SCS-C02 Threat Detection and Incident Response Practice Test 16 — 15 Questions

Question 1

A security team is implementing automated response to AWS GuardDuty findings. Which THREE actions should be taken to ensure proper incident response?

Accepted Answer

Create an AWS Lambda function that automatically modifies the security group of the affected instance to block all traffic.. Isolating the affected instance by modifying its security group to block all traffic is a common containment strategy that stops malicious network activity without destroying evidence. This approach allows the security team to perform forensic analysis and remediation while preventing further compromise, aligning with AWS incident response best practices.

Answer

Terminate the affected instance immediately to neutralize the threat.

Answer

Disable AWS CloudTrail to prevent further logging of malicious activity.

Question 2

Which TWO AWS services can be used to detect anomalous API calls in an AWS account?

Accepted Answer

AWS CloudTrail with Amazon CloudWatch Logs metric filters.. AWS CloudTrail with Amazon CloudWatch Logs metric filters is correct because CloudTrail records all API calls, and you can create metric filters on CloudWatch Logs to match patterns indicative of anomalous activity (e.g., unauthorized API calls, root user activity). When the filter triggers a threshold, it can send an alarm via Amazon SNS, enabling detection of anomalous API calls in near real-time.

Answer

AWS Shield Advanced.

Answer

AWS Config with managed rules.

Answer

AWS WAF.

Question 3

A security engineer finds this IAM policy attached to a user. The user is able to create CloudTrail trails but cannot start logging. What is the MOST likely reason?

Accepted Answer

The user lacks `iam:PassRole` permission for the CloudTrail service role.. The user can create CloudTrail trails but cannot start logging because starting logging requires the `iam:PassRole` permission to pass the CloudTrail service role to the CloudTrail service. Without this permission, CloudTrail cannot assume the role needed to write logs to the S3 bucket and deliver them to CloudWatch Logs, even though the user has `cloudtrail:CreateTrail` and `cloudtrail:StartLogging` actions in the policy.

Answer

The `StartLogging` action is not listed in the policy.

Answer

The policy does not specify the `cloudtrail:StartLogging` action.

Answer

The user does not have permission to create CloudTrail trails.

Question 4

Which TWO AWS services can be used to detect anomalous API activity in an AWS account? (Choose two.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that uses machine learning and anomaly detection to identify suspicious API activity. AWS CloudTrail, with the CloudTrail Insights feature, provides continuous monitoring and detection of anomalous API activity by analyzing management events and generating insights. Additionally, CloudTrail logs can be used with Amazon CloudWatch to set up metric filters and alarms for detecting unusual patterns. Therefore, both GuardDuty and CloudTrail are valid services for detecting anomalous API activity.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon Inspector

Question 5

Which THREE steps should a security engineer take to ensure that an incident response plan for an AWS environment is effective? (Choose three.)

Accepted Answer

Regularly test the incident response plan through tabletop exercises and simulations.. Regularly testing the incident response plan through tabletop exercises and simulations validates the plan's effectiveness, identifies gaps, and ensures team readiness. AWS recommends using Game Days and fault injection simulators to practice real-world scenarios without impacting production environments.

Answer

Use the AWS account root user for incident response actions to ensure full permissions.

Answer

Store all evidence in an S3 bucket with public read access for easy sharing.

Question 6

A security engineer is investigating a GuardDuty finding of type 'Backdoor:EC2/C&CActivity.B!DNS'. Which TWO actions should the engineer take as part of the initial response? (Choose two.)

Accepted Answer

Isolate the EC2 instance by modifying its security group to deny all traffic.. Isolating the EC2 instance by modifying its security group to deny all traffic is a critical containment step in incident response. This immediately stops the C2 (command and control) communication detected by GuardDuty's 'Backdoor:EC2/C&CActivity.B!DNS' finding, preventing further data exfiltration or lateral movement while preserving the instance for forensic analysis.

Answer

Enable Amazon GuardDuty in the account if not already enabled.

Answer

Immediately terminate the EC2 instance to stop the activity.

Answer

Disable termination protection on the instance to allow future termination.

Question 7

A security engineer is configuring Amazon GuardDuty to generate alerts for specific threat types. The engineer wants to ensure that alerts are sent to the security team's email distribution list and also trigger an automated Lambda function for immediate response. Which two actions should the engineer take? (Select TWO.)

Accepted Answer

Create an Amazon EventBridge rule that matches GuardDuty findings and triggers a Lambda function.. Amazon EventBridge (formerly CloudWatch Events) can be configured with a rule that matches GuardDuty finding events. When a finding matches the rule pattern, EventBridge can directly invoke a Lambda function for automated incident response, such as isolating a compromised instance or updating security groups.

Answer

Configure Amazon CloudWatch Logs to send log events to an email distribution list.

Answer

Create an Amazon CloudWatch Events rule to route findings to a Lambda function.

Answer

Create an Amazon Simple Queue Service (SQS) queue and have the Lambda function poll the queue.

Question 8

A security engineer is investigating a potential data exfiltration incident. The engineer notices that an EC2 instance with an attached IAM role has been making API calls to an S3 bucket in another AWS account. The engineer wants to identify the source of the API calls and determine if the calls are malicious. Which AWS service should the engineer use to view the API calls made by the IAM role?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made by IAM roles, including the source IP address, user agent, and the specific actions performed. In this scenario, CloudTrail logs will show the exact API calls made by the EC2 instance's IAM role to the S3 bucket in another account, enabling the security engineer to identify the source and determine if the calls are malicious.

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Answer

AWS Config

Question 9

A company's security policy requires that all S3 buckets be encrypted at rest. An security engineer needs to detect any S3 bucket that does not have default encryption enabled. Which AWS service should the engineer use to continuously monitor and alert on non-compliant buckets?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of your AWS resource configurations against desired policies. You can create an AWS Config rule, such as the managed rule 's3-bucket-default-encryption-enabled', which automatically checks each S3 bucket for the presence of default encryption (SSE-S3 or SSE-KMS) and triggers an alert or remediation action for any non-compliant bucket. This aligns directly with the requirement to detect and alert on buckets lacking encryption at rest.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 10

A company's security team is implementing an incident response plan for a potential ransomware attack on their EC2 instances. Which THREE steps should the team take to preserve forensic evidence while containing the incident?

Accepted Answer

Create an EBS snapshot of the root volume.. Creating an EBS snapshot of the root volume preserves the exact disk state at the time of the incident, including any ransomware artifacts, file system metadata, and encryption keys. This snapshot can be used for offline forensic analysis without altering the original evidence, as it captures the block-level data of the volume.

Answer

Stop the instance to preserve its state.

Answer

Delete the compromised instance immediately.

Question 11

A security team wants to detect unauthorized API calls in real time and automatically block the source IP address using network ACLs. Which AWS service should be used for detection?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is the correct choice because it is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, including API calls from unusual or known-bad IP addresses. It uses machine learning, anomaly detection, and integrated threat intelligence to generate findings that can trigger automated remediation, such as updating network ACLs via AWS Lambda and Amazon EventBridge. This aligns with the requirement for real-time detection and automated blocking of source IPs.

Answer

AWS CloudTrail

Answer

AWS WAF

Answer

AWS Config

Question 12

A company is designing an automated incident response workflow. When a high-severity GuardDuty finding is generated, the security team wants to automatically isolate the affected EC2 instance by modifying its security group to deny all traffic. Which service should orchestrate this response?

Accepted Answer

AWS Systems Manager Automation. AWS Systems Manager Automation is the correct choice because it provides a pre-built runbook (AWS-DetachAndIsolateEC2Instance) that can be triggered by Amazon EventBridge when a GuardDuty finding is generated. This runbook automatically modifies the EC2 instance's security group to deny all traffic, effectively isolating the instance without requiring custom code. Systems Manager Automation is designed for such operational workflows, offering built-in error handling and approval steps.

Answer

AWS Lambda

Answer

AWS Config

Answer

AWS Step Functions

Question 13

Which TWO steps are part of the forensic acquisition process for an EC2 instance suspected of being compromised?

Accepted Answer

Capture the instance's memory using a forensic tool.. Capturing the instance's memory using a forensic tool (such as LiME or F-Response) preserves volatile data—including running processes, network connections, and encryption keys—that would be lost if the instance were stopped or terminated. This is a critical step in the forensic acquisition process to gather evidence of compromise without altering the system state.

Answer

Stop the instance immediately to prevent further damage.

Answer

Enable termination protection on the instance.

Answer

Terminate the instance to ensure the threat is contained.

Question 14

A company uses a multi-account AWS Organizations setup with hundreds of accounts. The security team uses AWS Security Hub in the management account to aggregate findings from all accounts. They have configured Amazon GuardDuty in all accounts and enabled AWS Config with recording. Recently, they noticed that Security Hub is not displaying any findings from GuardDuty in member accounts, even though GuardDuty is generating sample findings. The security team has verified that the Security Hub integration with GuardDuty is enabled in the management account. What is the most likely reason for the missing findings?

Accepted Answer

The member accounts have not enabled the integration between GuardDuty and Security Hub.. In a multi-account AWS Organizations setup, Security Hub in the management account aggregates findings from member accounts only if each member account has explicitly enabled the integration between GuardDuty and Security Hub. Even if GuardDuty is generating sample findings in member accounts, Security Hub will not display those findings unless the member account has enabled the GuardDuty-to-SecurityHub integration (via the Security Hub console or API). The management account enabling the integration does not automatically propagate the integration to member accounts.

Answer

The IAM role for Security Hub in the management account lacks permissions to read findings from member accounts.

Answer

AWS Security Hub is not enabled in the member accounts.

Answer

Amazon GuardDuty is not enabled in the member accounts.

Question 15

A security engineer is configuring automated response to a specific GuardDuty finding type. The engineer wants to automatically block the offending IP address in the security group when a finding is generated. Which TWO AWS services should the engineer use together to achieve this? (Choose TWO.)

Accepted Answer

AWS Lambda. AWS Lambda is correct because it can execute custom code to modify security group rules, such as removing an offending IP address. Amazon EventBridge is correct because it can capture GuardDuty findings as events and trigger the Lambda function in response to a specific finding type. Together, they enable automated, event-driven remediation without manual intervention.

Answer

AWS Config

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon CloudWatch Logs