use Amazon CloudWatch Logs Insights to query the logs from the member account.

Question 7

Your company has a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The security team enabled AWS CloudTrail and Amazon GuardDuty. GuardDuty generates a finding 'Recon:EC2/PortProbeUnprotectedPort' for an EC2 instance that does not exist in the account. Upon investigation, you realize that the finding is triggered by a misconfigured Network Load Balancer (NLB) that is exposing a port to the internet. The NLB is used by the API Gateway. You need to reduce false positives for this specific finding. What should you do?

Accepted Answer

Create a suppression rule in GuardDuty to filter out findings for the NLB's public IP and port.. GuardDuty suppression rules allow you to filter out findings that are known false positives based on specific criteria, such as the public IP and port of the NLB. Since the NLB is intentionally exposing a port for API Gateway, the port probe finding is expected behavior, not a real threat. Suppressing findings for that specific combination reduces noise without disabling GuardDuty for the entire account.

Answer

Change the NLB to an Application Load Balancer.

Answer

Enable AWS Shield Advanced to block the probes.

Answer

Disable GuardDuty for the account.

Question 8

A security analyst needs to detect and alert on suspicious API calls in real time. Which combination of AWS services should be used?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Logs, and Amazon EventBridge.. AWS CloudTrail captures API calls and delivers log files to Amazon CloudWatch Logs, where you can define metric filters to detect suspicious patterns. Amazon EventBridge then consumes those filtered log events to trigger real-time alerts or automated remediation actions. This combination provides the end-to-end pipeline needed for real-time detection and alerting on API activity.

Answer

Amazon Inspector and AWS CloudTrail.

Answer

Amazon GuardDuty and AWS Lambda.

Answer

AWS Config and Amazon SNS.

Question 9

A company uses AWS Organizations with multiple accounts. The security team wants to centrally collect and analyze VPC Flow Logs from all accounts. What is the MOST efficient way to achieve this?

Accepted Answer

Configure VPC Flow Logs to deliver to a central S3 bucket in the security account, and use a bucket policy that grants the source accounts permission to write.. It uses a central S3 bucket in the security account with a bucket policy that grants the PutObject permission to the VPC Flow Logs delivery service from each source account. This is the most efficient approach as it avoids per-account configuration overhead, eliminates the need for cross-account replication, and provides a single location for centralized analysis using services like Amazon Athena or Amazon QuickSight.

Answer

Use AWS Firewall Manager to deploy VPC Flow Logs and aggregate logs in a single account.

Answer

Configure VPC Flow Logs to deliver to a central CloudWatch Logs log group in the management account.

Answer

Set up VPC Flow Logs in each account to deliver to local S3 buckets, then use S3 replication to copy to a central bucket.

Question 10

A security engineer is investigating a potential compromise. The engineer has captured a memory dump from an EC2 instance and needs to analyze it for malware. Which TWO actions should the engineer take to preserve the chain of custody? (Choose TWO.)

Accepted Answer

Record the date, time, and digital signature of the acquisition.. Recording the date, time, and digital signature of the acquisition establishes a clear audit trail, which is essential for proving that the evidence has not been tampered with. In forensic investigations, this metadata is part of the standard chain-of-custody documentation that demonstrates who collected the evidence, when, and that it remains unaltered. A digital signature (e.g., using a tool like gpg or a signed hash) provides non-repudiation and integrity verification beyond a simple hash.

Answer

Create an EBS snapshot of the instance's root volume.

Answer

Analyze the memory dump on the same EC2 instance.

Answer

Upload the memory dump to a public S3 bucket for analysis.

Question 11

A company wants to detect anomalous behavior in their AWS environment. Which THREE AWS services can be used for threat detection? (Choose THREE.)

Accepted Answer

AWS Security Hub. Amazon GuardDuty (D) is correct because it is a managed threat detection service that continuously monitors VPC Flow Logs, AWS CloudTrail management and S3 data events, and DNS logs to identify malicious or anomalous activity such as cryptocurrency mining, credential compromise, and reconnaissance. AWS Security Hub (B) is correct because it aggregates and correlates findings from GuardDuty, Inspector, Macie, and other sources, applies security standards checks, and surfaces prioritized threat-detection insights across accounts and Regions. Amazon Inspector (E) is correct because it performs automated vulnerability management by scanning EC2 instances, container images in ECR, and Lambda functions for software vulnerabilities and unintended network exposure, which supports detecting risky or anomalous configurations. AWS Trusted Advisor (A) is not a threat-detection service; it provides best-practice checks on cost, performance, security, fault tolerance, and service quotas. AWS Config (C) is a configuration recording and compliance-evaluation service that tracks resource changes and rule compliance, but it does not itself detect threats or malicious behavior.

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 12

An organization uses AWS CloudTrail with a multi-region trail. The security team suspects that an attacker has deleted logs. Which THREE findings would indicate that log deletion occurred? (Choose THREE.)

Accepted Answer

A `StopLogging` API call from an unknown IP address.. A `StopLogging` API call from an unknown IP address indicates that logging was deliberately disabled, which an attacker could do to cover their tracks. CloudTrail records all `StopLogging` events, and an unexpected source IP is a strong indicator of unauthorized activity. This directly suggests log deletion or suppression, as stopping the trail prevents further log delivery.

Answer

An S3 bucket with MFA Delete enabled.

Answer

Multiple `StartLogging` API calls in the logs.

Question 13

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team receives an alert from Amazon GuardDuty that one of the EC2 instances is generating outbound traffic to a known command-and-control (C2) IP address. The instance is part of an Auto Scaling group (ASG) with a minimum of 2 and maximum of 10 instances. The security incident response playbook instructs the team to isolate the compromised instance without affecting the application's availability. The team needs to preserve the instance for forensic analysis. Which action should the team take first?

Accepted Answer

Remove the instance from the ALB target group and attach a security group that denies all traffic.. Removing the instance from the ALB target group immediately stops new traffic from reaching the application, while attaching a security group that denies all traffic (e.g., a custom security group with no inbound/outbound rules) effectively isolates the instance at the network layer. This preserves the instance for forensic analysis and does not affect application availability, as the ASG will not automatically terminate the instance (since it is still running and healthy from the ASG's perspective). The ALB will continue to route traffic to the remaining healthy instances in the target group, maintaining service continuity.

Answer

Terminate the compromised EC2 instance and allow the ASG to launch a replacement.

Answer

Detach the EBS root volume from the instance and attach it to a forensic instance.

Answer

Shut down the instance from within the OS using AWS Systems Manager Run Command.

Question 14

A startup uses a single AWS account for development. The security engineer wants to detect if any EC2 instances have been compromised and are performing reconnaissance by probing open ports on other internal instances. The engineer has enabled VPC Flow Logs for all subnets. What is the most cost-effective way to detect this behavior?

Accepted Answer

Enable Amazon GuardDuty and review the findings.. Amazon GuardDuty is a managed threat detection service that uses machine learning and integrated threat intelligence to analyze VPC Flow Logs, DNS logs, and other data sources. It can automatically detect reconnaissance behavior such as port probing or port scanning from compromised EC2 instances without requiring any additional infrastructure or manual query setup. This makes it the most cost-effective solution because it operates on a pay-per-volume basis and eliminates the need for custom log analysis or per-instance agents.

Answer

Install a third-party intrusion detection system on each EC2 instance.

Answer

Use Amazon CloudWatch Logs Insights to query VPC Flow Logs for rejected traffic patterns.

Answer

Use AWS Config rules to check for security group changes.

Question 15

A company uses AWS Lambda functions to process sensitive data. The security team wants to ensure that if a Lambda function is compromised, the attacker cannot use the function's IAM role to access other AWS resources. The team has implemented the principle of least privilege by restricting the IAM role's permissions. However, they are concerned about a scenario where an attacker could use the Lambda function to execute AWS API calls that are not intended by the application. What additional measure should the team implement to reduce the risk of such lateral movement?

Accepted Answer

Use AWS IAM Access Analyzer to generate and refine the IAM policy based on actual usage.. AWS IAM Access Analyzer can generate IAM policies based on the actual API calls made by the Lambda function over a specified period. By reviewing and refining the policy to include only those actions, the team can further tighten least privilege beyond manual estimation, reducing the risk that an attacker could abuse unintended API calls. This directly addresses the concern of lateral movement by ensuring the function's role cannot perform actions not observed in normal operation.

Answer

Enable AWS CloudTrail data events for the Lambda function.

Answer

Attach a service control policy (SCP) that denies all actions except those explicitly allowed.

Answer

Place the Lambda function inside a VPC with no internet access.