SCS-C02 Threat Detection and Incident Response Practice Test 2 — 15 Questions

Question 1

An organization is using Amazon EKS for container workloads. The security team wants to detect container escape attempts. Which THREE AWS services or features should be enabled? (Choose THREE.)

Accepted Answer

AWS Security Hub. AWS Security Hub (B) is correct because it aggregates and correlates findings from services like GuardDuty, including EKS runtime and container-escape detections, into a centralized dashboard with security standards checks. Amazon GuardDuty with EKS Runtime Monitoring (D) is correct because it deploys the GuardDuty security agent to EKS nodes and uses eBPF-based runtime threat detection to identify container escape attempts, privilege escalation, and suspicious process activity at the pod level. AWS CloudTrail (E) is correct because it records EKS control plane API activity (e.g., CreateCluster, UpdateClusterConfig, and Kubernetes API calls via EKS audit logs) that can reveal attempts to modify workloads or escalate privileges as part of an escape chain. AWS WAF (A) is not correct because it protects HTTP/S web traffic at the application layer and has no visibility into container runtime or host-level escape behavior. VPC Flow Logs (C) is not correct because it only captures IP traffic metadata for network interfaces and cannot detect process-level container escape attempts.

Answer

AWS WAF

Answer

VPC Flow Logs

Question 2

A company's security team is configuring Amazon GuardDuty to detect crypto-mining activities on EC2 instances. Which THREE indicators should the team monitor? (Choose 3.)

Accepted Answer

Outbound connections to IP addresses on port 3333.. Option A is correct because port 3333 is a common Stratum mining-protocol port used by crypto-mining pools, so GuardDuty flags outbound connections to such IPs as a CryptoCurrency:EC2/BitcoinTool.B finding. Option B is correct because sustained, unusually high CPU utilization is a hallmark of resource-hijacking crypto-miners, and GuardDuty correlates this behavior with other signals to raise findings. Option D is correct because DNS queries to known mining pools (e.g., domains resolving to mining endpoints) are a strong indicator that an instance has been compromised for mining, and GuardDuty monitors DNS activity for these lookups. Option C is not a primary crypto-mining indicator since mining traffic is typically low-volume outbound, and inbound traffic spikes are more associated with DDoS or scanning. Option E is not a typical mining indicator because crypto-mining is CPU/GPU-intensive rather than disk-I/O-intensive, so high disk I/O is not one of the three monitored indicators.

Answer

High volume of inbound network traffic.

Answer

High disk I/O operations.

Question 3

A security engineer notices that an EC2 instance is sending outbound traffic to a known malicious IP address. The instance is part of an Auto Scaling group behind an Application Load Balancer. The engineer needs to immediately stop the exfiltration while preserving forensic evidence. What is the BEST course of action?

Accepted Answer

Remove the instance from the target group and apply a security group that denies all traffic.. Removing the instance from the target group immediately stops new traffic from the Application Load Balancer to the instance, while applying a security group that denies all outbound traffic (e.g., a custom security group with no outbound rules) halts any ongoing exfiltration without destroying the instance or its attached EBS volumes. This preserves the forensic evidence (memory, disk, logs) for later analysis, unlike termination or shutdown which could lose volatile data.

Answer

Detach the EBS volume from the instance.

Answer

Terminate the EC2 instance immediately.

Answer

Shut down the instance from within the OS.

Question 4

A company uses AWS CloudTrail to log all API calls. The security team notices a series of `UpdateTrail` API calls from a user in the Security account, disabling logging on a multi-region trail. The user has a policy that allows `cloudtrail:UpdateTrail` only on trails with a specific tag. However, the trail does not have that tag. What is the MOST likely reason the call succeeded?

Accepted Answer

The trail did not have the required tag at the time of the API call due to a race condition.. AWS IAM policies are evaluated based on the resource's tags at the time of the API call. If the `UpdateTrail` API call was made while the trail's tag was being removed or added, a race condition could cause the trail to temporarily lack the required tag, allowing the action to succeed despite the policy's intent. This is a known edge case in IAM tag-based authorization, where eventual consistency of tag changes can lead to unintended access.

Answer

The trail had an explicit deny in the same policy that was overridden by a separate allow.

Answer

The user's permissions were granted through a service control policy (SCP) that allowed the action.

Answer

CloudTrail API calls are not logged and bypass IAM policies.

Question 5

A security team is setting up incident response automation. Which TWO steps should be taken to ensure that a compromised EC2 instance is isolated while preserving forensic data? (Choose TWO.)

Accepted Answer

Remove the instance from any Auto Scaling group or load balancer target group.. Option C is correct because detaching the instance from Auto Scaling groups and load balancer target groups prevents the automation from replacing or deregistering it in ways that could destroy evidence, and it stops the instance from continuing to serve traffic or be terminated by scaling policies. Option D is correct because creating an EBS snapshot of the root volume captures a point-in-time, read-only copy of the disk for forensic analysis before any further changes are made. Option A is not ideal because a security group that denies all inbound and outbound traffic can block the forensic tooling and management access needed to investigate the instance, and it does not preserve data. Option B is wrong because shutting down from the OS can alter volatile memory and filesystem state, and it may not be possible if the instance is compromised. Option E is wrong because terminating the instance destroys the instance store and may delete volumes depending on the DeleteOnTermination setting, eliminating forensic evidence.

Answer

Assign a new security group that denies all inbound and outbound traffic.

Answer

Shut down the instance from the OS.

Answer

Terminate the instance.

Question 6

A financial services company uses AWS Organizations with over 100 accounts. The security team uses AWS CloudTrail to log all API calls to a central S3 bucket in the security account. The bucket policy enables cross-account log delivery from all member accounts. The team notices that some API calls from a specific member account are not appearing in the central bucket. The CloudTrail trail in that member account is configured to deliver logs to the central bucket. The IAM role used by CloudTrail in the member account has permissions to write to the central bucket. The security team has verified that the bucket policy allows the member account to write. What is the MOST likely cause of the missing logs?

Accepted Answer

The CloudTrail trail in the member account is not a multi-region trail.. The CloudTrail trail in the member account is likely configured as a single-region trail. A single-region trail only delivers logs for the region where it was created. If the member account has API calls in other regions, those events will not be delivered to the central S3 bucket. The IAM role and bucket policy are already verified as allowing writes, so the missing logs are most likely caused by regional coverage gaps.

Answer

The S3 bucket policy in the central bucket exceeds the size limit, causing write failures for some accounts.

Answer

The member account has not enabled CloudTrail logging for the specific region.

Answer

A service control policy (SCP) is denying the CloudTrail service in the member account from writing to the central bucket.

Question 7

A company uses AWS CloudFormation to deploy infrastructure. During a security incident, the security team needs to quickly capture a point-in-time snapshot of the entire environment for forensic analysis. The environment includes EC2 instances, RDS databases, and EBS volumes. What is the fastest way to preserve the state of the environment?

Accepted Answer

Create EBS snapshots of all EC2 instances and RDS snapshots of all databases.. Creating EBS snapshots of EC2 instances and RDS snapshots of databases captures point-in-time, crash-consistent copies of the underlying block storage, preserving the exact disk state for forensic analysis. This is the fastest method as snapshots are incremental and initiated asynchronously, allowing the environment to remain operational while the snapshot is being created.

Answer

Create Amazon Machine Images (AMIs) of all EC2 instances.

Answer

Enable AWS CloudTrail and start logging.

Answer

Export the CloudFormation stack template.

Question 8

A security engineer receives an AWS GuardDuty finding for 'UnauthorizedAccess:EC2/SSHBruteForce'. The affected EC2 instance has a public IP and is in a public subnet. What is the IMMEDIATE step to contain the threat?

Accepted Answer

Modify the network ACL to deny all inbound traffic from the attacker's IP address range.. Modify the network ACL to deny inbound traffic from the attacker's IP range immediately blocks the brute-force attempts at the subnet boundary. Security groups are allow-only and cannot deny a specific IP, so option D is invalid. NACLs support explicit deny rules, making C the correct immediate containment action.

Answer

Stop the EC2 instance to stop the brute force attempts.

Answer

Change the security group name to 'Quarantine' and remove all rules.

Answer

Update the security group to deny inbound SSH from the attacker's IP address.

Question 9

A security engineer finds this IAM policy attached to a user. The user is able to create CloudTrail trails but cannot start logging. What is the MOST likely reason?

Accepted Answer

The user lacks `iam:PassRole` permission for the CloudTrail service role.. The user can create CloudTrail trails but cannot start logging because starting logging requires the `iam:PassRole` permission to pass the CloudTrail service role to the CloudTrail service. Without this permission, CloudTrail cannot assume the role needed to write logs to the S3 bucket and deliver them to CloudWatch Logs, even though the user has `cloudtrail:CreateTrail` and `cloudtrail:StartLogging` actions in the policy.

Answer

The `StartLogging` action is not listed in the policy.

Answer

The policy does not specify the `cloudtrail:StartLogging` action.

Answer

The user does not have permission to create CloudTrail trails.

Question 10

Refer to the exhibit. A security engineer is reviewing this IAM policy attached to an IAM user. The user reports being unable to download objects from the S3 bucket when connecting from a VPN with IP address 10.0.1.45. What is the most likely reason for the failure?

Accepted Answer

The source IP 10.0.1.45 is not within the allowed range 10.0.0.0/16.. The `aws:SourceIp` condition key only evaluates public IP addresses, not private IPs (RFC 1918) like 10.0.1.45. Therefore, the condition in the policy, which likely allows access from 10.0.0.0/16, never matches for the VPN user, resulting in an implicit deny. Option C is correct because, from the perspective of the condition, the source IP is not within the allowed range.

Answer

The policy does not include an Allow effect for s3:GetObject.

Answer

The aws:SourceIp condition key is not supported for IAM user policies; it should be used with IAM role trust policies.

Answer

The policy uses the wrong action name; it should be s3:GetObjectAcl.

Question 11

A security engineer receives an alert that an EC2 instance is generating outbound traffic to a known malicious IP address. What is the FIRST step the engineer should take as part of the incident response process?

Accepted Answer

Isolate the EC2 instance by modifying the security group to deny all traffic.. The first step in incident response for a compromised EC2 instance is containment. Modifying the security group to deny all inbound and outbound traffic immediately stops communication with the malicious IP and prevents further data exfiltration or lateral movement, while preserving the instance for forensic analysis. This aligns with the NIST SP 800-61 incident response lifecycle, where containment precedes eradication and recovery.

Answer

Analyze the network traffic logs to understand the scope.

Answer

Apply the latest security patches to the EC2 instance.

Answer

Terminate the EC2 instance immediately.

Question 12

A company's security team is implementing an incident response plan for a potential ransomware attack on their EC2 instances. Which THREE steps should the team take to preserve forensic evidence while containing the incident?

Accepted Answer

Create an EBS snapshot of the root volume.. Option A is correct because creating an EBS snapshot of the root volume captures a point-in-time, block-level copy of the instance's disk that can later be attached to a forensic workstation for analysis without altering the original data. Option B is correct because creating an AMI of the compromised instance preserves the full instance configuration—including the root volume, any additional EBS volumes, and launch metadata—which is valuable for reconstructing and analyzing the compromised environment. Option C is correct because modifying the security group to deny all inbound and outbound traffic isolates the instance from the network, containing the ransomware's spread while keeping the instance running so volatile memory and state remain intact for forensics. Option D is not correct because stopping the instance discards volatile memory (RAM) contents and may alter the instance state, undermining forensic preservation. Option E is not correct because deleting the compromised instance destroys evidence and prevents any forensic investigation.

Answer

Stop the instance to preserve its state.

Answer

Delete the compromised instance immediately.

Question 13

During a security incident, a security engineer suspects that an EC2 instance has been compromised and is exfiltrating data to an external IP address. Which AWS service can provide real-time network traffic analysis and alert on unusual outbound traffic patterns?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) at the elastic network interface level. By enabling VPC Flow Logs and streaming them to Amazon CloudWatch Logs or Amazon S3, you can analyze outbound traffic patterns in near real-time using CloudWatch Logs Insights or third-party tools, and set up metric filters or alarms to detect unusual volumes to external IPs. This makes VPC Flow Logs the correct service for real-time network traffic analysis and alerting on suspicious outbound data exfiltration.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Question 14

A security engineer runs the above AWS CLI command to search for CreateKey events in CloudTrail. The command returns no events, but the security engineer knows that a KMS key was created in us-east-1 on January 1, 2023. What is the most likely reason for the empty result?

Accepted Answer

The CloudTrail trail is not multi-region and is configured in a different region. CloudTrail trails are region-specific by default. If the trail is configured only in a region other than us-east-1, it will not capture events from us-east-1, even if the security engineer is running the command from us-east-1. A multi-region trail must be explicitly enabled to log events from all AWS regions, including us-east-1.

Answer

The event name is incorrect; the correct event is 'CreateKey' but it is case-sensitive

Answer

The user does not have permission to view KMS events in CloudTrail

Answer

The time range specified is outside the retention period of CloudTrail

Question 15

A company is designing an automated incident response workflow. When a high-severity GuardDuty finding is generated, the security team wants to automatically isolate the affected EC2 instance by modifying its security group to deny all traffic. Which service should orchestrate this response?

Accepted Answer

AWS Systems Manager Automation. AWS Systems Manager Automation is the correct choice because it provides a pre-built runbook (AWS-DetachAndIsolateEC2Instance) that can be triggered by Amazon EventBridge when a GuardDuty finding is generated. This runbook automatically modifies the EC2 instance's security group to deny all traffic, effectively isolating the instance without requiring custom code. Systems Manager Automation is designed for such operational workflows, offering built-in error handling and approval steps.

Answer

AWS Lambda

Answer

AWS Config

Answer

AWS Step Functions