SCS-C02 Threat Detection and Incident Response Practice Test 16 — 15 Questions

Question 1

The above IAM policy is attached to an AWS Lambda function. The function is failing to write logs to CloudWatch Logs. What is the likely cause?

Accepted Answer

The resource ARN does not include the log group itself; only log streams. The IAM policy grants `logs:CreateLogStream` and `logs:PutLogEvents` with a resource ARN that correctly targets log streams under the specified log group. However, the policy lacks any statement that grants permission on the log group resource itself. If the log group does not already exist, the Lambda function requires `logs:CreateLogGroup` permission on the log group ARN (`arn:aws:logs:us-east-1:123456789012:log-group:MyLogGroup`) to create it. Without this, the function cannot create the log group, causing the write to fail. The resource ARN in the policy does not include the log group itself, only log streams, which is why the function lacks the necessary permissions to interact with the log group resource.

Answer

The actions list does not include logs:DescribeLogGroups

Answer

The policy is missing an explicit deny for other actions

Answer

The region in the ARN does not match the Lambda function's region

Question 2

The above condition is added to an S3 bucket policy to restrict access to a specific VPC endpoint. An EC2 instance in the same VPC is unable to access the bucket. What is the most likely reason?

Accepted Answer

The resource ARN in the policy is for EC2, not for S3. The resource ARN in the policy must reference the S3 bucket (e.g., arn:aws:s3:::bucket-name/*), not an EC2 resource. If the ARN is for EC2, the policy will not apply to S3 operations, causing the EC2 instance to be denied access regardless of the VPC endpoint condition. S3 bucket policies only take effect when the Resource element specifies the S3 bucket ARN.

Answer

The condition should use aws:SourceVpc instead of aws:SourceVpce

Answer

The EC2 instance does not have a public IP address

Answer

The VPC endpoint policy does not allow the s3:GetObject action

Question 3

A security engineer is investigating a potential compromise of an EC2 instance. The engineer needs to capture network traffic to and from the instance for forensic analysis. Which AWS service should be used to capture this traffic?

Accepted Answer

VPC Traffic Mirroring. VPC Traffic Mirroring captures and inspects network traffic at the Elastic Network Interface (ENI) level by copying packets from a source ENI to a target, such as a Network Load Balancer or another ENI. This allows the security engineer to perform deep packet inspection and forensic analysis without impacting the production traffic flow. It supports both IPv4 and IPv6 traffic and can filter by protocol, port, or packet direction, making it ideal for incident response scenarios.

Answer

AWS Config

Answer

AWS Network Firewall

Answer

Amazon Inspector

Question 4

A company uses AWS Organizations with multiple accounts. The security team wants to automatically receive alerts when an IAM user attempts to access resources they do not have permissions for, across all accounts. Which combination of services should be used?

Accepted Answer

Amazon GuardDuty and AWS Security Hub. Amazon GuardDuty continuously monitors for suspicious activity, including unauthorized API calls or failed access attempts, across all accounts in an AWS Organization. Security Hub aggregates these findings from GuardDuty and other services, enabling automated alerts via integrations like Amazon SNS or AWS Chatbot. Together, they provide a centralized, cross-account threat detection and alerting solution that meets the requirement of notifying the security team when IAM users attempt unauthorized resource access.

Answer

Amazon Inspector and AWS Lambda

Answer

AWS Config and Amazon SNS

Answer

AWS CloudTrail and Amazon CloudWatch Logs

Question 5

During an incident response, a security engineer needs to collect volatile memory from a compromised EC2 instance without affecting the running system. The instance is critical and cannot be stopped. Which approach is most appropriate?

Accepted Answer

Use AWS Systems Manager Run Command to execute a memory capture utility.. AWS Systems Manager Run Command allows you to execute a memory capture utility (such as WinPmem or LiME) on the EC2 instance without stopping it, preserving volatile memory for forensic analysis. This approach uses the SSM Agent to run commands remotely, minimizing impact on the running system while collecting critical evidence like running processes, network connections, and kernel data.

Answer

Stop the instance, detach the root volume, and attach it to a forensics instance for analysis.

Answer

Use AWS License Manager to create a snapshot of the instance memory.

Answer

Use Amazon EC2 Rescue to collect memory dump.

Question 6

A security team wants to detect unauthorized API calls in real time and automatically block the source IP address using network ACLs. Which AWS service should be used for detection?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is the correct choice because it is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, including API calls from unusual or known-bad IP addresses. It uses machine learning, anomaly detection, and integrated threat intelligence to generate findings that can trigger automated remediation, such as updating network ACLs via AWS Lambda and Amazon EventBridge. This aligns with the requirement for real-time detection and automated blocking of source IPs.

Answer

AWS CloudTrail

Answer

AWS WAF

Answer

AWS Config

Question 7

A company needs to ensure that all API calls in their AWS account are logged and monitored for suspicious activity. Which service should be enabled first?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct first service to enable because it records all API calls made in the AWS account, including the identity, source IP, and timestamp of each call. This audit log is foundational for detecting suspicious activity, as it provides the raw data needed for analysis by other services like Amazon GuardDuty or third-party tools. Without CloudTrail, there is no record of API activity to monitor.

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

AWS Config

Question 8

During an incident response, a security engineer needs to preserve the state of an EC2 instance's root volume for forensic analysis. The instance is still running. Which action should be taken to ensure the data is preserved without altering it?

Accepted Answer

Create a snapshot of the root volume.. Creating a snapshot of the root volume is the correct action because it captures a point-in-time, crash-consistent copy of the volume's data without requiring the instance to be stopped or the volume to be detached. This preserves the current state of the running instance for forensic analysis while ensuring the data is not altered by the snapshot process itself, as AWS snapshots are read-only and do not modify the source volume.

Answer

Stop the instance and then create an AMI.

Answer

Use dd if=/dev/xvda over SSH to copy the volume.

Answer

Detach the root volume and attach it to a forensics instance.

Question 9

Which THREE actions should be taken when preparing an incident response plan for AWS?

Accepted Answer

Enable AWS CloudTrail in all regions.. AWS CloudTrail must be enabled in all regions to ensure that all API calls across the entire AWS infrastructure are logged. This provides a comprehensive audit trail essential for forensic investigation and identifying the scope of a security incident. Without multi-region CloudTrail, an attacker could operate in an unmonitored region, leaving no trace for incident responders.

Answer

Share the AWS account root user password with the incident response team.

Answer

Disable VPC Flow Logs to reduce log volume.

Question 10

Which TWO steps are part of the forensic acquisition process for an EC2 instance suspected of being compromised?

Accepted Answer

Capture the instance's memory using a forensic tool.. Capturing the instance's memory using a forensic tool (such as LiME or F-Response) preserves volatile data—including running processes, network connections, and encryption keys—that would be lost if the instance were stopped or terminated. This is a critical step in the forensic acquisition process to gather evidence of compromise without altering the system state.

Answer

Stop the instance immediately to prevent further damage.

Answer

Enable termination protection on the instance.

Answer

Terminate the instance to ensure the threat is contained.

Question 11

Refer to the exhibit. A security engineer is analyzing a VPC Flow Logs entry for an EC2 instance with private IP 192.0.2.10. The log shows an accepted outbound connection from the instance to 203.0.113.50 on port 443. The instance is not expected to initiate outbound HTTPS connections. What should the engineer do next to investigate?

Accepted Answer

Log into the instance and check for unauthorized processes or malware.. The VPC Flow Logs show an accepted outbound connection from the EC2 instance to an external IP on port 443, which is unexpected behavior. The immediate next step is to log into the instance and investigate for unauthorized processes, malware, or compromised credentials that could be initiating this outbound HTTPS traffic. This aligns with incident response best practices: verify the host before making network-level changes.

Answer

Block the IP 203.0.113.50 in the security group immediately.

Answer

Check the security group rules to see if outbound HTTPS is allowed.

Answer

Check Amazon Route 53 DNS logs to see what domain was resolved.

Question 12

A security engineer is investigating a potential data breach. AWS CloudTrail logs show that an IAM user 'svc-backup' created an S3 bucket in the us-east-1 region and then uploaded a large number of objects. The engineer suspects that the user's credentials were compromised. What is the MOST efficient way to quickly identify the source IP address and user agent of the API calls made by this user?

Accepted Answer

Query AWS CloudTrail logs in Amazon Athena for the user's API calls.. CloudTrail logs capture detailed records of all API calls, including the source IP address and user agent for each request. By querying these logs with Amazon Athena, the security engineer can efficiently filter for the specific IAM user 'svc-backup' and extract the source IP and user agent from the relevant event records, enabling rapid identification of the compromised credentials' origin.

Answer

Analyze VPC Flow Logs for traffic to the S3 bucket.

Answer

Enable Amazon GuardDuty and review the generated findings.

Answer

Use AWS Config to review the configuration history of the S3 bucket.

Question 13

A company uses AWS Organizations with multiple accounts. The security team wants to detect suspicious API activity across all accounts in real time. They have enabled AWS CloudTrail in all accounts and are sending logs to a centralized S3 bucket. However, they are receiving alerts only after a significant delay. What should the security team do to reduce the latency of threat detection?

Accepted Answer

Set up Amazon EventBridge rules in each account to send specific CloudTrail events to a centralized event bus for immediate processing.. Amazon EventBridge can be configured with rules in each account to forward specific CloudTrail events to a centralized event bus in near real time, bypassing the latency introduced by CloudTrail log delivery to S3 (which can be up to 15 minutes). This allows the security team to process and alert on suspicious API activity immediately as events occur, rather than waiting for log files to be delivered and processed.

Answer

Enable Amazon GuardDuty in each account and configure it to send findings to a centralized S3 bucket.

Answer

Configure CloudTrail to deliver logs to a single S3 bucket and use S3 Event Notifications to trigger a Lambda function.

Answer

Use Amazon CloudWatch Logs Insights to query CloudTrail logs across accounts in real time.

Question 14

A security engineer discovers an Amazon GuardDuty finding of type 'UnauthorizedAccess:EC2/SSHBruteForce' for an EC2 instance. The instance is part of an Auto Scaling group and has a public IP address. What is the MOST effective immediate step to mitigate the threat?

Accepted Answer

Detach the instance from the Auto Scaling group and terminate it.. The instance is compromised and part of an Auto Scaling group. Detaching it first prevents the Auto Scaling group from immediately replacing it with a new instance that might inherit the same vulnerability, allowing for forensic analysis. Terminating it after detachment stops the SSH brute force attack at its source without risking automatic re-provisioning of a similarly exposed instance.

Answer

Modify the network ACL to block SSH traffic from the attacker's IP.

Answer

Terminate the instance without detaching it from the Auto Scaling group.

Answer

Update the security group to restrict SSH access to known IP addresses.

Question 15

A security engineer is investigating a potential incident where an EC2 instance was compromised. The engineer has access to the following logs: CloudTrail, VPC Flow Logs, and OS-level logs from the instance. Which TWO log sources would be MOST useful to determine the initial attack vector? (Choose TWO.)

Accepted Answer

OS-level authentication and system logs. OS-level authentication and system logs (option B) are critical because they record local login attempts, sudo commands, and process executions that can reveal how an attacker gained initial access—such as via SSH brute force, a compromised user account, or a vulnerable service. CloudTrail logs (option C) are equally important because they capture API calls made to AWS services, including RunInstances, CreateKeyPair, and ModifySecurityGroup, which can show if the attacker launched the instance from a compromised AWS account or modified security groups to allow inbound traffic. Together, these two sources provide the evidence needed to trace the initial compromise vector, whether it originated from within the OS or through AWS API manipulation.

Answer

Amazon CloudWatch Metrics for the instance

Answer

AWS Config configuration history

Answer

VPC Flow Logs