SCS-C02 Threat Detection and Incident Response Practice Test 17 — 15 Questions

Question 1

A company uses Amazon GuardDuty to monitor its AWS environment. The security team has received a GuardDuty finding of type 'Recon:EC2/PortProbeUnprotectedPort'. The finding indicates that an EC2 instance has an open SSH port that is being probed from the internet. The team wants to reduce the attack surface and prevent future probes. Which THREE actions should the team take? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the security group to allow SSH only from specific IP addresses.. Modifying the security group to allow SSH only from specific IP addresses directly restricts inbound traffic to trusted sources, eliminating the open exposure that triggers the GuardDuty 'Recon:EC2/PortProbeUnprotectedPort' finding. This is a fundamental network access control that reduces the attack surface by applying the principle of least privilege at the security group level.

Answer

Suppress the GuardDuty finding to reduce noise.

Answer

Terminate the EC2 instance and launch a new one.

Question 2

A security engineer is configuring automated response to a specific GuardDuty finding type. The engineer wants to automatically block the offending IP address in the security group when a finding is generated. Which TWO AWS services should the engineer use together to achieve this? (Choose TWO.)

Accepted Answer

AWS Lambda. Amazon EventBridge [CORRECT] is the right service to detect the GuardDuty finding event, because GuardDuty publishes its findings as events to the default EventBridge event bus, and an EventBridge rule can match the specific finding type (e.g., source aws.guardduty with the desired detail-type) and route it to a target for automated response. AWS Lambda [CORRECT] is the correct target to perform the remediation, since a Lambda function can call the EC2 APIs (such as AuthorizeSecurityGroupIngress/RevokeSecurityGroupIngress or ModifyNetworkInterfaceAttribute) to block the offending IP address in the security group. AWS Config is for recording resource configuration changes and evaluating compliance rules, not for event-driven remediation of GuardDuty findings. Amazon SNS can deliver notifications but cannot itself modify security groups, so it does not perform the blocking action. Amazon CloudWatch Logs stores log data but does not react to GuardDuty findings or execute remediation logic.

Answer

AWS Config

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon CloudWatch Logs

Question 3

A financial services company uses a multi-account AWS organization with a centralized security account. The security team has enabled Amazon GuardDuty in all accounts and configured it to send findings to the security account via AWS Organizations. The team also uses AWS Security Hub in the security account to aggregate findings. They have set up automated response using AWS Systems Manager Automation documents to isolate compromised EC2 instances by applying a security group that denies all traffic. However, during a recent incident, the automation failed because the Systems Automation document did not have permission to modify the security group in the member account. The security team needs to design a solution that allows the security account to automatically isolate instances in any member account. What should they do?

Accepted Answer

Use AWS CloudFormation StackSets to deploy an IAM role in each member account with permissions to modify security groups. Then, in the security account, configure the Systems Manager Automation document to assume that role when running the isolation step.. It uses AWS CloudFormation StackSets to deploy an IAM role in each member account with the necessary permissions to modify security groups. The Systems Manager Automation document in the security account can then assume this role via a cross-account IAM role assumption, allowing it to isolate EC2 instances in any member account without requiring a single monolithic role or per-account Lambda functions.

Answer

Create a Lambda function in each member account that is triggered by GuardDuty findings and modifies the security group.

Answer

Create a single IAM role in the security account that has permissions to modify security groups in all member accounts.

Answer

Modify the IAM role used by Systems Manager Automation in the security account to include permissions to modify security groups in all member accounts.

Question 4

A company uses Amazon GuardDuty and AWS Security Hub in a single AWS account. The security team has created a custom action in Security Hub to send findings to a custom Lambda function for automated response. The Lambda function is designed to take remediation actions based on the finding type. During testing, the team notices that the Lambda function is not being invoked when new findings are generated. The Lambda function's resource-based policy allows invocations from Security Hub, and the function's execution role has necessary permissions. What is the most likely reason for the failure?

Accepted Answer

No Amazon EventBridge rule is configured to send Security Hub findings to the Lambda function.. Security Hub custom actions do not automatically invoke a Lambda function. When a custom action is triggered, Security Hub publishes an event to the default EventBridge bus, and you must create an EventBridge rule that matches the custom action ARN and targets the Lambda function. Without that rule, the Lambda is never invoked, even though the resource-based policy and execution role are correctly configured.

Answer

GuardDuty is not enabled for all required resource types.

Answer

The Lambda function's execution role does not have permission to access GuardDuty.

Answer

The Lambda function's resource-based policy does not include Security Hub as a principal.

Question 5

A company uses AWS CloudTrail to log all API activity. The security team wants to be alerted when an IAM user creates a new access key. They have created a CloudWatch metric filter on the CloudTrail log group for the event name 'CreateAccessKey' and set up a CloudWatch alarm that sends an email via Amazon SNS. However, the alarm is not triggering even though the team knows that access keys have been created. The metric filter has been tested and shows data points in CloudWatch. What should the security team check next?

Accepted Answer

Review the CloudWatch alarm configuration, including the period and threshold.. The metric filter is producing data points, which means logs are being ingested and the filter is matching events. The most likely issue is that the CloudWatch alarm's period or threshold is misconfigured—for example, the evaluation period might be too long or the threshold too high, causing the alarm to not transition to ALARM state despite the metric having values. The security team should verify the alarm's settings, such as the period (e.g., 5 minutes) and the threshold (e.g., >= 1), to ensure they align with the expected frequency of access key creation events.

Answer

Ensure that the CloudTrail trail is delivering logs to the correct CloudWatch Logs log group.

Answer

Verify that the CloudTrail trail is logging data events.

Answer

Check that the IAM user has permissions to create access keys.

Question 6

A company has a serverless application using AWS Lambda, API Gateway, and DynamoDB. The security team wants to detect and respond to potential SQL injection attempts in API requests. They have enabled AWS WAF on the API Gateway and created a rule to block SQL injection. However, they also want to capture the blocked requests for analysis and store them in an S3 bucket. The team has configured WAF to send logs to Amazon Kinesis Data Firehose, which delivers to an S3 bucket. After testing, the team notices that the logs are not being delivered. The Firehose delivery stream is in the same AWS account, and the S3 bucket policy allows the Firehose service to write. What is the most likely cause?

Accepted Answer

The Kinesis Data Firehose delivery stream does not have an IAM role with permissions to write to the S3 bucket.. The most likely cause is that the Kinesis Data Firehose delivery stream lacks an IAM role with permissions to write to the S3 bucket. Even if the S3 bucket policy allows the Firehose service to write, Firehose assumes an IAM role to access the bucket. If that role does not have the necessary permissions (e.g., s3:PutObject), delivery fails. The other options are less likely because WAF logging is configured (since logs are attempted), the S3 bucket policy is stated to allow write, and Firehose buffering is normal.

Answer

The WAF web ACL is not configured to log blocked requests.

Answer

The S3 bucket policy does not grant write permissions to the Firehose delivery stream's IAM role.

Answer

Kinesis Data Firehose delivers logs in batches every 5 minutes, so the team should wait longer.

Question 7

A company uses Amazon Detective to investigate security findings. The security team is analyzing a GuardDuty finding of type 'Backdoor:EC2/C&CActivity.B!DNS' for an EC2 instance. The team wants to use Detective to understand the full scope of the incident, including which other resources the instance communicated with and any IAM roles used. However, when the team opens the finding in Detective, they see no network activity data for the instance. The instance is in a VPC with VPC Flow Logs enabled, and Flow Logs are being published to CloudWatch Logs. What should the team do to enable Detective to display the network activity?

Accepted Answer

Ensure that VPC Flow Logs are enabled for the VPC and are being published to Amazon CloudWatch Logs in the same account and Region as Detective.. Amazon Detective ingests VPC Flow Logs from CloudWatch Logs to generate network activity visualizations for EC2 instances. Even though VPC Flow Logs are enabled and published to CloudWatch Logs, Detective requires that the logs are in the same AWS account and Region as the Detective behavior graph. If the logs are in a different account or Region, Detective cannot access them, resulting in no network activity data being displayed for the instance.

Answer

Re-enable the GuardDuty finding in Amazon Detective.

Answer

Enable GuardDuty EKS Audit Logs monitoring.

Answer

Install the Amazon Detective agent on the EC2 instance.

Question 8

A company uses AWS CloudTrail to log all API activity. The security team wants to ensure that any changes to CloudTrail configuration (e.g., disabling the trail, deleting the trail, modifying the log delivery) are detected immediately. They have created a CloudWatch Events rule to capture the event 'StopLogging' and send an SNS notification. During testing, the team stops the trail and does not receive the notification. The CloudWatch Events rule is configured with the correct event pattern. What should the team check?

Accepted Answer

Check the IAM role associated with the CloudWatch Events rule to ensure it has permissions to publish to the SNS topic.. CloudWatch Events rules require an IAM role with permissions to invoke the target (e.g., publish to SNS). Even if the event pattern matches and the SNS topic exists, without a properly configured IAM role that grants `sns:Publish` to the CloudWatch Events service, the rule cannot deliver the notification. This is a common misconfiguration that causes silent failures.

Answer

Verify that the CloudTrail trail is logging management events.

Answer

Ensure that the event pattern includes the correct source and detail-type.

Answer

Confirm that the SNS topic subscription is confirmed.

Question 9

A company uses Amazon GuardDuty and AWS Security Hub. The security team has configured a custom insight in Security Hub to track findings related to S3 bucket exposures. They want to automatically remediate these findings by applying an S3 bucket policy that blocks public access. The team has created a Lambda function that applies the bucket policy and configured Security Hub to send findings to the Lambda function via a custom action. However, when a new finding is generated, the Lambda function is invoked but fails to apply the policy because it does not have permission to modify the S3 bucket. The Lambda function's execution role has permissions to modify S3 bucket policies, but the function is in the same account as the bucket. What should the team check?

Accepted Answer

Check the S3 bucket policy for any explicit deny statements that might block the Lambda function's role.. The Lambda function's execution role already has IAM permissions to modify S3 bucket policies, and it operates in the same account as the bucket, so cross-account trust is not the issue. An explicit Deny statement in the S3 bucket policy overrides any Allow granted by IAM policies, including the Lambda role's permissions. Therefore, the team must inspect the bucket policy for explicit denies that block the role from calling PutBucketPolicy. This is the only remaining cause consistent with the symptoms.

Answer

Add the Lambda function's execution role to the bucket's Access Control List (ACL).

Answer

Ensure that the Lambda function's execution role has a trust policy that allows Security Hub to assume it.

Answer

Verify that the S3 bucket's block public access settings are not preventing the policy update.

Question 10

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application processes sensitive customer data. The Security team has enabled VPC Flow Logs, CloudTrail, and GuardDuty. Recently, the team received a GuardDuty finding indicating a potential SSH brute force attack originating from an external IP address 203.0.113.50 targeting one of the EC2 instances. The Security Engineer needs to automatically isolate the affected instance and capture forensic evidence for analysis. The company has strict requirements: the instance must be isolated immediately, and a snapshot of the EBS volume must be taken before any remediation actions are taken. The instance is part of an Auto Scaling group, and the Security Engineer wants to minimize manual intervention. The Security Engineer has access to AWS Systems Manager and AWS Lambda. Which combination of steps should the Security Engineer implement to meet the requirements?

Accepted Answer

Configure Amazon EventBridge to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function first calls the EC2 CreateSnapshot API to capture a forensic snapshot of the instance's EBS volume. Then, it uses AWS Systems Manager Automation to run a pre-defined automation document that isolates the instance by modifying the instance's security group to only allow traffic from a trusted management IP, and then stops the instance.. It uses EventBridge to directly detect the GuardDuty finding, which triggers a Lambda function that first takes an EBS snapshot (forensic capture) via the CreateSnapshot API before any remediation. Then it uses Systems Manager Automation to isolate the instance by modifying the security group to allow only a trusted management IP and stops the instance, ensuring isolation without destroying the instance. This sequence satisfies the strict requirement that a snapshot must be taken before any remediation actions, and it minimizes manual intervention by automating the entire response.

Answer

Use AWS Systems Manager to automatically connect to the instance via EC2 Instance Connect, run commands to capture forensic data, and then modify the security group to deny all inbound traffic.

Answer

Create a CloudWatch Logs metric filter on the VPC Flow Logs for the attacker IP. When the metric breaches a threshold, trigger an SNS topic that runs an AWS Systems Manager Automation document to isolate the instance and take an EBS snapshot.

Answer

Configure a CloudWatch Events rule to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function terminates the EC2 instance and then takes a snapshot of the EBS volume for forensic analysis.

Question 11

A security engineer is investigating a compromised IAM user whose access key was leaked. The engineer uses the AWS CLI to review CloudTrail event history but notices that recent management events performed by the compromised access key are missing. The CloudTrail trail is configured to log management events for all Regions and delivers to an S3 bucket. The engineer needs to determine whether the missing events indicate that the attacker is evading detection or that the engineer is querying the wrong data source. Which action should the engineer take FIRST to confirm the source of the discrepancy?

Accepted Answer

Verify that the CloudTrail trail is logging and that the S3 bucket policy, KMS key policy, and CloudTrail service principal permissions allow the trail to deliver logs, then check the S3 bucket for the expected log file prefix and timestamps.. When CloudTrail events appear missing, the first step is to confirm that the trail is actually delivering logs to its destination. A trail can be enabled yet fail delivery because the S3 bucket policy, KMS key policy, or CloudTrail service principal lacks required permissions, or because the trail was modified. Inspecting the S3 bucket for the expected log file prefix and recent timestamps distinguishes a delivery failure from attacker evasion, and it is faster and more definitive than querying event history or GuardDuty.

Answer

Query Amazon GuardDuty findings for the IAM user to see whether GuardDuty recorded the API calls, then correlate the GuardDuty finding timestamps with the CloudTrail event history.

Answer

Enable AWS CloudTrail Insights on the trail to detect unusual API call rates, then review the Insights events in the S3 bucket for the compromised access key.

Answer

Use the AWS CloudTrail console or the aws cloudtrail lookup-events command to query the last 90 days of event history, since the event history is retained for 90 days and is separate from the trail's S3 delivery.

Question 12

A security engineer needs to centrally aggregate AWS CloudTrail management events from all accounts in an AWS Organizations organization and retain them for 7 years in immutable storage. The engineer has already created an organization trail that delivers to a central S3 bucket in the security account. Which additional configuration is required to make the logs tamper-evident and to detect if any account attempts to disable CloudTrail?

Accepted Answer

Enable S3 Object Lock in compliance mode on the central bucket and enable CloudTrail log file validation, then create an Amazon EventBridge rule for the CloudTrail StopLogging API call.. Immutability and tamper detection are two distinct controls. S3 Object Lock in compliance mode enforces WORM retention so logs cannot be altered or deleted for the retention period, and CloudTrail log file validation produces digest files that let you verify delivered logs were not modified. Because disabling a trail stops future delivery, an EventBridge rule matching the StopLogging event (and related trail APIs) is needed to alert the security team immediately.

Answer

Enable S3 Versioning and MFA Delete on the central bucket, then configure AWS Config to record the cloudtrail:StopLogging API as a configuration change.

Answer

Enable AWS CloudTrail Insights on the organization trail and configure an Amazon SNS topic to notify the security team when unusual API activity is detected.

Answer

Enable Amazon Macie on the central bucket to detect anomalous access and configure an S3 bucket policy that denies s3:DeleteObject to all principals except the CloudTrail service principal.

Question 13

A security engineer is investigating a suspected compromise of an Amazon EC2 instance that is a member of an Auto Scaling group. The instance is still running and the engineer must preserve volatile evidence before the Auto Scaling group replaces it. Which sequence of actions best preserves the evidence while maintaining the ability to analyze it later?

Accepted Answer

Capture memory with an approved forensic tool, take EBS snapshots of all attached volumes, record instance metadata and network connections, then isolate the instance by replacing its security group with a quarantine group.. Preserving volatile evidence requires acting before any shutdown or termination. Capturing memory first retains processes and credentials, EBS snapshots preserve disk state for offline analysis, and recording metadata and network connections provides investigative context. Isolating the instance with a quarantine security group stops exfiltration and command-and-control traffic without destroying the evidence, and it keeps the instance alive so additional artifacts can be collected if needed.

Answer

Stop the instance, detach the root EBS volume, create a snapshot of the volume, and then reattach the original volume to the instance.

Answer

Create an AMI of the instance, terminate the instance to prevent further malicious activity, and launch a new instance from the AMI for analysis.

Answer

Detach the instance from the Auto Scaling group, reboot the instance into single-user mode, and copy the root filesystem to an S3 bucket using the AWS CLI.

Question 14

A security analyst needs to detect and respond to suspicious API activity in a multi-account AWS environment. The analyst wants near real-time detection of anomalous IAM behavior and the ability to automatically invoke a remediation Lambda function when a specific finding occurs. Which combination of AWS services provides this with the least operational overhead?

Accepted Answer

Amazon GuardDuty with an AWS Organizations delegated administrator, an Amazon EventBridge rule matching the finding, and the remediation Lambda function as the rule target.. GuardDuty provides managed, near real-time threat detection using CloudTrail, VPC Flow Logs, DNS logs, and threat intelligence, and it integrates with Organizations through a delegated administrator so all accounts are covered centrally. EventBridge receives GuardDuty findings as events, and a rule can target a Lambda function directly, enabling automated remediation without building custom detection logic or per-account rules.

Answer

Amazon Detective with an organization-wide graph, Amazon EventBridge rules for each account, and AWS Systems Manager Automation documents to run remediation.

Answer

AWS Security Hub with custom insights, Amazon CloudWatch Logs metric filters on CloudTrail, and a CloudWatch alarm that invokes the remediation Lambda function.

Answer

AWS CloudTrail with an organization trail, Amazon Athena queries scheduled by AWS Glue, and an Amazon SNS topic that invokes the remediation Lambda function.

Question 15

A company's security team uses AWS Security Hub in a central security account. They want to ensure that when a critical finding is generated in any member account, the affected resource is automatically tagged with an incident identifier and the finding is routed to a third-party ticketing system. Which approach best meets these requirements?

Accepted Answer

Configure Security Hub to send findings to EventBridge in each member account, create an EventBridge rule matching the critical severity, and target a Lambda function that tags the resource and calls the ticketing API.. Security Hub publishes findings to EventBridge in the account where they are generated, so a rule in each member account can match critical severity and invoke a Lambda function that tags the resource and creates a ticket. This provides automatic, near real-time response in every account without manual intervention, and it scales across an organization when deployed consistently.

Answer

Use AWS Config conformance packs to evaluate resources, and configure an Amazon SNS topic that invokes the tagging and ticketing Lambda function for noncompliant resources.

Answer

Create a custom action in Security Hub that the analyst manually triggers for each critical finding, and configure the custom action to invoke a Lambda function that tags the resource and creates a ticket.

Answer

Enable cross-region aggregation in Security Hub and configure a single EventBridge rule in the aggregation Region to invoke the tagging and ticketing Lambda function for all findings.