SCS-C02 Threat Detection and Incident Response Practice Test 12 — 15 Questions

Question 1

A security engineer is reviewing AWS CloudTrail logs and notices repeated `CreateTrail` API calls from an IAM user that is not authorized to create trails. What is the MOST likely cause of these log entries?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The IAM user attempted to create a trail but was denied due to lack of permissions.. The repeated `CreateTrail` API calls in CloudTrail logs indicate that an IAM user is attempting to create a trail. Since the user lacks the required `cloudtrail:CreateTrail` permission, the API call is recorded as an attempted action that was denied by AWS Identity and Access Management (IAM) policy evaluation. CloudTrail logs all API calls, including those that fail due to insufficient permissions, which is why these entries appear in the logs.

Answer

AWS GuardDuty is generating simulated events.

Answer

S3 server access logs are enabled for the trail's S3 bucket.

Answer

CloudTrail is configured to log only data events.

Question 2

A company uses AWS Organizations with multiple accounts. The security team wants to centrally aggregate and analyze VPC Flow Logs from all accounts. Which solution is MOST efficient and scalable?

Accepted Answer

Configure VPC Flow Logs to send to Amazon Kinesis Data Firehose in each account, which delivers to a central Amazon OpenSearch Service domain.. Amazon Kinesis Data Firehose can directly receive VPC Flow Logs from each account and deliver them to a centralized Amazon OpenSearch Service domain, enabling near-real-time aggregation and analysis without intermediate storage or replication overhead. This architecture is serverless, scales automatically, and avoids the complexity of managing cross-account S3 replication or EC2 instances, making it the most efficient and scalable solution for centralized log analysis.

Answer

Configure VPC Flow Logs to send to an S3 bucket in each account and use S3 Cross-Region Replication to a central bucket.

Answer

Launch Amazon EC2 instances in each account to run tcpdump and send logs to a central S3 bucket.

Answer

Configure VPC Flow Logs to send to CloudWatch Logs in each account and use cross-account CloudWatch dashboards.

Question 3

During an incident response, a security engineer needs to capture a memory image of a compromised Amazon EC2 instance running Linux. The instance is in a production Auto Scaling group. Which approach is BEST?

Accepted Answer

Detach the instance from the Auto Scaling group, isolate it by changing security groups, and use AWS Systems Manager Run Command to execute a memory acquisition tool.. It preserves the volatile memory evidence by detaching the instance from the Auto Scaling group (preventing replacement) and isolating it via security group changes, then using AWS Systems Manager Run Command to execute a memory acquisition tool like LiME or AVML. This approach captures the memory image without shutting down the instance, which would destroy the evidence, and avoids the risk of the Auto Scaling group automatically terminating or replacing the instance during the investigation.

Answer

Use AWS CloudFormation to create a new stack with a forensic instance and copy the compromised instance's data.

Answer

Terminate the instance immediately to prevent further damage and launch a replacement.

Answer

Take a snapshot of the EBS volumes and attach them to a forensic instance to analyze memory.

Question 4

A company's AWS Lambda function that processes sensitive data is triggering unexpectedly. The security team wants to investigate using AWS CloudTrail. What should they look for?

Accepted Answer

`Invoke` events in CloudTrail from the Lambda service.. `Invoke` events in CloudTrail record every invocation of a Lambda function, including the source (e.g., AWS service, SDK, or console) and the identity that triggered it. By analyzing these events, the security team can identify unexpected triggers, such as unauthorized IAM users or roles invoking the function, or anomalous invocation patterns that indicate a potential security issue.

Answer

`UpdateFunctionConfiguration` events in CloudTrail from the Lambda service.

Answer

`CreateFunction` events in CloudTrail from the Lambda service.

Answer

`PutSubscriptionFilter` events in CloudTrail from CloudWatch Logs.

Question 5

During a security incident, a security engineer needs to collect EBS snapshots of multiple EC2 instances across different accounts in AWS Organizations. The snapshots must be copied to a central forensics account. Which combination of steps is MOST efficient?

Accepted Answer

Use AWS Backup to create backup plans in each account and enable cross-account backup copy to the forensics account.. AWS Backup is the most efficient solution because it natively supports cross-account backup copy, allowing you to create backup plans in each account and automatically copy EBS snapshots to a central forensics account without custom scripting or manual intervention. This integrates directly with AWS Organizations, enabling centralized management of backup policies across multiple accounts, which is ideal for incident response scenarios requiring rapid, consistent snapshot collection.

Answer

Use Amazon Data Lifecycle Manager (DLM) to create snapshots and copy them to the forensics account using S3 cross-region replication.

Answer

Use AWS CloudFormation StackSets to deploy a stack that creates snapshots and copies them manually.

Answer

Use AWS Systems Manager Automation to run scripts in each account that create snapshots and copy them to the forensics account via Lambda.

Question 6

A security engineer is reviewing AWS CloudTrail and notices `AssumeRole` API calls to a role that should not be assumed by the source identity. What is the FIRST step in the incident response process?

Accepted Answer

Investigate the source IP address and user agent of the `AssumeRole` calls.. The first step in any incident response process is to investigate and gather evidence to understand the scope and impact of the potential security event. Option C is correct because analyzing the source IP address and user agent of the `AssumeRole` API calls provides critical forensic data to determine if the activity is malicious or a false positive, without disrupting operations or destroying evidence. AWS CloudTrail logs these details, enabling the security engineer to trace the origin of the unauthorized assumption before taking any containment or remediation actions.

Answer

Enable AWS GuardDuty to detect future anomalies.

Answer

Delete the IAM role immediately.

Answer

Disable the AWS account and contact support.

Question 7

A company uses Amazon S3 to store sensitive data. The security team wants to detect and alert on public read access to S3 buckets. Which combination of AWS services is MOST appropriate?

Accepted Answer

Amazon Macie with automated discovery jobs and Amazon CloudWatch Events to send alerts.. Amazon Macie is purpose-built for discovering and protecting sensitive data in S3, and its automated discovery jobs can detect public read access to buckets. By integrating with Amazon CloudWatch Events, Macie can trigger alerts in real-time when such access is identified, making it the most appropriate choice for this detection and alerting requirement.

Answer

AWS CloudTrail and Amazon CloudWatch Logs with metric filters for `PutBucketPolicy` events.

Answer

Amazon GuardDuty and AWS Lambda.

Answer

AWS Config with managed rules like `s3-bucket-public-read-prohibited` and Amazon SNS.

Question 8

During incident response, a security engineer needs to preserve the state of a running EC2 instance for forensic analysis without losing volatile data. The instance is in an Auto Scaling group. Which action should the engineer take FIRST?

Accepted Answer

Suspend the `HealthCheck` and `ReplaceUnhealthy` processes on the Auto Scaling group.. Suspending the `HealthCheck` and `ReplaceUnhealthy` processes on the Auto Scaling group prevents the group from detecting the instance as unhealthy and terminating it while the engineer preserves volatile data. This is the first step to ensure the instance remains running and accessible for forensic collection (e.g., memory dump) before any other actions that could alter its state.

Answer

Detach the instance from the Auto Scaling group.

Answer

Stop the instance to preserve its EBS volumes.

Answer

Take an AMI of the instance immediately.

Question 9

A security engineer is investigating a potential data exfiltration from an AWS account. Which TWO CloudTrail events would be MOST indicative of data exfiltration via S3?

Accepted Answer

`CopyObject` API calls from a production bucket to a bucket in another AWS account.. `CopyObject` API calls from a production bucket to a bucket in another AWS account indicate data being replicated or moved across account boundaries, which is a strong signal of potential data exfiltration. This action bypasses typical network controls and can transfer large volumes of data without requiring a download, making it a common exfiltration technique.

Answer

`PutObject` API calls from a known internal IP.

Answer

`ListObjects` API calls from an EC2 instance in the same VPC.

Answer

`DeleteObject` API calls from the root user.

Question 10

A security team is implementing automated response to AWS GuardDuty findings. Which THREE actions should be taken to ensure proper incident response?

Accepted Answer

Create an AWS Lambda function that automatically modifies the security group of the affected instance to block all traffic.. Isolating the affected instance by modifying its security group to block all traffic is a common containment strategy that stops malicious network activity without destroying evidence. This approach allows the security team to perform forensic analysis and remediation while preventing further compromise, aligning with AWS incident response best practices.

Answer

Terminate the affected instance immediately to neutralize the threat.

Answer

Disable AWS CloudTrail to prevent further logging of malicious activity.

Question 11

Which TWO AWS services can be used to detect anomalous API calls in an AWS account?

Accepted Answer

AWS CloudTrail with Amazon CloudWatch Logs metric filters.. AWS CloudTrail with Amazon CloudWatch Logs metric filters is correct because CloudTrail records all API calls, and you can create metric filters on CloudWatch Logs to match patterns indicative of anomalous activity (e.g., unauthorized API calls, root user activity). When the filter triggers a threshold, it can send an alarm via Amazon SNS, enabling detection of anomalous API calls in near real-time.

Answer

AWS Shield Advanced.

Answer

AWS Config with managed rules.

Answer

AWS WAF.

Question 12

A security engineer is analyzing VPC Flow Logs and sees the entry above. The source IP 203.0.113.5 is flagged as suspicious. What additional information would help determine if this is malicious?

Accepted Answer

CloudTrail logs for any `ConsoleLogin` or `AssumeRole` events from 203.0.113.5.. VPC Flow Logs capture network traffic metadata (IPs, ports, protocols) but not the identity or authentication context of the source. CloudTrail logs record API calls, including ConsoleLogin and AssumeRole events, which can reveal whether 203.0.113.5 is associated with an authenticated user or role. If no such events exist, the traffic is likely from an unauthenticated external source, strengthening the case for malicious activity.

Answer

The source port used by 203.0.113.5.

Answer

Network ACL changes associated with the destination subnet.

Answer

Amazon GuardDuty findings for the destination 10.0.1.5.

Question 13

A security engineer creates an Amazon CloudWatch Events rule with this event pattern to trigger an AWS Lambda function for automated response to GuardDuty findings. However, the Lambda function is not triggered for new findings. What is the MOST likely cause?

Accepted Answer

The event pattern does not match the actual structure of GuardDuty findings.. The event pattern provided in the CloudWatch Events rule must exactly match the JSON structure of a GuardDuty finding as it is published to the default event bus. GuardDuty findings are delivered with a specific schema that includes a `detail` object containing `type`, `severity`, and other fields. If the event pattern uses incorrect field names, nesting, or missing required elements (e.g., `source` must be `aws.guardduty`), CloudWatch Events will not match the incoming events, and the Lambda function will not be triggered.

Answer

The finding type is not specified in the pattern.

Answer

CloudTrail is not enabled in the account.

Answer

The Lambda function does not have permission to be invoked by CloudWatch Events.

Question 14

A security engineer is investigating a potential data exfiltration from an S3 bucket. The engineer needs to identify which IAM role or user accessed the bucket and from which IP address. Which AWS service should the engineer use to obtain this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to S3, including the IAM role or user identity (via the `userIdentity` field) and the source IP address (via the `sourceIPAddress` field). For data exfiltration investigation, you need these specific details from management events or data events (e.g., `GetObject`, `PutObject`), which CloudTrail captures. Other services either lack identity-level detail or focus on network-level traffic without user attribution.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Question 15

A security engineer is designing an automated incident response workflow for an Amazon EC2 instance that is compromised. The workflow must isolate the instance by removing it from the security group that allows SSH access. The engineer wants to use AWS Systems Manager Automation to run a document. What is the most secure way to grant the automation the necessary permissions to modify the security group?

Accepted Answer

Create a Systems Manager Automation service role with a least-privilege policy that includes ec2:ModifySecurityGroupRules and use that role in the automation.. Systems Manager Automation can assume a dedicated service role with a least-privilege IAM policy that includes the specific action `ec2:ModifySecurityGroupRules`. This follows the security best practice of granting only the permissions required for the automation to modify the security group, without exposing broader privileges or relying on user or instance credentials.

Answer

Create an AWS Lambda function with permissions to modify the security group and call it from the automation.

Answer

Use the IAM user's permissions that trigger the automation.

Answer

Attach an IAM policy to the EC2 instance's instance profile that allows ec2:ModifySecurityGroupRules.