SCS-C02 Threat Detection and Incident Response Practice Test 10 — 15 Questions

Question 1

A company has a security requirement to capture all DNS queries made by EC2 instances for threat analysis. Which AWS service can provide this capability with minimal configuration?

Accepted Answer

Amazon Route 53 Resolver DNS Firewall. Amazon Route 53 Resolver DNS Firewall can capture and log all DNS queries made by EC2 instances by enabling DNS query logging to Amazon S3 or CloudWatch Logs. This requires minimal configuration because it integrates directly with the VPC's DNS resolver, automatically capturing outbound DNS traffic without needing agents or changes to instance configurations.

Answer

VPC Flow Logs

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 2

A security analyst notices an IAM role 'AdminRole' is being assumed from an IP address outside the company's allowed network. The analyst wants to receive real-time alerts when this role is assumed from unauthorized locations. Which combination of services should be used?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Events, and Amazon SNS. Option D is correct because AWS CloudTrail logs IAM role assumption events (sts:AssumeRole) as CloudTrail events, which can be sent to Amazon CloudWatch Events (now Amazon EventBridge) as a real-time event stream. CloudWatch Events rules can then match specific patterns (e.g., source IP outside allowed ranges) and trigger an Amazon SNS notification to alert the security analyst immediately. This combination provides the real-time alerting required without additional polling or storage.

Answer

AWS CloudTrail, Amazon S3, and Amazon Athena

Answer

AWS Config, Amazon SNS, and AWS Lambda

Answer

Amazon GuardDuty and AWS Lambda

Question 3

A company wants to automatically isolate an EC2 instance that is suspected to be compromised. What is the MOST effective AWS-native approach?

Accepted Answer

Use Amazon GuardDuty to detect the compromise and automatically modify the instance's security group to deny all traffic. Amazon GuardDuty can detect suspicious activity on an EC2 instance (e.g., cryptocurrency mining, unusual outbound traffic) and, when integrated with Amazon EventBridge and AWS Lambda, automatically modify the instance's security group to deny all traffic. This approach isolates the instance without terminating it, preserving forensic evidence and allowing further investigation. It is the most effective AWS-native approach because it combines threat detection with automated, least-privilege response actions.

Answer

Terminate the instance immediately

Answer

Use AWS Config to change the instance's IAM role

Answer

Use AWS Systems Manager to run a script that stops the instance

Question 4

A security team needs to analyze historical CloudTrail logs across multiple AWS accounts to detect patterns of suspicious activity. Which solution provides the MOST cost-effective and scalable analysis?

Accepted Answer

Aggregate logs into a central S3 bucket and query with Amazon Athena. Aggregating CloudTrail logs into a central S3 bucket and querying with Amazon Athena is the most cost-effective and scalable solution because Athena uses a serverless, pay-per-query model with no infrastructure to manage, and it can directly analyze large volumes of structured log data stored in S3 using standard SQL. This approach avoids the cost of provisioning and maintaining dedicated clusters (as with Redshift or Elasticsearch) and avoids the per-GB ingestion and storage fees of CloudWatch Logs Insights, making it ideal for historical analysis across multiple accounts.

Answer

Stream logs to Amazon Elasticsearch Service and use Kibana

Answer

Load logs into Amazon Redshift for analysis

Answer

Use Amazon CloudWatch Logs Insights across all accounts

Question 5

A company has a requirement to detect and respond to threats in near real-time by analyzing VPC Flow Logs. The logs are generated in a VPC and sent to CloudWatch Logs. What is the MOST efficient way to analyze these logs for suspicious patterns and trigger automated responses?

Accepted Answer

Use Amazon Kinesis Data Analytics for real-time analysis and AWS Lambda for automated response. Amazon Kinesis Data Analytics can process streaming VPC Flow Logs from CloudWatch Logs in near real-time using SQL or Apache Flink, enabling immediate detection of suspicious patterns. AWS Lambda can then be triggered to automate incident response actions, such as updating security groups or isolating instances, making this the most efficient solution for near real-time threat detection and response.

Answer

Stream logs to Amazon Elasticsearch Service and use Kibana alerts

Answer

Use S3 event notifications to trigger Lambda functions on new log files

Answer

Export logs to S3 and use Amazon Athena queries with scheduled rules

Question 6

Which TWO actions are best practices for securing an AWS account's root user? (Choose 2.)

Accepted Answer

Use a strong password and store it securely. Option B is correct because the root user has unrestricted access to all AWS resources and services, so a strong, complex password (e.g., at least 14 characters with mixed case, numbers, and symbols) is essential to prevent brute-force or credential-stuffing attacks. Storing this password securely—such as in a password manager with restricted access or a physical safe—ensures it is available only to authorized personnel for emergency break-glass scenarios, aligning with the principle of least privilege and the AWS Well-Architected Framework's security pillar.

Answer

Share the root user password with the team for emergency access

Answer

Use the root user for daily administrative tasks

Answer

Create access keys for the root user for programmatic access

Question 7

Which THREE AWS services can be used to detect potentially compromised EC2 instances? (Choose 3.)

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) for network interfaces in a VPC. By analyzing flow logs for anomalous patterns—such as unexpected outbound connections to known malicious IPs, port scanning, or data exfiltration attempts—you can detect potentially compromised EC2 instances. This makes VPC Flow Logs a key detective control for threat detection.

Answer

AWS WAF

Answer

AWS Shield

Question 8

Which TWO steps should a security engineer take when responding to a confirmed security incident involving a compromised EC2 instance? (Choose 2.)

Accepted Answer

Isolate the instance by changing its security group to deny all traffic. Preserving the instance (snapshot) and isolating it (security group change) are key steps. Terminating immediately destroys evidence. Deleting logs is wrong. Reimaging without investigation destroys evidence.

Answer

Reimage the instance from a clean AMI immediately

Answer

Delete all CloudTrail logs related to the instance

Answer

Immediately terminate the instance to stop the attack

Question 9

A security engineer is reviewing AWS CloudTrail logs and notices repeated `CreateTrail` API calls from an IAM user that is not authorized to create trails. What is the MOST likely cause of these log entries?

Accepted Answer

The IAM user attempted to create a trail but was denied due to lack of permissions.. The repeated `CreateTrail` API calls in CloudTrail logs indicate that an IAM user is attempting to create a trail. Since the user lacks the required `cloudtrail:CreateTrail` permission, the API call is recorded as an attempted action that was denied by AWS Identity and Access Management (IAM) policy evaluation. CloudTrail logs all API calls, including those that fail due to insufficient permissions, which is why these entries appear in the logs.

Answer

AWS GuardDuty is generating simulated events.

Answer

S3 server access logs are enabled for the trail's S3 bucket.

Answer

CloudTrail is configured to log only data events.

Question 10

A company uses AWS Organizations with multiple accounts. The security team wants to centrally aggregate and analyze VPC Flow Logs from all accounts. Which solution is MOST efficient and scalable?

Accepted Answer

Configure VPC Flow Logs to send to Amazon Kinesis Data Firehose in each account, which delivers to a central Amazon OpenSearch Service domain.. Option D is correct because Amazon Kinesis Data Firehose can directly receive VPC Flow Logs from each account and deliver them to a centralized Amazon OpenSearch Service domain, enabling near-real-time aggregation and analysis without intermediate storage or replication overhead. This architecture is serverless, scales automatically, and avoids the complexity of managing cross-account S3 replication or EC2 instances, making it the most efficient and scalable solution for centralized log analysis.

Answer

Configure VPC Flow Logs to send to an S3 bucket in each account and use S3 Cross-Region Replication to a central bucket.

Answer

Launch Amazon EC2 instances in each account to run tcpdump and send logs to a central S3 bucket.

Answer

Configure VPC Flow Logs to send to CloudWatch Logs in each account and use cross-account CloudWatch dashboards.

Question 11

During an incident response, a security engineer needs to capture a memory image of a compromised Amazon EC2 instance running Linux. The instance is in a production Auto Scaling group. Which approach is BEST?

Accepted Answer

Detach the instance from the Auto Scaling group, isolate it by changing security groups, and use AWS Systems Manager Run Command to execute a memory acquisition tool.. Option C is correct because it preserves the volatile memory evidence by detaching the instance from the Auto Scaling group (preventing replacement) and isolating it via security group changes, then using AWS Systems Manager Run Command to execute a memory acquisition tool like LiME or AVML. This approach captures the memory image without shutting down the instance, which would destroy the evidence, and avoids the risk of the Auto Scaling group automatically terminating or replacing the instance during the investigation.

Answer

Use AWS CloudFormation to create a new stack with a forensic instance and copy the compromised instance's data.

Answer

Terminate the instance immediately to prevent further damage and launch a replacement.

Answer

Take a snapshot of the EBS volumes and attach them to a forensic instance to analyze memory.

Question 12

A security engineer receives an AWS GuardDuty finding for 'UnauthorizedAccess:EC2/SSHBruteForce'. The affected EC2 instance has a public IP and is in a public subnet. What is the IMMEDIATE step to contain the threat?

Accepted Answer

Update the security group to deny inbound SSH from the attacker's IP address.. Option D is correct because updating the security group to deny inbound SSH from the attacker's IP address immediately blocks the brute force attempts at the instance level without disrupting legitimate traffic from other sources. Security groups are stateful and act as a virtual firewall for EC2 instances, so denying the specific attacker IP for port 22 (SSH) stops the attack while preserving the instance's availability and other services.

Answer

Stop the EC2 instance to stop the brute force attempts.

Answer

Change the security group name to 'Quarantine' and remove all rules.

Answer

Modify the network ACL to deny all inbound traffic from the attacker's IP address range.

Question 13

A company's AWS Lambda function that processes sensitive data is triggering unexpectedly. The security team wants to investigate using AWS CloudTrail. What should they look for?

Accepted Answer

`Invoke` events in CloudTrail from the Lambda service.. Option C is correct because `Invoke` events in CloudTrail record every invocation of a Lambda function, including the source (e.g., AWS service, SDK, or console) and the identity that triggered it. By analyzing these events, the security team can identify unexpected triggers, such as unauthorized IAM users or roles invoking the function, or anomalous invocation patterns that indicate a potential security issue.

Answer

`UpdateFunctionConfiguration` events in CloudTrail from the Lambda service.

Answer

`CreateFunction` events in CloudTrail from the Lambda service.

Answer

`PutSubscriptionFilter` events in CloudTrail from CloudWatch Logs.

Question 14

During a security incident, a security engineer needs to collect EBS snapshots of multiple EC2 instances across different accounts in AWS Organizations. The snapshots must be copied to a central forensics account. Which combination of steps is MOST efficient?

Accepted Answer

Use AWS Backup to create backup plans in each account and enable cross-account backup copy to the forensics account.. AWS Backup is the most efficient solution because it natively supports cross-account backup copy, allowing you to create backup plans in each account and automatically copy EBS snapshots to a central forensics account without custom scripting or manual intervention. This integrates directly with AWS Organizations, enabling centralized management of backup policies across multiple accounts, which is ideal for incident response scenarios requiring rapid, consistent snapshot collection.

Answer

Use Amazon Data Lifecycle Manager (DLM) to create snapshots and copy them to the forensics account using S3 cross-region replication.

Answer

Use AWS CloudFormation StackSets to deploy a stack that creates snapshots and copies them manually.

Answer

Use AWS Systems Manager Automation to run scripts in each account that create snapshots and copy them to the forensics account via Lambda.

Question 15

A security engineer is reviewing AWS CloudTrail and notices `AssumeRole` API calls to a role that should not be assumed by the source identity. What is the FIRST step in the incident response process?

Accepted Answer

Investigate the source IP address and user agent of the `AssumeRole` calls.. The first step in any incident response process is to investigate and gather evidence to understand the scope and impact of the potential security event. Option C is correct because analyzing the source IP address and user agent of the `AssumeRole` API calls provides critical forensic data to determine if the activity is malicious or a false positive, without disrupting operations or destroying evidence. AWS CloudTrail logs these details, enabling the security engineer to trace the origin of the unauthorized assumption before taking any containment or remediation actions.

Answer

Enable AWS GuardDuty to detect future anomalies.

Answer

Delete the IAM role immediately.

Answer

Disable the AWS account and contact support.