SCS-C02 Threat Detection and Incident Response Practice Test 16 — 15 Questions

Question 1

Refer to the exhibit. A security engineer is analyzing a VPC Flow Logs entry for an EC2 instance with private IP 192.0.2.10. The log shows an accepted outbound connection from the instance to 203.0.113.50 on port 443. The instance is not expected to initiate outbound HTTPS connections. What should the engineer do next to investigate?

Accepted Answer

Log into the instance and check for unauthorized processes or malware.. Option A is correct because the VPC Flow Logs show an accepted outbound connection from the EC2 instance to an external IP on port 443, which is unexpected behavior. The immediate next step is to log into the instance and investigate for unauthorized processes, malware, or compromised credentials that could be initiating this outbound HTTPS traffic. This aligns with incident response best practices: verify the host before making network-level changes.

Answer

Block the IP 203.0.113.50 in the security group immediately.

Answer

Check the security group rules to see if outbound HTTPS is allowed.

Answer

Check Amazon Route 53 DNS logs to see what domain was resolved.

Question 2

A company uses a multi-account AWS Organizations setup with hundreds of accounts. The security team uses AWS Security Hub in the management account to aggregate findings from all accounts. They have configured Amazon GuardDuty in all accounts and enabled AWS Config with recording. Recently, they noticed that Security Hub is not displaying any findings from GuardDuty in member accounts, even though GuardDuty is generating sample findings. The security team has verified that the Security Hub integration with GuardDuty is enabled in the management account. What is the most likely reason for the missing findings?

Accepted Answer

The member accounts have not enabled the integration between GuardDuty and Security Hub.. Option D is correct because in a multi-account AWS Organizations setup, Security Hub in the management account aggregates findings from member accounts only if each member account has explicitly enabled the integration between GuardDuty and Security Hub. Even if GuardDuty is generating sample findings in member accounts, Security Hub will not display those findings unless the member account has enabled the GuardDuty-to-SecurityHub integration (via the Security Hub console or API). The management account enabling the integration does not automatically propagate the integration to member accounts.

Answer

The IAM role for Security Hub in the management account lacks permissions to read findings from member accounts.

Answer

AWS Security Hub is not enabled in the member accounts.

Answer

Amazon GuardDuty is not enabled in the member accounts.

Question 3

A security engineer is investigating a potential data breach. AWS CloudTrail logs show that an IAM user 'svc-backup' created an S3 bucket in the us-east-1 region and then uploaded a large number of objects. The engineer suspects that the user's credentials were compromised. What is the MOST efficient way to quickly identify the source IP address and user agent of the API calls made by this user?

Accepted Answer

Query AWS CloudTrail logs in Amazon Athena for the user's API calls.. Option B is correct because CloudTrail logs contain the sourceIPAddress and userAgent fields for each API call, which can be queried using CloudTrail Insights or Athena to identify the source. Option A is wrong because VPC Flow Logs capture network traffic but do not include IAM user information. Option C is wrong because GuardDuty detects threats but does not store historical API call details. Option D is wrong because Config records resource configuration changes but not API call source details.

Answer

Analyze VPC Flow Logs for traffic to the S3 bucket.

Answer

Enable Amazon GuardDuty and review the generated findings.

Answer

Use AWS Config to review the configuration history of the S3 bucket.

Question 4

A company uses AWS Organizations with multiple accounts. The security team wants to detect suspicious API activity across all accounts in real time. They have enabled AWS CloudTrail in all accounts and are sending logs to a centralized S3 bucket. However, they are receiving alerts only after a significant delay. What should the security team do to reduce the latency of threat detection?

Accepted Answer

Set up Amazon EventBridge rules in each account to send specific CloudTrail events to a centralized event bus for immediate processing.. Option D is correct because Amazon EventBridge can consume CloudTrail events in near real time across accounts by using cross-account event buses, allowing immediate action. Option A is wrong because consolidating logs is already done; the issue is latency in analysis, not aggregation. Option B is wrong because GuardDuty can analyze CloudTrail logs but may still introduce delay; EventBridge is faster for real-time detection. Option C is wrong because CloudWatch Logs Insights is for querying, not real-time alerting.

Answer

Enable Amazon GuardDuty in each account and configure it to send findings to a centralized S3 bucket.

Answer

Configure CloudTrail to deliver logs to a single S3 bucket and use S3 Event Notifications to trigger a Lambda function.

Answer

Use Amazon CloudWatch Logs Insights to query CloudTrail logs across accounts in real time.

Question 5

A security engineer discovers an Amazon GuardDuty finding of type 'UnauthorizedAccess:EC2/SSHBruteForce' for an EC2 instance. The instance is part of an Auto Scaling group and has a public IP address. What is the MOST effective immediate step to mitigate the threat?

Accepted Answer

Detach the instance from the Auto Scaling group and terminate it.. Option D is correct because the instance is compromised and part of an Auto Scaling group. Detaching it first prevents the Auto Scaling group from immediately replacing it with a new instance that might inherit the same vulnerability, allowing for forensic analysis. Terminating it after detachment stops the SSH brute force attack at its source without risking automatic re-provisioning of a similarly exposed instance.

Answer

Modify the network ACL to block SSH traffic from the attacker's IP.

Answer

Terminate the instance without detaching it from the Auto Scaling group.

Answer

Update the security group to restrict SSH access to known IP addresses.

Question 6

A company uses AWS Lambda functions that process sensitive data. The security team wants to ensure that any unauthorized invocation of the functions is detected and alerted. The team has enabled AWS CloudTrail and is monitoring for Lambda Invoke API calls. However, they are concerned about missing events that occur within the Lambda service itself (e.g., internal retries). What should the team do to capture all relevant events?

Accepted Answer

Enable Amazon CloudWatch Lambda Insights.. Option C is correct because Amazon CloudWatch Lambda Insights provides a monitoring and troubleshooting solution for serverless applications, capturing detailed metrics and logs for all Lambda invocations, including internal retries and invocations that occur within the Lambda service itself. Unlike CloudTrail data events, which only log API calls made to the Lambda Invoke API, Lambda Insights collects telemetry from the Lambda execution environment, ensuring visibility into events that happen after the initial invocation, such as retries triggered by the Lambda service due to throttling or errors.

Answer

Enable VPC Flow Logs for the Lambda function's VPC.

Answer

Configure CloudWatch Logs to capture all Lambda function logs.

Answer

Enable CloudTrail data events for Lambda functions.

Question 7

A security engineer is investigating a potential incident where an EC2 instance was compromised. The engineer has access to the following logs: CloudTrail, VPC Flow Logs, and OS-level logs from the instance. Which TWO log sources would be MOST useful to determine the initial attack vector? (Choose TWO.)

Accepted Answer

OS-level authentication and system logs. Option A is correct because CloudTrail logs API calls, which can show who launched the instance and what security groups were used. Option D is correct because OS-level logs show login attempts, processes, and file changes. Option B is wrong because VPC Flow Logs show network traffic but not application-level details. Option C is wrong because CloudWatch Metrics are aggregated and do not provide detailed logs. Option E is wrong because Config records configuration changes, not attack vectors.

Answer

Amazon CloudWatch Metrics for the instance

Answer

AWS Config configuration history

Answer

VPC Flow Logs

Question 8

A company uses Amazon GuardDuty to monitor its AWS environment. The security team has received a GuardDuty finding of type 'Recon:EC2/PortProbeUnprotectedPort'. The finding indicates that an EC2 instance has an open SSH port that is being probed from the internet. The team wants to reduce the attack surface and prevent future probes. Which THREE actions should the team take? (Choose THREE.)

Accepted Answer

Modify the security group to allow SSH only from specific IP addresses.. Options A, C, and D are correct: changing the security group to restrict SSH access to known IPs, placing the instance in a private subnet with a NAT gateway, and using Systems Manager Session Manager instead of SSH. Option B is wrong because terminating the instance is not necessary if it can be secured. Option E is wrong because GuardDuty suppression is for false positives, not for fixing actual vulnerabilities.

Answer

Suppress the GuardDuty finding to reduce noise.

Answer

Terminate the EC2 instance and launch a new one.

Question 9

A security engineer is configuring automated response to a specific GuardDuty finding type. The engineer wants to automatically block the offending IP address in the security group when a finding is generated. Which TWO AWS services should the engineer use together to achieve this? (Choose TWO.)

Accepted Answer

AWS Lambda. AWS Lambda is correct because it can execute custom code to modify security group rules, such as removing an offending IP address. Amazon EventBridge is correct because it can capture GuardDuty findings as events and trigger the Lambda function in response to a specific finding type. Together, they enable automated, event-driven remediation without manual intervention.

Answer

AWS Config

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon CloudWatch Logs

Question 10

A financial services company uses a multi-account AWS organization with a centralized security account. The security team has enabled Amazon GuardDuty in all accounts and configured it to send findings to the security account via AWS Organizations. The team also uses AWS Security Hub in the security account to aggregate findings. They have set up automated response using AWS Systems Manager Automation documents to isolate compromised EC2 instances by applying a security group that denies all traffic. However, during a recent incident, the automation failed because the Systems Automation document did not have permission to modify the security group in the member account. The security team needs to design a solution that allows the security account to automatically isolate instances in any member account. What should they do?

Accepted Answer

Use AWS CloudFormation StackSets to deploy an IAM role in each member account with permissions to modify security groups. Then, in the security account, configure the Systems Manager Automation document to assume that role when running the isolation step.. Option A is correct because using a CloudFormation StackSet to deploy the necessary IAM roles in each member account with the appropriate permissions, and then having the automation in the security account assume that role via cross-account access, is a scalable and secure approach. Option B is wrong because modifying the IAM role in the security account does not grant permissions in member accounts. Option C is wrong because using a Lambda function in each member account is less scalable than using StackSet. Option D is wrong because creating a single role in the security account does not grant access to member accounts.

Answer

Create a Lambda function in each member account that is triggered by GuardDuty findings and modifies the security group.

Answer

Create a single IAM role in the security account that has permissions to modify security groups in all member accounts.

Answer

Modify the IAM role used by Systems Manager Automation in the security account to include permissions to modify security groups in all member accounts.

Question 11

A company uses Amazon GuardDuty and AWS Security Hub in a single AWS account. The security team has created a custom action in Security Hub to send findings to a custom Lambda function for automated response. The Lambda function is designed to take remediation actions based on the finding type. During testing, the team notices that the Lambda function is not being invoked when new findings are generated. The Lambda function's resource-based policy allows invocations from Security Hub, and the function's execution role has necessary permissions. What is the most likely reason for the failure?

Accepted Answer

No Amazon EventBridge rule is configured to send Security Hub findings to the Lambda function.. Option C is correct because Security Hub custom actions require an EventBridge rule to route findings to the Lambda function. Without the rule, Security Hub cannot invoke Lambda directly. Option A is wrong because the function's execution role permissions are for accessing other AWS resources, not for being invoked. Option B is wrong because Security Hub findings are generated even if GuardDuty is enabled. Option D is wrong because the Lambda function's resource-based policy allows invocation from Security Hub, but Security Hub does not directly invoke Lambda; it uses EventBridge.

Answer

GuardDuty is not enabled for all required resource types.

Answer

The Lambda function's execution role does not have permission to access GuardDuty.

Answer

The Lambda function's resource-based policy does not include Security Hub as a principal.

Question 12

A company uses AWS CloudTrail to log all API activity. The security team wants to be alerted when an IAM user creates a new access key. They have created a CloudWatch metric filter on the CloudTrail log group for the event name 'CreateAccessKey' and set up a CloudWatch alarm that sends an email via Amazon SNS. However, the alarm is not triggering even though the team knows that access keys have been created. The metric filter has been tested and shows data points in CloudWatch. What should the security team check next?

Accepted Answer

Review the CloudWatch alarm configuration, including the period and threshold.. Option C is correct because the metric filter is producing data points, which means logs are being ingested and the filter is matching events. The most likely issue is that the CloudWatch alarm's period or threshold is misconfigured—for example, the evaluation period might be too long or the threshold too high, causing the alarm to not transition to ALARM state despite the metric having values. The security team should verify the alarm's settings, such as the period (e.g., 5 minutes) and the threshold (e.g., >= 1), to ensure they align with the expected frequency of access key creation events.

Answer

Ensure that the CloudTrail trail is delivering logs to the correct CloudWatch Logs log group.

Answer

Verify that the CloudTrail trail is logging data events.

Answer

Check that the IAM user has permissions to create access keys.

Question 13

A company has a serverless application using AWS Lambda, API Gateway, and DynamoDB. The security team wants to detect and respond to potential SQL injection attempts in API requests. They have enabled AWS WAF on the API Gateway and created a rule to block SQL injection. However, they also want to capture the blocked requests for analysis and store them in an S3 bucket. The team has configured WAF to send logs to Amazon Kinesis Data Firehose, which delivers to an S3 bucket. After testing, the team notices that the logs are not being delivered. The Firehose delivery stream is in the same AWS account, and the S3 bucket policy allows the Firehose service to write. What is the most likely cause?

Accepted Answer

The Kinesis Data Firehose delivery stream does not have an IAM role with permissions to write to the S3 bucket.. Option D is correct because Kinesis Data Firehose requires an IAM role to write to S3, and the role must have the necessary permissions. Even if the bucket policy allows, the delivery stream's IAM role must be configured. Option A is wrong because WAF logs are delivered in near real time, not in batch. Option B is wrong because the bucket policy allows Firehose, but the role is separate. Option C is wrong because WAF is enabled and blocking requests, so it should generate logs.

Answer

The WAF web ACL is not configured to log blocked requests.

Answer

The S3 bucket policy does not grant write permissions to the Firehose delivery stream's IAM role.

Answer

Kinesis Data Firehose delivers logs in batches every 5 minutes, so the team should wait longer.

Question 14

A company uses Amazon Detective to investigate security findings. The security team is analyzing a GuardDuty finding of type 'Backdoor:EC2/C&CActivity.B!DNS' for an EC2 instance. The team wants to use Detective to understand the full scope of the incident, including which other resources the instance communicated with and any IAM roles used. However, when the team opens the finding in Detective, they see no network activity data for the instance. The instance is in a VPC with VPC Flow Logs enabled, and Flow Logs are being published to CloudWatch Logs. What should the team do to enable Detective to display the network activity?

Accepted Answer

Ensure that VPC Flow Logs are enabled for the VPC and are being published to Amazon CloudWatch Logs in the same account and Region as Detective.. Option A is correct because Detective ingests VPC Flow Logs from CloudWatch Logs to analyze network traffic. The VPC Flow Logs must be in the correct format and delivered to CloudWatch Logs for Detective to consume. Option B is wrong because Detective does not need direct access to the instance. Option C is wrong because the GuardDuty finding is already in Detective; the issue is network data. Option D is wrong because enabling more GuardDuty findings does not add network data.

Answer

Re-enable the GuardDuty finding in Amazon Detective.

Answer

Enable GuardDuty EKS Audit Logs monitoring.

Answer

Install the Amazon Detective agent on the EC2 instance.

Question 15

A company uses AWS CloudTrail to log all API activity. The security team wants to ensure that any changes to CloudTrail configuration (e.g., disabling the trail, deleting the trail, modifying the log delivery) are detected immediately. They have created a CloudWatch Events rule to capture the event 'StopLogging' and send an SNS notification. During testing, the team stops the trail and does not receive the notification. The CloudWatch Events rule is configured with the correct event pattern. What should the team check?

Accepted Answer

Check the IAM role associated with the CloudWatch Events rule to ensure it has permissions to publish to the SNS topic.. Option B is correct because CloudWatch Events rules require an IAM role to invoke the SNS topic. The role must have sns:Publish permissions. Option A is wrong because the trail is logging management events by default. Option C is wrong because the event pattern is correct, but the target action fails. Option D is wrong because SNS topic subscriptions are for subscribers, not for publishing.

Answer

Verify that the CloudTrail trail is logging management events.

Answer

Ensure that the event pattern includes the correct source and detail-type.

Answer

Confirm that the SNS topic subscription is confirmed.

SCS-C02 Threat Detection and Incident Response Practice Test 16 — 15 Questions

Exhibit

SCS-C02 Threat Detection and Incident Response Practice Test 16 — 15 Questions

Exhibit