SCS-C02 Threat Detection and Incident Response Practice Test 14 — 15 Questions

Question 1

A company's security team is implementing an incident response plan for a potential ransomware attack on their EC2 instances. Which THREE steps should the team take to preserve forensic evidence while containing the incident?

Accepted Answer

Create an EBS snapshot of the root volume.. Option A is correct because creating an EBS snapshot of the root volume preserves the exact disk state at the time of the incident, including any ransomware artifacts, file system metadata, and encryption keys. This snapshot can be used for offline forensic analysis without altering the original evidence, as it captures the block-level data of the volume.

Answer

Stop the instance to preserve its state.

Answer

Delete the compromised instance immediately.

Question 2

A company wants to use AWS services to detect and respond to a potential DDoS attack on their web application hosted on EC2 instances behind an Application Load Balancer (ALB). Which TWO AWS services should the company use for detection and mitigation?

Accepted Answer

AWS WAF. AWS WAF is correct because it allows you to create web access control lists (web ACLs) to filter and monitor HTTP/HTTPS requests to your Application Load Balancer. By defining rate-based rules, you can automatically block IP addresses that exceed a threshold of requests per 5-minute window, mitigating layer 7 DDoS attacks such as HTTP floods or SQL injection attempts.

Answer

Amazon Route 53

Answer

Amazon CloudFront

Answer

Amazon GuardDuty

Question 3

A security engineer is configuring automated response to a GuardDuty finding of type 'UnauthorizedAccess:EC2/SSHBruteForce'. The engineer needs to isolate the compromised instance by modifying the security group to deny all inbound traffic. Which AWS service should be used to orchestrate this response?

Accepted Answer

AWS Systems Manager Automation. Option A is correct because AWS Systems Manager Automation can run a runbook to modify security group rules in response to a GuardDuty finding via EventBridge. Option B is wrong because Lambda can be used but is not the orchestration service; it is a compute service. Option C is wrong because Config is for compliance, not response. Option D is wrong because CloudFormation is for infrastructure provisioning, not real-time response.

Answer

AWS Lambda

Answer

AWS CloudFormation

Answer

AWS Config

Question 4

A company uses AWS CloudTrail to log all API calls. During an incident investigation, the security team needs to identify who deleted an S3 bucket. CloudTrail logs are stored in a centralized S3 bucket with server-side encryption using AWS KMS. Which additional step is required to ensure the CloudTrail logs can be queried quickly for this investigation?

Accepted Answer

Use Amazon Athena with a table defined over the S3 bucket. Option D is correct because CloudTrail logs are JSON files, and Athena can query them directly using DDL and DML. Option A is wrong because CloudTrail Lake is a managed query service but not necessary if logs are in S3; Athena is more direct. Option B is wrong because CloudWatch Logs Insights queries CloudWatch Logs, not S3 objects. Option C is wrong because GuardDuty is for threat detection, not log query.

Answer

Enable CloudTrail Lake

Answer

Stream logs to CloudWatch Logs and use CloudWatch Logs Insights

Answer

Enable Amazon GuardDuty

Question 5

A security team wants to detect and alert on API calls that create or modify IAM roles in their AWS account. Which AWS service can be used to create a metric filter and alarm for these specific CloudTrail events?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs can create metric filters on CloudTrail log data to detect specific API calls, such as CreateRole or UpdateAssumeRolePolicy. These metric filters can then trigger CloudWatch alarms for real-time notification. CloudTrail delivers logs to CloudWatch Logs, but the metric filter and alarm capabilities reside in CloudWatch Logs, not in CloudTrail itself.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Config

Question 6

During a security incident, a security engineer suspects that an EC2 instance has been compromised and is exfiltrating data to an external IP address. Which AWS service can provide real-time network traffic analysis and alert on unusual outbound traffic patterns?

Accepted Answer

VPC Flow Logs. Option B is correct because VPC Flow Logs capture IP traffic information and can be analyzed to detect abnormal outbound traffic. Option A is wrong because GuardDuty uses VPC Flow Logs and other sources but does not provide raw flow log analysis. Option C is wrong because CloudTrail logs API calls, not network traffic. Option D is wrong because Inspector is for vulnerability assessment, not network traffic analysis.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Question 7

A company uses AWS Organizations with multiple accounts. The security team wants to centralize threat detection and automatically remediate high-severity GuardDuty findings across all accounts. What is the MOST efficient way to achieve this?

Accepted Answer

Enable GuardDuty in the management account and designate a delegated administrator to manage findings across all accounts. Option A is correct because GuardDuty can be enabled at the organization level, and findings are sent to a delegated administrator account. Option B is wrong because enabling manually in each account is inefficient. Option C is wrong because Security Hub aggregates findings but does not enable GuardDuty automatically. Option D is wrong because EventBridge alone does not enable GuardDuty across accounts.

Answer

Create a Lambda function that enables GuardDuty in each account using cross-account IAM roles

Answer

Configure Amazon EventBridge to forward findings from each account to a central account

Answer

Use AWS Security Hub and enable GuardDuty in each account separately

Question 8

A security engineer needs to ensure that any changes to an S3 bucket's public access settings are immediately detected and an alert is sent. Which combination of AWS services should be used?

Accepted Answer

AWS Config and AWS Lambda. AWS Config continuously monitors and records changes to AWS resource configurations, including S3 bucket public access settings. By creating a Config rule that triggers on changes to the `PublicAccessBlockConfiguration` or bucket ACLs, you can invoke an AWS Lambda function via an Amazon SNS topic to send an alert. This combination provides real-time detection and automated response to unauthorized public access changes.

Answer

Amazon GuardDuty and AWS Lambda

Answer

Amazon CloudWatch Logs and Amazon SNS

Answer

AWS CloudTrail and Amazon CloudWatch Logs

Question 9

During a security incident, a forensic investigator needs to capture the memory of a running EC2 instance without shutting it down. Which AWS feature should be used?

Accepted Answer

EC2 Rescue for Linux or Systems Manager Run Command with a memory dump script. Option B is correct because EC2 Rescue for Linux (via Systems Manager Run Command) includes a built-in script that can capture a full memory dump from a running EC2 instance without requiring a shutdown. This is essential for forensic analysis to preserve volatile data like running processes, network connections, and kernel structures. The script leverages the Linux 'vmcore' or 'LiME' (Linux Memory Extractor) tool to safely extract memory contents while the instance remains operational.

Answer

Amazon CloudWatch agent

Answer

AWS CloudTrail

Answer

Amazon EBS snapshot

Question 10

A company has a multi-account strategy and wants to ensure that all API calls from member accounts are logged to a centralized S3 bucket in the security account. Which configuration is required?

Accepted Answer

Create an organization trail in the management account that logs all accounts. Option B is correct because AWS Organizations allows you to create an organization trail in the management account that automatically applies to all member accounts. This ensures that CloudTrail logs from every account in the organization are delivered to a single, centralized S3 bucket in the security account without needing per-account configuration. The organization trail uses the management account’s CloudTrail configuration to enable logging across the entire organization, and the S3 bucket policy must grant the necessary permissions for CloudTrail to write logs from all accounts.

Answer

Use Amazon Kinesis Data Streams to stream CloudTrail events from all accounts to the central S3 bucket

Answer

Create a CloudTrail trail in each member account and specify the same S3 bucket

Answer

Enable AWS Security Hub in the security account and configure it to collect CloudTrail logs

Question 11

A security team detects that an IAM user's access keys are being used from an unusual geographic location. Which AWS service provides this type of anomaly detection?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, including anomalous API calls from unusual geographic locations. It uses machine learning models and integrated threat intelligence to analyze AWS CloudTrail management events, VPC Flow Logs, and DNS logs, making it the correct service for detecting IAM user access key usage from an unexpected region.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

AWS Config

Question 12

A security engineer is investigating a potential data exfiltration incident where an attacker used a compromised EC2 instance to transfer data to an external IP. Which TWO AWS services can provide evidence of the network traffic and the API calls made from the instance?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic going to and from network interfaces, including the source/destination IP, ports, protocol, and packet/byte counts. This provides direct evidence of data being transferred to an external IP address from the compromised EC2 instance. AWS CloudTrail records API calls made within the AWS environment, such as those executed by the EC2 instance's IAM role or the instance itself (e.g., via the AWS CLI or SDK), which can reveal actions like starting data transfers or modifying security groups to allow exfiltration.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 13

A company uses AWS Organizations and wants to implement a centralized incident response process. Which THREE steps should be taken to ensure that security teams can respond to incidents across all accounts effectively?

Accepted Answer

Create IAM roles in each member account that grant incident responders cross-account access from the security account. Option A (delegated administrator for GuardDuty) centralizes findings. Option C (centralized S3 bucket for CloudTrail logs) enables log analysis. Option D (cross-account IAM roles) allows incident responders to access affected accounts. Option B (single CloudTrail trail in management account) is not sufficient; organization trail logs all accounts. Option E (separate Incident Manager per account) is not centralized.

Answer

Set up AWS Systems Manager Incident Manager in each account independently

Answer

Create a single CloudTrail trail in the management account to log events from all accounts

Question 14

A security engineer needs to detect and respond to suspicious activity on an Amazon RDS database. Which TWO services can be used together to monitor database activity and trigger automated remediation?

Accepted Answer

AWS Lambda. Option B (RDS Enhanced Monitoring) provides OS-level metrics, not database queries. Option C (Amazon GuardDuty) does not monitor RDS data plane. Option D (Amazon Detective) analyzes findings but does not trigger remediation. Option E (AWS Lambda) can execute remediation. Option A (Amazon RDS Performance Insights) monitors database load, but for security, use CloudWatch Logs with metric filters. Actually, correct combination: Amazon RDS for monitoring (CloudWatch Logs) and Lambda for response. But the answer choices: Option A (Performance Insights) is for performance, not security. Option B (Enhanced Monitoring) is for OS metrics. Option C (GuardDuty) monitors RDS for suspicious behavior but does not trigger remediation directly. Option D (Detective) is analysis. Option E (Lambda) can be used for response. The best two are: GuardDuty (detection) and Lambda (response). However, GuardDuty does monitor RDS login events. So answer: C and E.

Answer

Amazon Detective

Answer

Amazon RDS Enhanced Monitoring

Answer

Amazon RDS Performance Insights

Question 15

The above IAM policy is attached to an AWS Lambda function. The function is failing to write logs to CloudWatch Logs. What is the likely cause?

Accepted Answer

The resource ARN does not include the log group itself; only log streams. The IAM policy grants `logs:CreateLogStream` and `logs:PutLogEvents` but specifies a resource ARN that only covers log streams (`arn:aws:logs:us-east-1:123456789012:log-group:MyLogGroup:log-stream:*`). The Lambda function first needs to write to the log group itself (e.g., to create the log group or confirm its existence), which requires `logs:CreateLogGroup` or `logs:DescribeLogGroups` permissions on the log group resource ARN (`arn:aws:logs:us-east-1:123456789012:log-group:MyLogGroup`). Without that, the initial API call to the log group fails, preventing any log stream creation or log event delivery.

Answer

The actions list does not include logs:DescribeLogGroups

Answer

The policy is missing an explicit deny for other actions

Answer

The region in the ARN does not match the Lambda function's region