SCS-C02 Threat Detection and Incident Response Practice Test 14 — 15 Questions

Question 1

During a security incident, a security engineer needs to capture network traffic from an EC2 instance for forensic analysis. The instance is part of an Auto Scaling group and may be terminated. What is the MOST efficient way to capture the traffic without affecting the instance's performance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use VPC Traffic Mirroring to mirror the instance's network traffic.. VPC Traffic Mirroring captures all network traffic at the hypervisor level without installing agents or consuming instance CPU/memory, making it ideal for forensic analysis of an EC2 instance that may be terminated. It works by copying packets from the source ENI to a target (e.g., a Network Load Balancer or another ENI) for inspection, ensuring zero performance impact on the production instance. This approach preserves traffic even if the instance is later terminated, as the mirror session is tied to the ENI, not the instance lifecycle.

Answer

Enable VPC Flow Logs for the subnet.

Answer

SSH into the instance and run tcpdump to capture packets.

Answer

Attach a Network Load Balancer in front of the instance.

Question 2

A security team wants to automatically revoke public access to an S3 bucket when Amazon GuardDuty detects a suspicious API call from a known malicious IP address. Which AWS service should be used to orchestrate this automated response?

Accepted Answer

AWS Systems Manager Automation. AWS Systems Manager Automation is the correct service because it provides a runbook-based orchestration framework that can be triggered by Amazon EventBridge events from GuardDuty findings. It can execute predefined automation documents (e.g., AWS-DisableS3BucketPublicReadWrite) to modify S3 bucket policies and revoke public access without requiring custom code, making it ideal for automated incident response workflows.

Answer

AWS Config

Answer

AWS Lambda

Answer

AWS CloudTrail

Question 3

A company has enabled Amazon GuardDuty in all accounts within AWS Organizations. The security team wants to view aggregated findings from all accounts in a single dashboard. Which service should the team use?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct service because it provides a single dashboard that aggregates and prioritizes security findings from multiple AWS services, including Amazon GuardDuty, across all accounts in an AWS Organization. It normalizes findings from GuardDuty, Inspector, Macie, and other sources into the AWS Security Finding Format (ASFF), enabling centralized viewing and automated response workflows.

Answer

Amazon CloudWatch

Answer

Amazon Inspector

Answer

Amazon Macie

Question 4

A security engineer is configuring an automated incident response workflow. When a GuardDuty finding of type 'UnauthorizedAccess:EC2/SSHBruteForce' is generated, the workflow should isolate the EC2 instance and snapshot its EBS volume. Which AWS service can coordinate these actions?

Accepted Answer

AWS Step Functions. AWS Step Functions is the correct service because it is designed to orchestrate multi-step workflows by coordinating AWS services like Lambda, EC2, and EBS snapshots in a defined state machine. For the given GuardDuty finding, Step Functions can receive the event, invoke a Lambda function to isolate the EC2 instance (e.g., modify security groups or attach a deny-all NACL), and then trigger another Lambda or direct API call to snapshot the EBS volume, all with built-in error handling, retries, and sequencing.

Answer

AWS Lambda functions invoked sequentially

Answer

AWS CloudFormation

Answer

AWS Config rules with auto-remediation

Question 5

A company has a requirement to detect and alert on S3 objects that contain personally identifiable information (PII) being shared publicly. Which AWS service should be used?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover, classify, and protect sensitive data such as personally identifiable information (PII) stored in Amazon S3. It can automatically generate alerts when S3 objects containing PII are made publicly accessible, meeting the requirement to detect and alert on such events.

Answer

Amazon CloudWatch

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 6

A security engineer is investigating a potential security incident involving an Amazon RDS database. The engineer needs to identify which of the following actions should be taken during the forensic analysis phase? (Select TWO.)

Accepted Answer

Take a manual snapshot of the RDS instance.. Taking a manual snapshot preserves a point-in-time, immutable copy of the RDS instance for offline forensic analysis without altering the live database. This ensures that evidence is captured before any changes occur during the investigation, and the snapshot can be restored to a separate instance for safe examination.

Answer

Enable automatic backups if not already enabled.

Answer

Disable deletion protection to allow cleanup.

Answer

Modify the security group to restrict database access.

Question 7

A security team is designing an automated incident response system. The system must meet the following requirements: (1) automatically respond to GuardDuty findings, (2) ensure that response actions are logged and immutable, and (3) allow for human approval before destructive actions. Which services should the team use? (Select THREE.)

Accepted Answer

Amazon EventBridge. Amazon EventBridge (A) is correct because it can receive GuardDuty findings in near real-time and route them to downstream targets for automated response. This enables the first requirement by triggering workflows directly from GuardDuty events without custom polling.

Answer

AWS Lambda

Answer

Amazon Simple Notification Service (SNS)

Question 8

A security engineer is configuring Amazon GuardDuty to generate alerts for specific threat types. The engineer wants to ensure that alerts are sent to the security team's email distribution list and also trigger an automated Lambda function for immediate response. Which two actions should the engineer take? (Select TWO.)

Accepted Answer

Create an Amazon EventBridge rule that matches GuardDuty findings and triggers a Lambda function.. Amazon EventBridge (formerly CloudWatch Events) can be configured with a rule that matches GuardDuty finding events. When a finding matches the rule pattern, EventBridge can directly invoke a Lambda function for automated incident response, such as isolating a compromised instance or updating security groups.

Answer

Configure Amazon CloudWatch Logs to send log events to an email distribution list.

Answer

Create an Amazon CloudWatch Events rule to route findings to a Lambda function.

Answer

Create an Amazon Simple Queue Service (SQS) queue and have the Lambda function poll the queue.

Question 9

A security engineer is investigating a potential data exfiltration incident. The engineer notices that an EC2 instance with an attached IAM role has been making API calls to an S3 bucket in another AWS account. The engineer wants to identify the source of the API calls and determine if the calls are malicious. Which AWS service should the engineer use to view the API calls made by the IAM role?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made by IAM roles, including the source IP address, user agent, and the specific actions performed. In this scenario, CloudTrail logs will show the exact API calls made by the EC2 instance's IAM role to the S3 bucket in another account, enabling the security engineer to identify the source and determine if the calls are malicious.

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Answer

AWS Config

Question 10

A company uses AWS Organizations to manage multiple accounts. The security team wants to centralize threat detection across all accounts. They enable Amazon GuardDuty in the management account and intend to use delegated administrator functionality. However, they find that GuardDuty is not detecting threats in member accounts. What is the most likely cause?

Accepted Answer

GuardDuty is not enabled in the member accounts. The security team must invite member accounts or use the delegated administrator to enable GuardDuty in all accounts.. Amazon GuardDuty must be enabled in each member account to detect threats in those accounts. When using the delegated administrator model, the security team can enable GuardDuty across all accounts programmatically via the delegated administrator API, but they must explicitly perform this action. Simply enabling GuardDuty in the management account does not automatically activate it in member accounts, which is why no threats are detected in those accounts.

Answer

GuardDuty requires an S3 bucket in each account to store findings.

Answer

GuardDuty only monitors the management account's resources, not member accounts.

Answer

GuardDuty does not support delegated administrator for AWS Organizations.

Question 11

A company has an incident response (IR) process that includes isolating compromised EC2 instances. During a security incident, the IR team needs to block all traffic to and from a compromised instance while preserving the instance for forensic analysis. Which approach should the team take?

Accepted Answer

Modify the security group associated with the instance to remove all inbound and outbound rules.. Modifying the security group to remove all inbound and outbound rules effectively blocks all traffic to and from the EC2 instance because security groups act as a stateful virtual firewall at the instance level. This approach preserves the instance in its current running state, allowing the IR team to perform forensic analysis without the risk of the instance being tampered with or communicating with external systems.

Answer

Detach the instance from the Auto Scaling group and stop it.

Answer

Update the network ACL for the subnet to deny all traffic.

Answer

Terminate the instance immediately.

Question 12

A security engineer is configuring AWS CloudWatch Logs to monitor for suspicious activity. They want to create a metric filter that detects when an IAM user calls the `iam:CreateAccessKey` API. The engineer writes the following filter pattern: `{ ($.eventName = "CreateAccessKey") }`. After testing, the filter does not trigger. What is the most likely reason?

Accepted Answer

The metric filter is not associated with the correct log group.. The filter pattern `{ ($.eventName = "CreateAccessKey") }` is syntactically correct and will match any CloudTrail event with eventName CreateAccessKey, regardless of service. The most likely reason the filter does not trigger is that the metric filter is not associated with the correct log group, or the log group does not contain CloudTrail events from IAM. A missing eventSource field does not prevent the filter from working; it would simply match events from any service, which could cause false positives, but not a failure to trigger.

Answer

The filter pattern syntax is incorrect; it should use square brackets.

Answer

CloudWatch Logs does not support metric filters for CloudTrail logs.

Answer

The filter pattern does not include the eventSource field, so it might match events from other services.

Question 13

A company is using AWS Lambda functions to process sensitive data. The security team wants to detect when a Lambda function is invoked with an unexpected payload that may indicate an injection attack. Which AWS service should the team use to inspect the function's input for malicious patterns?

Accepted Answer

None of the above; the team should implement custom validation within the Lambda function.. AWS Lambda functions process event payloads directly within the function code, and no AWS managed service can inspect the actual input data passed to a Lambda function at invocation time. AWS WAF operates at the HTTP/HTTPS layer for API Gateway or CloudFront, not for Lambda function payloads. Amazon Inspector scans for software vulnerabilities in EC2 instances and container images, not runtime payloads. AWS Shield provides DDoS protection at the network and transport layers. Amazon GuardDuty analyzes VPC flow logs, DNS logs, and CloudTrail events for threats, but it does not inspect Lambda function invocation payloads. Therefore, the only way to detect malicious patterns in the function's input is to implement custom validation logic within the Lambda function code itself.

Answer

AWS WAF

Answer

Amazon Inspector

Answer

AWS Shield

Answer

Amazon GuardDuty

Question 14

A company wants to automate the response to a specific GuardDuty finding. When GuardDuty detects a finding of type `UnauthorizedAccess:EC2/SSHBruteForce`, they want to automatically block the offending IP address using a network ACL. Which AWS service can they use to orchestrate this response?

Accepted Answer

AWS Systems Manager Automation. AWS Systems Manager Automation is the correct service because it provides a runbook-based automation framework that can be triggered by Amazon EventBridge events from GuardDuty. When GuardDuty generates a finding of type `UnauthorizedAccess:EC2/SSHBruteForce`, an EventBridge rule can invoke an SSM Automation document that modifies the network ACL to block the offending IP address. This orchestration is natively supported by SSM Automation without requiring custom code, making it the ideal choice for automated incident response workflows.

Answer

AWS Lambda

Answer

AWS Config

Answer

AWS CloudFormation

Question 15

A security engineer is reviewing AWS CloudTrail logs and notices a large number of `DescribeInstances` API calls from a single IAM user in a short period. The engineer suspects a credential compromise. What is the most effective way to automatically revoke the compromised credentials and notify the security team?

Accepted Answer

Create an Amazon EventBridge rule that triggers an AWS Lambda function to revoke the keys and send an SNS notification.. It uses Amazon EventBridge to detect the anomalous DescribeInstances API calls (via CloudTrail as an event source), then triggers an AWS Lambda function to programmatically revoke the IAM user's access keys (using the `deactivate_access_key` or `delete_access_key` API), and sends an SNS notification to the security team. This provides an automated, near-real-time response to a suspected credential compromise without manual intervention.

Answer

Use AWS CloudTrail to automatically disable the IAM user's access keys.

Answer

Create an AWS Config rule that checks for excessive API calls and revokes keys.

Answer

Enable Amazon GuardDuty to automatically revoke compromised credentials.