SCS-C02 Threat Detection and Incident Response Practice Test 2 — 15 Questions

Question 1

During a security incident, a security engineer needs to preserve forensic evidence from an EC2 instance that may be compromised. The instance is running a critical application. Which approach minimizes data loss while ensuring the integrity of the evidence?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an EBS snapshot, then isolate the instance by modifying the security group and removing it from the load balancer.. Creating an EBS snapshot preserves the disk state at the point of the incident, capturing forensic evidence without altering the running instance. Isolating the instance by modifying the security group (e.g., removing all inbound/outbound rules) and removing it from the load balancer stops network traffic and prevents further compromise, minimizing data loss while maintaining the integrity of the evidence for later analysis.

Answer

Immediately terminate the instance to stop any ongoing malicious activity.

Answer

SSH into the instance and run forensic tools to capture memory.

Answer

Detach the instance from the Auto Scaling group and leave it running without changes.

Question 2

A company's security team wants to detect unauthorized S3 bucket access attempts in real time. Which service should they use to generate alerts when an IAM user attempts to access a bucket without proper permissions?

Accepted Answer

AWS CloudTrail with CloudWatch alarms. AWS CloudTrail logs all API calls made to S3, including access denied errors. By creating a CloudWatch alarm on the `S3 AccessDenied` event in CloudTrail logs, the security team can receive real-time alerts when an IAM user attempts to access a bucket without proper permissions. This approach directly captures the unauthorized attempt at the API level, enabling immediate detection.

Answer

Amazon GuardDuty

Answer

S3 server access logs

Answer

AWS Config

Question 3

An organization uses AWS Organizations with multiple accounts. The security team needs a centralized location to collect and analyze security findings from GuardDuty, Inspector, and Macie. Which AWS service should they use?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct service because it provides a centralized view of security alerts and compliance status across multiple AWS accounts. It aggregates findings from GuardDuty, Inspector, and Macie, normalizing them into the AWS Security Finding Format (ASFF), enabling the security team to analyze and prioritize threats in a single dashboard.

Answer

Amazon Detective

Answer

Amazon CloudWatch

Answer

AWS Config

Question 4

A security engineer is investigating a potential compromise of an EC2 instance. The instance was launched from a custom AMI. The engineer needs to determine if the AMI itself contains malicious software. Which approach provides the most thorough analysis without risking the production environment?

Accepted Answer

Launch a test instance from the AMI in an isolated VPC and run Amazon Inspector.. Launching a test instance from the AMI in an isolated VPC allows you to run Amazon Inspector, which performs automated vulnerability assessments and network reachability checks against the instance. This approach provides a thorough analysis of the AMI's software and configuration without exposing the production environment to any potential malicious activity. Amazon Inspector uses a knowledge base of common vulnerabilities and exposures (CVEs) and CIS benchmarks to identify security issues, making it effective for detecting malicious software embedded in the AMI.

Answer

Use AWS Systems Manager to run a compliance scan on the running instance.

Answer

Create an EBS snapshot from the AMI and scan the snapshot with Amazon Detective.

Answer

Launch a test instance from the AMI in an isolated VPC and analyze its behavior.

Question 5

A company wants to ensure that any deleted CloudTrail logs are detected and alerted within minutes. Which approach should they use?

Accepted Answer

Configure CloudTrail to send logs to CloudWatch Logs, create a metric filter for DeleteTrail events, and set a CloudWatch alarm to send an SNS notification.. CloudTrail management events (including DeleteTrail) are delivered to CloudWatch Logs, where a metric filter can match the exact event name. A CloudWatch alarm on that metric triggers an SNS notification within minutes, meeting the detection and alerting requirement. This approach directly monitors the CloudTrail API call that deletes the trail itself, not just the log files.

Answer

Enable S3 event notifications on the CloudTrail bucket for DELETE events.

Answer

Use AWS Config to track CloudTrail configuration changes and trigger a Lambda function.

Answer

Enable Amazon GuardDuty to monitor CloudTrail management events.

Question 6

A security team discovers that an IAM user's credentials are being used from an unusual geographic location. Which AWS service can provide automated response to revoke the user's access immediately?

Accepted Answer

AWS Systems Manager Automation. AWS Systems Manager Automation is correct because it can be triggered by Amazon GuardDuty findings (e.g., UnauthorizedAccess:IAMUser/AnomalousBehavior) via Amazon EventBridge to run an automation document that immediately revokes the IAM user's access keys and applies a deny-all policy. This provides a fully automated, low-latency response without requiring manual intervention or custom code.

Answer

Amazon GuardDuty

Answer

AWS Lambda

Answer

AWS Config

Question 7

During incident response, a security engineer needs to capture network traffic from an EC2 instance for forensic analysis. The instance is part of an Auto Scaling group. Which action preserves the most evidence while minimizing disruption?

Accepted Answer

Enable VPC Flow Logs for the subnet and analyze the logs.. VPC Flow Logs capture metadata (IP addresses, ports, protocols, packet sizes) of all traffic to/from the EC2 instance at the subnet level, preserving a forensic record without any disruption to the running instance or Auto Scaling group. This approach avoids stopping, terminating, or modifying the instance, ensuring the incident environment remains intact for further investigation.

Answer

Take an EBS snapshot and analyze network logs from the snapshot.

Answer

Use AWS Traffic Mirroring to mirror traffic to a monitoring appliance.

Answer

Terminate the instance and launch a new one to capture network logs.

Question 8

Which TWO actions should a security engineer take to investigate a potential AWS API credential leak? (Choose two.)

Accepted Answer

Use AWS CloudTrail to review API calls made with the compromised keys.. AWS CloudTrail logs all API calls made within an AWS account, including those using compromised access keys. By reviewing these logs, a security engineer can identify the scope of the breach, such as which resources were accessed, from which IP addresses, and at what times. This is a critical first step in incident response to understand the impact and gather forensic evidence.

Answer

Change the IAM user's password.

Answer

Disable all AWS services in the account.

Answer

Delete the IAM user and recreate it with the same permissions.

Question 9

Which THREE services can be used to detect and alert on suspicious API activity across an AWS organization? (Choose three.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior, including suspicious API activity. It uses machine learning, anomaly detection, and integrated threat intelligence to analyze AWS CloudTrail management events, VPC Flow Logs, and DNS logs across an AWS organization, and can trigger alerts via Amazon EventBridge or Security Hub.

Answer

Amazon Inspector

Answer

AWS Config

Question 10

Which TWO are best practices for securing an AWS account's root user? (Choose two.)

Accepted Answer

Enable multi-factor authentication (MFA) on the root user.. Enabling multi-factor authentication (MFA) on the root user adds a second layer of security beyond the password and is the single most effective control to prevent unauthorized access to the most privileged account in an AWS environment. AWS strongly recommends MFA for the root user as it mitigates the risk of credential theft or compromise, which could lead to full account takeover and irreversible damage.

Answer

Share the root user credentials with the security team.

Answer

Delete the root user account.

Answer

Use the root user for daily administrative tasks.

Question 11

A company is using Amazon GuardDuty to detect threats. They notice that GuardDuty is generating a high volume of 'UnauthorizedAccess:EC2/SSHBruteForce' findings from an internal EC2 instance that is used for vulnerability scanning. The security team wants to reduce false positives without disabling GuardDuty entirely. What should they do?

Accepted Answer

Create a suppression rule for findings originating from the vulnerability scanner's IP address.. Amazon GuardDuty's suppression rules allow you to filter out findings based on criteria such as IP address, without disabling the detector or any finding types. By creating a suppression rule that matches the vulnerability scanner's IP address, you automatically archive and suppress future 'UnauthorizedAccess:EC2/SSHBruteForce' findings from that specific source, reducing false positives while maintaining full threat detection coverage for all other instances.

Answer

Change the security group of the vulnerability scanner to block SSH traffic.

Answer

Disable GuardDuty for the subnet where the vulnerability scanner is located.

Answer

Disable the 'UnauthorizedAccess:EC2/SSHBruteForce' finding type in GuardDuty.

Question 12

A security engineer is investigating a potential compromise of an S3 bucket. The engineer needs to determine if any objects were accessed by an unauthorized user. Which AWS service can provide detailed access logs for S3 objects?

Accepted Answer

S3 server access logs. S3 server access logs provide detailed records of requests made to an S3 bucket, including the requester, bucket name, request time, action, and response status. This granularity is essential for identifying unauthorized access to specific objects, as it logs every GET, PUT, DELETE, and HEAD request at the object level. AWS CloudTrail, while useful for management events, does not log data-level operations like object reads by default unless data events are explicitly enabled, and even then, it may not capture all object-level access details as comprehensively as server access logs.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon Inspector

Question 13

A security engineer is setting up automated incident response for a compromised EC2 instance. The engineer wants to isolate the instance immediately upon detection of a GuardDuty finding. Which AWS service can be used to automatically trigger a Lambda function that modifies the instance's security group?

Accepted Answer

Amazon CloudWatch Events. Amazon CloudWatch Events (now part of Amazon EventBridge) can be configured with a rule that matches specific GuardDuty finding events. When a finding is detected, the rule triggers a Lambda function that can modify the EC2 instance's security group to isolate it, for example by removing all inbound rules or replacing the group with a restrictive one. This provides the automated, event-driven response required.

Answer

AWS Step Functions

Answer

Amazon Inspector

Answer

AWS Config

Question 14

A security engineer is configuring AWS CloudTrail to monitor data events for S3 objects. Which TWO of the following must be enabled to log object-level operations? (Select TWO.)

Accepted Answer

Enable data events in the CloudTrail trail.. CloudTrail data events capture S3 object-level operations such as GetObject, PutObject, and DeleteObject. To enable this, you must explicitly select 'Data events' in the CloudTrail trail configuration, as management events only cover bucket-level operations like CreateBucket.

Answer

Enable S3 server access logs on the bucket.

Answer

Enable management events in the CloudTrail trail.

Answer

Enable S3 Object Lambda.

Question 15

A company wants to implement automated remediation of security findings from Amazon GuardDuty. Which THREE AWS services can be used together to create an automated response workflow? (Select THREE.)

Accepted Answer

Amazon CloudWatch Events (EventBridge). Amazon GuardDuty sends findings to Amazon CloudWatch Events (EventBridge) as events. You can configure an EventBridge rule to match specific GuardDuty findings and trigger an AWS Lambda function for automated remediation. AWS Step Functions can orchestrate complex remediation workflows involving multiple Lambda functions or other AWS services, providing retry logic and error handling.

Answer

Amazon SQS

Answer

AWS Config