SCS-C02 Threat Detection and Incident Response Practice Test 12 — 15 Questions

Question 1

A security engineer is setting up automated incident response for a compromised IAM user. The engineer wants to automatically revoke the user's access keys and attach a deny-all policy when a GuardDuty finding of type 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration' is generated. Which services should be used to achieve this automation?

Accepted Answer

Amazon CloudWatch Events and AWS Lambda. Amazon CloudWatch Events (now part of Amazon EventBridge) can capture GuardDuty findings in real-time and trigger a Lambda function to revoke IAM user access keys and attach a deny-all policy. This is the native, event-driven pattern for automated incident response to GuardDuty findings, as CloudWatch Events directly supports GuardDuty as an event source.

Answer

Amazon Simple Notification Service (SNS) and AWS Lambda

Answer

AWS Config and AWS Lambda

Answer

AWS Systems Manager Automation and AWS Lambda

Question 2

A company uses AWS CloudTrail to log all API calls. The security team wants to be alerted when an IAM user creates a new access key for another IAM user (an action that could indicate privilege escalation). What is the most effective way to detect this specific API call?

Accepted Answer

Create an Amazon CloudWatch Events rule that matches the 'iam:CreateAccessKey' API call and sends a notification to an SNS topic.. Option C is correct because Amazon CloudWatch Events (now Amazon EventBridge) can be configured with a rule that matches the specific 'iam:CreateAccessKey' API call as it occurs. When this API call is made, CloudTrail delivers the event in near real-time to CloudWatch Events, which can then trigger an SNS topic to send an alert. This provides immediate, event-driven detection without the latency of scheduled queries or the overhead of custom rules.

Answer

Query AWS CloudTrail logs using Amazon Athena on a schedule.

Answer

Use AWS Config to create a custom rule that checks for changes to IAM users.

Answer

Enable Amazon GuardDuty and look for the 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration' finding.

Question 3

Which TWO AWS services can be used to detect anomalous API activity in an AWS account? (Choose two.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior, including anomalous API activity. It uses machine learning, anomaly detection, and integrated threat intelligence to analyze AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs. When GuardDuty detects unusual API calls, such as a spike in failed authentication attempts or API calls from an unusual geographic location, it generates a security finding. This makes GuardDuty a correct choice for detecting anomalous API activity.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon Inspector

Question 4

Which THREE steps should a security engineer take to ensure that an incident response plan for an AWS environment is effective? (Choose three.)

Accepted Answer

Regularly test the incident response plan through tabletop exercises and simulations.. Options A, B, and C are correct. Testing the plan via simulations (A) validates its effectiveness. Automating containment actions (B) reduces response time. Documenting procedures and contacts (C) ensures clarity. Option D is wrong because using the root user for incident response is a security risk. Option E is wrong because storing evidence in public S3 buckets is insecure.

Answer

Use the AWS account root user for incident response actions to ensure full permissions.

Answer

Store all evidence in an S3 bucket with public read access for easy sharing.

Question 5

A security engineer is investigating a GuardDuty finding of type 'Backdoor:EC2/C&CActivity.B!DNS'. Which TWO actions should the engineer take as part of the initial response? (Choose two.)

Accepted Answer

Isolate the EC2 instance by modifying its security group to deny all traffic.. Option B is correct because isolating the EC2 instance by modifying its security group to deny all traffic is a critical containment step in incident response. This immediately stops the C2 (command and control) communication detected by GuardDuty's 'Backdoor:EC2/C&CActivity.B!DNS' finding, preventing further data exfiltration or lateral movement while preserving the instance for forensic analysis.

Answer

Enable Amazon GuardDuty in the account if not already enabled.

Answer

Immediately terminate the EC2 instance to stop the activity.

Answer

Disable termination protection on the instance to allow future termination.

Question 6

Refer to the exhibit. A security engineer is reviewing this IAM policy attached to an IAM user. The user reports being unable to download objects from the S3 bucket when connecting from a VPN with IP address 10.0.1.45. What is the most likely reason for the failure?

Accepted Answer

The aws:SourceIp condition key is not supported for IAM user policies; it should be used with IAM role trust policies.. Option D is correct because IAM policies do not support the aws:SourceIp condition key for IAM users; it only works for IAM roles. Options A, B, and C are incorrect because the policy syntax is valid for roles, the IP is in the range, and the action is allowed.

Answer

The policy does not include an Allow effect for s3:GetObject.

Answer

The source IP 10.0.1.45 is not within the allowed range 10.0.0.0/16.

Answer

The policy uses the wrong action name; it should be s3:GetObjectAcl.

Question 7

Refer to the exhibit. A security engineer runs this AWS CLI command to investigate root user logins. The output shows a successful ConsoleLogin event. What should the engineer do next to improve security?

Accepted Answer

Enable IAM Access Analyzer to detect and alert on root user activity.. Option B is correct because the root user should not be used for daily activities. The best practice is to enable IAM Access Analyzer to detect root user activity. Option A is wrong because the root user password cannot be disabled; it can only be deleted. Option C is wrong because root user MFA is important but not the most direct response to this finding. Option D is wrong because the root user cannot be deleted.

Answer

Delete the root user account.

Answer

Disable the root user password and require all logins via IAM users.

Answer

Enable multi-factor authentication (MFA) for the root user.

Question 8

Refer to the exhibit. A security engineer reviews this CloudFormation template. The bucket is intended to be private. What is the security issue in the configuration?

Accepted Answer

The bucket policy grants public read access to the bucket, which overrides the PublicAccessBlock configuration.. Option C is correct because the bucket policy explicitly grants public read access (Effect: Allow, Principal: *, Action: s3:GetObject), which overrides the PublicAccessBlock configuration when the policy is applied. PublicAccessBlock settings block new public policies but do not retroactively block existing policies that grant public access; the bucket policy takes precedence and makes the bucket publicly readable despite the intended private configuration.

Answer

The PublicAccessBlock configuration is missing the BlockPublicPolicy setting.

Answer

The bucket does not have versioning enabled.

Answer

The bucket policy uses an incorrect resource ARN.

Question 9

A security engineer is investigating an AWS CloudTrail log entry that shows an unauthorized API call to delete an S3 bucket. Which service should the engineer use to analyze the log data for patterns of similar malicious activity?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors AWS accounts for malicious activity, including unauthorized API calls like the S3 bucket deletion attempt. It uses machine learning and integrated threat intelligence to analyze CloudTrail management events, VPC flow logs, and DNS logs, enabling it to identify patterns of similar malicious behavior across your environment. This makes GuardDuty the correct choice for detecting and alerting on patterns of unauthorized activity, rather than just logging or compliance checks.

Answer

AWS Config

Answer

Amazon CloudWatch Logs Insights

Answer

AWS Artifact

Question 10

A company uses AWS Organizations with multiple accounts. The security team needs a centralized solution to automatically initiate incident response runbooks across all accounts when a threat is detected. Which approach meets these requirements?

Accepted Answer

Use AWS Security Hub with cross-account aggregation and Amazon EventBridge to trigger AWS Systems Manager Automation runbooks.. AWS Security Hub with cross-account aggregation collects findings from all accounts into a single administrator account. Amazon EventBridge can then be configured to match specific Security Hub findings (e.g., a GuardDuty threat detection) and trigger AWS Systems Manager Automation runbooks. This provides a centralized, automated incident response mechanism across all accounts without requiring per-account Lambda functions or manual remediation.

Answer

Enable Amazon GuardDuty in all accounts and use its built-in remediation actions.

Answer

Configure AWS CloudFormation StackSets to deploy incident response stacks in all accounts.

Answer

Deploy an AWS Lambda function in each member account to respond to findings.

Question 11

A security engineer receives an alert that an EC2 instance is generating outbound traffic to a known malicious IP address. What is the FIRST step the engineer should take as part of the incident response process?

Accepted Answer

Isolate the EC2 instance by modifying the security group to deny all traffic.. Option C is correct because the first step in incident response for a compromised EC2 instance is containment. Modifying the security group to deny all inbound and outbound traffic immediately stops communication with the malicious IP and prevents further data exfiltration or lateral movement, while preserving the instance for forensic analysis. This aligns with the NIST SP 800-61 incident response lifecycle, where containment precedes eradication and recovery.

Answer

Analyze the network traffic logs to understand the scope.

Answer

Apply the latest security patches to the EC2 instance.

Answer

Terminate the EC2 instance immediately.

Question 12

A company wants to detect and alert on suspicious IAM role usage, such as a role being assumed from an unusual geographic location. Which AWS service should be used to generate the alerts?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is the correct choice because it is a threat detection service that continuously monitors for suspicious activity, including unusual IAM role usage such as a role being assumed from an anomalous geographic location. It uses machine learning, anomaly detection, and integrated threat intelligence to analyze CloudTrail management events and VPC flow logs, generating alerts (findings) for deviations from baseline behavior. This directly meets the requirement to detect and alert on suspicious role assumptions without needing to write custom rules.

Answer

AWS IAM Access Analyzer

Answer

AWS CloudTrail

Answer

Amazon CloudWatch

Question 13

During a security incident, a security engineer needs to capture network traffic from an EC2 instance for forensic analysis. The instance is part of an Auto Scaling group and may be terminated. What is the MOST efficient way to capture the traffic without affecting the instance's performance?

Accepted Answer

Use VPC Traffic Mirroring to mirror the instance's network traffic.. VPC Traffic Mirroring allows you to copy network traffic from an EC2 instance to a monitoring appliance without impacting the instance. Option A (tcpdump) is intrusive. Option B (VPC Flow Logs) captures metadata, not full packets. Option D (Network Load Balancer) forwards traffic but is not designed for forensic capture.

Answer

Enable VPC Flow Logs for the subnet.

Answer

SSH into the instance and run tcpdump to capture packets.

Answer

Attach a Network Load Balancer in front of the instance.

Question 14

A security team wants to automatically revoke public access to an S3 bucket when Amazon GuardDuty detects a suspicious API call from a known malicious IP address. Which AWS service should be used to orchestrate this automated response?

Accepted Answer

AWS Systems Manager Automation. AWS Systems Manager Automation can run a runbook to change the S3 bucket policy. GuardDuty can send findings to Amazon EventBridge, which triggers the automation. Option A (Lambda) is possible but Systems Manager is more structured for runbooks. Option B (Config) is reactive. Option D (CloudTrail) is logging.

Answer

AWS Config

Answer

AWS Lambda

Answer

AWS CloudTrail

Question 15

A company has enabled Amazon GuardDuty in all accounts within AWS Organizations. The security team wants to view aggregated findings from all accounts in a single dashboard. Which service should the team use?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct service because it provides a single dashboard that aggregates and prioritizes security findings from multiple AWS services, including Amazon GuardDuty, across all accounts in an AWS Organization. It normalizes findings from GuardDuty, Inspector, Macie, and other sources into the AWS Security Finding Format (ASFF), enabling centralized viewing and automated response workflows.

Answer

Amazon CloudWatch

Answer

Amazon Inspector

Answer

Amazon Macie