SCS-C02 Threat Detection and Incident Response Practice Test 12 — 15 Questions

Question 1

Which THREE actions should be taken when preparing an incident response plan for AWS?

Accepted Answer

Enable AWS CloudTrail in all regions.. AWS CloudTrail must be enabled in all regions to ensure that all API calls across the entire AWS infrastructure are logged. This provides a comprehensive audit trail essential for forensic investigation and identifying the scope of a security incident. Without multi-region CloudTrail, an attacker could operate in an unmonitored region, leaving no trace for incident responders.

Answer

Share the AWS account root user password with the incident response team.

Answer

Disable VPC Flow Logs to reduce log volume.

Question 2

Which TWO steps are part of the forensic acquisition process for an EC2 instance suspected of being compromised?

Accepted Answer

Capture the instance's memory using a forensic tool.. Capturing the instance's memory using a forensic tool (such as LiME or F-Response) preserves volatile data—including running processes, network connections, and encryption keys—that would be lost if the instance were stopped or terminated. This is a critical step in the forensic acquisition process to gather evidence of compromise without altering the system state.

Answer

Stop the instance immediately to prevent further damage.

Answer

Enable termination protection on the instance.

Answer

Terminate the instance to ensure the threat is contained.

Question 3

Refer to the exhibit. A security engineer is reviewing an S3 bucket policy. The policy is intended to allow read access to objects in the bucket only from the corporate network (203.0.113.0/24). However, users outside the network can still access the bucket. What is the most likely reason?

Accepted Answer

The bucket policy does not include an explicit Deny statement for IP addresses outside the allowed range.. The bucket policy only grants read access to requests originating from the corporate network (203.0.113.0/24) using an Allow effect with a condition. This Allow statement does not explicitly deny other IP addresses. If there are other applicable Allow permissions (e.g., from IAM user policies or a bucket ACL), they can still allow access from outside the network. To restrict access only to the corporate network, add an explicit Deny for s3:GetObject when aws:SourceIp is not in 203.0.113.0/24.

Answer

The s3:GetObject action is misspelled; it should be s3:GetObjectVersion.

Answer

The condition key should be aws:SourceIp instead of aws:SourceIp.

Answer

The bucket policy must be attached to the bucket's ACL instead.

Question 4

Refer to the exhibit. A security engineer is analyzing a VPC Flow Logs entry for an EC2 instance with private IP 192.0.2.10. The log shows an accepted outbound connection from the instance to 203.0.113.50 on port 443. The instance is not expected to initiate outbound HTTPS connections. What should the engineer do next to investigate?

Accepted Answer

Log into the instance and check for unauthorized processes or malware.. The VPC Flow Logs show an accepted outbound connection from the EC2 instance to an external IP on port 443, which is unexpected behavior. The immediate next step is to log into the instance and investigate for unauthorized processes, malware, or compromised credentials that could be initiating this outbound HTTPS traffic. This aligns with incident response best practices: verify the host before making network-level changes.

Answer

Block the IP 203.0.113.50 in the security group immediately.

Answer

Check the security group rules to see if outbound HTTPS is allowed.

Answer

Check Amazon Route 53 DNS logs to see what domain was resolved.

Question 5

A security engineer is investigating a potential data breach. AWS CloudTrail logs show that an IAM user 'svc-backup' created an S3 bucket in the us-east-1 region and then uploaded a large number of objects. The engineer suspects that the user's credentials were compromised. What is the MOST efficient way to quickly identify the source IP address and user agent of the API calls made by this user?

Accepted Answer

Query AWS CloudTrail logs in Amazon Athena for the user's API calls.. CloudTrail logs capture detailed records of all API calls, including the source IP address and user agent for each request. By querying these logs with Amazon Athena, the security engineer can efficiently filter for the specific IAM user 'svc-backup' and extract the source IP and user agent from the relevant event records, enabling rapid identification of the compromised credentials' origin.

Answer

Analyze VPC Flow Logs for traffic to the S3 bucket.

Answer

Enable Amazon GuardDuty and review the generated findings.

Answer

Use AWS Config to review the configuration history of the S3 bucket.

Question 6

A company uses AWS Lambda functions that process sensitive data. The security team wants to ensure that any unauthorized invocation of the functions is detected and alerted. The team has enabled AWS CloudTrail and is monitoring for Lambda Invoke API calls. However, they are concerned about missing events that occur within the Lambda service itself (e.g., internal retries). What should the team do to capture all relevant events?

Accepted Answer

Enable CloudTrail data events for Lambda functions.. To detect unauthorized invocations, you need to capture the Invoke API calls that initiate Lambda executions. CloudTrail data events for Lambda functions record each Invoke API call, including caller identity, source IP, and timestamp. Lambda Insights is a performance monitoring tool and does not provide security audit details. Internal retries are not separate unauthorized invocations, so they are not relevant here.

Answer

Enable VPC Flow Logs for the Lambda function's VPC.

Answer

Configure CloudWatch Logs to capture all Lambda function logs.

Answer

Enable Amazon CloudWatch Lambda Insights.

Question 7

A security engineer is investigating a potential incident where an EC2 instance was compromised. The engineer has access to the following logs: CloudTrail, VPC Flow Logs, and OS-level logs from the instance. Which TWO log sources would be MOST useful to determine the initial attack vector? (Choose TWO.)

Accepted Answer

OS-level authentication and system logs. OS-level authentication and system logs (option B) are critical because they record local login attempts, sudo commands, and process executions that can reveal how an attacker gained initial access—such as via SSH brute force, a compromised user account, or a vulnerable service. CloudTrail logs (option C) are equally important because they capture API calls made to AWS services, including RunInstances, CreateKeyPair, and ModifySecurityGroup, which can show if the attacker launched the instance from a compromised AWS account or modified security groups to allow inbound traffic. Together, these two sources provide the evidence needed to trace the initial compromise vector, whether it originated from within the OS or through AWS API manipulation.

Answer

Amazon CloudWatch Metrics for the instance

Answer

AWS Config configuration history

Answer

VPC Flow Logs

Question 8

A company uses Amazon GuardDuty to monitor its AWS environment. The security team has received a GuardDuty finding of type 'Recon:EC2/PortProbeUnprotectedPort'. The finding indicates that an EC2 instance has an open SSH port that is being probed from the internet. The team wants to reduce the attack surface and prevent future probes. Which THREE actions should the team take? (Choose THREE.)

Accepted Answer

Modify the security group to allow SSH only from specific IP addresses.. Modifying the security group to allow SSH only from specific IP addresses directly restricts inbound traffic to trusted sources, eliminating the open exposure that triggers the GuardDuty 'Recon:EC2/PortProbeUnprotectedPort' finding. This is a fundamental network access control that reduces the attack surface by applying the principle of least privilege at the security group level.

Answer

Suppress the GuardDuty finding to reduce noise.

Answer

Terminate the EC2 instance and launch a new one.

Question 9

A company uses Amazon GuardDuty and AWS Security Hub in a single AWS account. The security team has created a custom action in Security Hub to send findings to a custom Lambda function for automated response. The Lambda function is designed to take remediation actions based on the finding type. During testing, the team notices that the Lambda function is not being invoked when new findings are generated. The Lambda function's resource-based policy allows invocations from Security Hub, and the function's execution role has necessary permissions. What is the most likely reason for the failure?

Accepted Answer

No Amazon EventBridge rule is configured to send Security Hub findings to the Lambda function.. Security Hub custom actions do not directly invoke Lambda functions. Instead, they generate events that must be routed via an Amazon EventBridge rule. Without a properly configured EventBridge rule that matches the custom action's event pattern and targets the Lambda function, the function will not be invoked. Option B is incorrect because GuardDuty being enabled for all resource types is not relevant to the invocation mechanism. Option C is incorrect because the Lambda function's execution role permissions are for accessing other AWS resources, not for being invoked by Security Hub. Option D is incorrect because while the resource-based policy allows invocation from Security Hub, Security Hub does not directly invoke Lambda; it relies on EventBridge.

Answer

GuardDuty is not enabled for all required resource types.

Answer

The Lambda function's execution role does not have permission to access GuardDuty.

Answer

The Lambda function's resource-based policy does not include Security Hub as a principal.

Question 10

A company uses AWS CloudTrail to log all API activity. The security team wants to be alerted when an IAM user creates a new access key. They have created a CloudWatch metric filter on the CloudTrail log group for the event name 'CreateAccessKey' and set up a CloudWatch alarm that sends an email via Amazon SNS. However, the alarm is not triggering even though the team knows that access keys have been created. The metric filter has been tested and shows data points in CloudWatch. What should the security team check next?

Accepted Answer

Review the CloudWatch alarm configuration, including the period and threshold.. The metric filter is producing data points, which means logs are being ingested and the filter is matching events. The most likely issue is that the CloudWatch alarm's period or threshold is misconfigured—for example, the evaluation period might be too long or the threshold too high, causing the alarm to not transition to ALARM state despite the metric having values. The security team should verify the alarm's settings, such as the period (e.g., 5 minutes) and the threshold (e.g., >= 1), to ensure they align with the expected frequency of access key creation events.

Answer

Ensure that the CloudTrail trail is delivering logs to the correct CloudWatch Logs log group.

Answer

Verify that the CloudTrail trail is logging data events.

Answer

Check that the IAM user has permissions to create access keys.

Question 11

A company has a serverless application using AWS Lambda, API Gateway, and DynamoDB. The security team wants to detect and respond to potential SQL injection attempts in API requests. They have enabled AWS WAF on the API Gateway and created a rule to block SQL injection. However, they also want to capture the blocked requests for analysis and store them in an S3 bucket. The team has configured WAF to send logs to Amazon Kinesis Data Firehose, which delivers to an S3 bucket. After testing, the team notices that the logs are not being delivered. The Firehose delivery stream is in the same AWS account, and the S3 bucket policy allows the Firehose service to write. What is the most likely cause?

Accepted Answer

The Kinesis Data Firehose delivery stream does not have an IAM role with permissions to write to the S3 bucket.. Kinesis Data Firehose requires an IAM role with permissions to write to the S3 bucket. Even if the bucket policy allows the Firehose service, the delivery stream's IAM role must be granted write access to the bucket. Option A is incorrect because WAF can be configured to log blocked requests; the issue is that logs are not being delivered at all. Option C is incorrect because the bucket policy already allows Firehose, but the IAM role for the delivery stream is separate and must also have permissions. Option D is incorrect because Firehose delivers logs in near real time (typically within 60 seconds), so the delay is not the cause.

Answer

The WAF web ACL is not configured to log blocked requests.

Answer

The S3 bucket policy does not grant write permissions to the Firehose delivery stream's IAM role.

Answer

Kinesis Data Firehose delivers logs in batches every 5 minutes, so the team should wait longer.

Question 12

A company uses Amazon GuardDuty and AWS Security Hub. The security team has configured a custom insight in Security Hub to track findings related to S3 bucket exposures. They want to automatically remediate these findings by applying an S3 bucket policy that blocks public access. The team has created a Lambda function that applies the bucket policy and configured Security Hub to send findings to the Lambda function via a custom action. However, when a new finding is generated, the Lambda function is invoked but fails to apply the policy because it does not have permission to modify the S3 bucket. The Lambda function's execution role has permissions to modify S3 bucket policies, but the function is in the same account as the bucket. What should the team check?

Accepted Answer

Check the S3 bucket policy for any explicit deny statements that might block the Lambda function's role.. Even if the Lambda function has permissions, the S3 bucket policy may explicitly deny access to the Lambda function's role. Option A is incorrect because bucket ACLs are not used to grant permissions to Lambda functions; the Lambda function's execution role needs to be allowed by the bucket policy. Option B is incorrect because Security Hub does not need to assume the Lambda execution role; Security Hub sends events to Lambda via a custom action, and Lambda is invoked directly—no trust policy for Security Hub is required. Option D is incorrect because S3 block public access settings control whether bucket policies that grant public access can be applied, but they do not prevent the Lambda function from modifying the bucket policy; the issue is likely an explicit deny in the bucket policy.

Answer

Add the Lambda function's execution role to the bucket's Access Control List (ACL).

Answer

Ensure that the Lambda function's execution role has a trust policy that allows Security Hub to assume it.

Answer

Verify that the S3 bucket's block public access settings are not preventing the policy update.

Question 13

A security engineer is configuring an AWS environment to detect and respond to potential security threats. Which AWS service can be used to automate the remediation of unwanted access to Amazon S3 buckets by invoking AWS Lambda functions?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads. It can integrate with AWS Lambda functions via CloudWatch Events to automate remediation actions, such as blocking unwanted access to S3 buckets by updating bucket policies or removing public access. This makes GuardDuty the correct choice for detecting and automatically responding to security threats against S3 resources.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS WAF

Question 14

A security engineer is investigating a potential data exfiltration incident. The engineer notices large volumes of data being transferred from an Amazon S3 bucket to an external IP address. Which AWS services can be used to detect and alert on such behavior? (Choose THREE.)

Accepted Answer

Amazon CloudWatch Logs with S3 access log analysis.. Amazon CloudWatch Logs can ingest and analyze S3 access logs, which record detailed information about requests made to an S3 bucket, including the source IP address, request type, and bytes transferred. By analyzing these logs with CloudWatch Logs Insights or metric filters, you can detect large data transfers to external IPs and trigger alerts via CloudWatch Alarms, making it a valid detection and alerting mechanism for data exfiltration.

Answer

AWS Config with compliance rules.

Answer

VPC Flow Logs.

Question 15

A security engineer is analyzing the VPC Flow Logs entry in the exhibit. The log shows traffic from an internal IP to an external IP. Which potential security concern should the engineer investigate?

Accepted Answer

An EC2 instance is attempting to connect to an external host on port 3389 (RDP).. The VPC Flow Logs entry shows outbound traffic from an internal IP to an external IP on destination port 3389, which is the default port for Remote Desktop Protocol (RDP). RDP outbound from an EC2 instance to an external host is a security concern because it could indicate an attacker using the instance as a pivot point to connect to an external command-and-control server or to exfiltrate data via an RDP tunnel. The log direction (src internal, dst external) and port 3389 specifically point to an outbound RDP attempt, not inbound scanning or DDoS.

Answer

The instance is participating in a DDoS attack against the external IP.

Answer

An external host is scanning the internal network on port 443.

Answer

The security group allows inbound RDP from 0.0.0.0/0.