SCS-C02 Threat Detection and Incident Response Practice Test 10 — 15 Questions

Question 1

A security engineer is configuring an automated incident response workflow. When a GuardDuty finding of type 'UnauthorizedAccess:EC2/SSHBruteForce' is generated, the workflow should isolate the EC2 instance and snapshot its EBS volume. Which AWS service can coordinate these actions?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Step Functions. AWS Step Functions is the correct service because it is designed to orchestrate multi-step workflows by coordinating AWS services like Lambda, EC2, and EBS snapshots in a defined state machine. For the given GuardDuty finding, Step Functions can receive the event, invoke a Lambda function to isolate the EC2 instance (e.g., modify security groups or attach a deny-all NACL), and then trigger another Lambda or direct API call to snapshot the EBS volume, all with built-in error handling, retries, and sequencing.

Answer

AWS Lambda functions invoked sequentially

Answer

AWS CloudFormation

Answer

AWS Config rules with auto-remediation

Question 2

A company has a requirement to detect and alert on S3 objects that contain personally identifiable information (PII) being shared publicly. Which AWS service should be used?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover, classify, and protect sensitive data such as personally identifiable information (PII) stored in Amazon S3. It can automatically generate alerts when S3 objects containing PII are made publicly accessible, meeting the requirement to detect and alert on such events.

Answer

Amazon CloudWatch

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 3

A security engineer is investigating a potential security incident involving an Amazon RDS database. The engineer needs to identify which of the following actions should be taken during the forensic analysis phase? (Select TWO.)

Accepted Answer

Take a manual snapshot of the RDS instance.. Taking a manual snapshot preserves a point-in-time, immutable copy of the RDS instance for offline forensic analysis without altering the live database. This ensures that evidence is captured before any changes occur during the investigation, and the snapshot can be restored to a separate instance for safe examination.

Answer

Enable automatic backups if not already enabled.

Answer

Disable deletion protection to allow cleanup.

Answer

Modify the security group to restrict database access.

Question 4

A security team is designing an automated incident response system. The system must meet the following requirements: (1) automatically respond to GuardDuty findings, (2) ensure that response actions are logged and immutable, and (3) allow for human approval before destructive actions. Which services should the team use? (Select THREE.)

Accepted Answer

Amazon EventBridge. Amazon EventBridge (A) is correct because it can receive GuardDuty findings in near real-time and route them to downstream targets for automated response. This enables the first requirement by triggering workflows directly from GuardDuty events without custom polling.

Answer

AWS Lambda

Answer

Amazon Simple Notification Service (SNS)

Question 5

A security engineer is configuring Amazon GuardDuty to generate alerts for specific threat types. The engineer wants to ensure that alerts are sent to the security team's email distribution list and also trigger an automated Lambda function for immediate response. Which two actions should the engineer take? (Select TWO.)

Accepted Answer

Create an Amazon EventBridge rule that matches GuardDuty findings and triggers a Lambda function.. Amazon EventBridge (formerly CloudWatch Events) can be configured with a rule that matches GuardDuty finding events. When a finding matches the rule pattern, EventBridge can directly invoke a Lambda function for automated incident response, such as isolating a compromised instance or updating security groups.

Answer

Configure Amazon CloudWatch Logs to send log events to an email distribution list.

Answer

Create an Amazon CloudWatch Events rule to route findings to a Lambda function.

Answer

Create an Amazon Simple Queue Service (SQS) queue and have the Lambda function poll the queue.

Question 6

A company uses AWS Organizations to manage multiple accounts. The security team wants to centralize threat detection across all accounts. They enable Amazon GuardDuty in the management account and intend to use delegated administrator functionality. However, they find that GuardDuty is not detecting threats in member accounts. What is the most likely cause?

Accepted Answer

GuardDuty is not enabled in the member accounts. The security team must invite member accounts or use the delegated administrator to enable GuardDuty in all accounts.. Amazon GuardDuty must be enabled in each member account to detect threats in those accounts. When using the delegated administrator model, the security team can enable GuardDuty across all accounts programmatically via the delegated administrator API, but they must explicitly perform this action. Simply enabling GuardDuty in the management account does not automatically activate it in member accounts, which is why no threats are detected in those accounts.

Answer

GuardDuty requires an S3 bucket in each account to store findings.

Answer

GuardDuty only monitors the management account's resources, not member accounts.

Answer

GuardDuty does not support delegated administrator for AWS Organizations.

Question 7

A company is using AWS Lambda functions to process sensitive data. The security team wants to detect when a Lambda function is invoked with an unexpected payload that may indicate an injection attack. Which AWS service should the team use to inspect the function's input for malicious patterns?

Accepted Answer

None of the above; the team should implement custom validation within the Lambda function.. AWS Lambda functions process event payloads directly within the function code, and no AWS managed service can inspect the actual input data passed to a Lambda function at invocation time. AWS WAF operates at the HTTP/HTTPS layer for API Gateway or CloudFront, not for Lambda function payloads. Amazon Inspector scans for software vulnerabilities in EC2 instances and container images, not runtime payloads. AWS Shield provides DDoS protection at the network and transport layers. Amazon GuardDuty analyzes VPC flow logs, DNS logs, and CloudTrail events for threats, but it does not inspect Lambda function invocation payloads. Therefore, the only way to detect malicious patterns in the function's input is to implement custom validation logic within the Lambda function code itself.

Answer

AWS WAF

Answer

Amazon Inspector

Answer

AWS Shield

Answer

Amazon GuardDuty

Question 8

A security engineer is reviewing AWS CloudTrail logs and notices a large number of `DescribeInstances` API calls from a single IAM user in a short period. The engineer suspects a credential compromise. What is the most effective way to automatically revoke the compromised credentials and notify the security team?

Accepted Answer

Create an Amazon EventBridge rule that triggers an AWS Lambda function to revoke the keys and send an SNS notification.. It uses Amazon EventBridge to detect the anomalous DescribeInstances API calls (via CloudTrail as an event source), then triggers an AWS Lambda function to programmatically revoke the IAM user's access keys (using the `deactivate_access_key` or `delete_access_key` API), and sends an SNS notification to the security team. This provides an automated, near-real-time response to a suspected credential compromise without manual intervention.

Answer

Use AWS CloudTrail to automatically disable the IAM user's access keys.

Answer

Create an AWS Config rule that checks for excessive API calls and revokes keys.

Answer

Enable Amazon GuardDuty to automatically revoke compromised credentials.

Question 9

A company uses Amazon RDS for its database. The security team needs to detect when a database instance is started or stopped outside of maintenance windows. Which AWS service should the team use to monitor these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity in your AWS account, including StartDBInstance and StopDBInstance calls from the RDS service. By monitoring CloudTrail logs, the security team can detect when a database instance is started or stopped outside of maintenance windows, as each API call is logged with a timestamp and user identity. CloudTrail is specifically designed for auditing API calls, making it the appropriate tool for this use case.

Answer

Amazon CloudWatch

Answer

Amazon GuardDuty

Answer

AWS Config

Question 10

A company uses AWS CloudTrail to log all API activity. The security team wants to detect when an IAM user creates an access key for another user, which is a potential privilege escalation. Which TWO actions should the team take to set up this detection?

Accepted Answer

Create a CloudWatch alarm based on the metric filter.. To detect when an IAM user creates an access key for another user, the security team should create a CloudWatch Logs metric filter that matches the CreateAccessKey event (option C) and then create a CloudWatch alarm based on that metric filter (option B). The metric filter extracts the specific API call from CloudTrail logs, and the alarm triggers when the metric exceeds a threshold, alerting the team of potential privilege escalation. Option D, using EventBridge with Lambda, is also a valid method but is a single action, and the question asks for exactly two actions. Option A is incorrect because AWS Config managed rules evaluate resource configurations, not API events. Option E is incorrect because GuardDuty custom threat lists are for known malicious IPs, not for detecting specific API calls.

Answer

Create an AWS Config managed rule to detect CreateAccessKey calls.

Answer

Use Amazon EventBridge to create a rule that matches the CloudTrail event and triggers an AWS Lambda function.

Answer

Enable Amazon GuardDuty and create a custom threat list.

Question 11

A company wants to use AWS services to detect and respond to a potential DDoS attack on their web application hosted on EC2 instances behind an Application Load Balancer (ALB). Which TWO AWS services should the company use for detection and mitigation?

Accepted Answer

AWS WAF. AWS WAF is correct because it allows you to create web access control lists (web ACLs) to filter and monitor HTTP/HTTPS requests to your Application Load Balancer. By defining rate-based rules, you can automatically block IP addresses that exceed a threshold of requests per 5-minute window, mitigating layer 7 DDoS attacks such as HTTP floods or SQL injection attempts.

Answer

Amazon Route 53

Answer

Amazon CloudFront

Answer

Amazon GuardDuty

Question 12

A security team wants to detect and alert on API calls that create or modify IAM roles in their AWS account. Which AWS service can be used to create a metric filter and alarm for these specific CloudTrail events?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs can create metric filters on CloudTrail log data to detect specific API calls, such as CreateRole or UpdateAssumeRolePolicy. These metric filters can then trigger CloudWatch alarms for real-time notification. CloudTrail delivers logs to CloudWatch Logs, but the metric filter and alarm capabilities reside in CloudWatch Logs, not in CloudTrail itself.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Config

Question 13

During a security incident, a security engineer suspects that an EC2 instance has been compromised and is exfiltrating data to an external IP address. Which AWS service can provide real-time network traffic analysis and alert on unusual outbound traffic patterns?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) at the elastic network interface level. By enabling VPC Flow Logs and streaming them to Amazon CloudWatch Logs or Amazon S3, you can analyze outbound traffic patterns in near real-time using CloudWatch Logs Insights or third-party tools, and set up metric filters or alarms to detect unusual volumes to external IPs. This makes VPC Flow Logs the correct service for real-time network traffic analysis and alerting on suspicious outbound data exfiltration.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Question 14

A company uses AWS Organizations with multiple accounts. The security team wants to centralize threat detection and automatically remediate high-severity GuardDuty findings across all accounts. What is the MOST efficient way to achieve this?

Accepted Answer

Enable GuardDuty in the management account and designate a delegated administrator to manage findings across all accounts. AWS Organizations allows you to enable GuardDuty in the management account and designate a delegated administrator, which automatically enables GuardDuty across all member accounts and centralizes finding management. This approach eliminates the need for per-account configuration or cross-account IAM roles, as the delegated administrator can view and manage findings from all accounts in a single GuardDuty console. It is the most efficient method because it leverages native AWS Organizations integration for automated, centralized threat detection and remediation.

Answer

Create a Lambda function that enables GuardDuty in each account using cross-account IAM roles

Answer

Configure Amazon EventBridge to forward findings from each account to a central account

Answer

Use AWS Security Hub and enable GuardDuty in each account separately

Question 15

A security engineer needs to ensure that any changes to an S3 bucket's public access settings are immediately detected and an alert is sent. Which combination of AWS services should be used?

Accepted Answer

AWS Config and AWS Lambda. AWS Config continuously monitors and records changes to AWS resource configurations, including S3 bucket public access settings. By creating a Config rule that triggers on changes to the `PublicAccessBlockConfiguration` or bucket ACLs, you can invoke an AWS Lambda function via an Amazon SNS topic to send an alert. This combination provides real-time detection and automated response to unauthorized public access changes.

Answer

Amazon GuardDuty and AWS Lambda

Answer

Amazon CloudWatch Logs and Amazon SNS

Answer

AWS CloudTrail and Amazon CloudWatch Logs