SCS-C02 Threat Detection and Incident Response Practice Test 2 — 15 Questions

Question 1

A security engineer is reviewing a CloudTrail log entry (exhibit). What is the most immediate security concern indicated by this event?

Accepted Answer

A security group rule was added allowing SSH access from any IP address.. The CloudTrail log shows an AuthorizeSecurityGroupIngress API call that added a security group rule with the CIDR 0.0.0.0/0 for port 22 (SSH). This effectively opens SSH access to the entire internet, creating a severe exposure that could allow any attacker to attempt brute-force or credential-stuffing attacks against any EC2 instance associated with that security group. This is the most immediate security concern because it directly introduces a wide-open attack surface.

Answer

The source IP address 203.0.113.5 is from a known malicious IP range.

Answer

The API call was made from the AWS CLI, which may indicate a compromised access key.

Answer

The user JohnDoe did not use multi-factor authentication (MFA) for this API call.

Question 2

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB) in a VPC. The security team uses Amazon GuardDuty and has enabled Amazon Detective. Recently, GuardDuty raised a 'Recon:EC2/PortProbeUnprotectedPort' finding for one of the instances. The security engineer verified that the ALB security group only allows inbound HTTP/HTTPS from the internet. However, the finding indicates that the instance is receiving probes on port 22 (SSH). Further investigation with Detective shows that the probes originate from multiple IP addresses and are reaching the instance's private IP address. The engineer suspects that the SSH port is exposed despite the security group configuration. What is the MOST likely cause of this exposure?

Accepted Answer

The EC2 instance's security group allows inbound SSH from 0.0.0.0/0.. The GuardDuty finding 'Recon:EC2/PortProbeUnprotectedPort' indicates that an EC2 instance is receiving unsolicited probes on a port that should not be publicly accessible. Since the ALB security group only allows HTTP/HTTPS from the internet, but the probes are reaching the instance's private IP on port 22 (SSH), the most likely cause is that the instance's own security group has an inbound rule allowing SSH from 0.0.0.0/0. This bypasses the ALB's security group because the instance's security group is evaluated independently for direct traffic to the instance's private IP, and if it permits SSH from anywhere, the probes will reach the instance.

Answer

VPC Flow Logs are misconfigured and are inadvertently forwarding traffic to the instance.

Answer

AWS Shield Advanced is causing false positives by marking legitimate traffic as probes.

Answer

The ALB security group has an inbound rule that allows SSH from the internet.

Question 3

A security engineer is investigating a potential compromise. An EC2 instance running Amazon Linux 2 is sending outbound traffic to a known malicious IP address. The engineer needs to capture the network traffic for analysis without alerting the attacker. Which solution meets these requirements?

Accepted Answer

Use VPC Traffic Mirroring to mirror the EC2 instance's ENI traffic to a monitoring appliance in a separate VPC.. Option C is correct because VPC Traffic Mirroring captures all network traffic at the packet level from the EC2 instance's Elastic Network Interface (ENI) and forwards it to a monitoring appliance without any inline processing or modification of the traffic. This allows the security engineer to perform deep packet analysis while remaining completely transparent to the attacker, as the mirrored traffic is a copy and does not affect the original flow. Unlike other options, Traffic Mirroring provides full packet capture (including headers and payloads) for forensic analysis, which is essential for investigating a compromise.

Answer

Enable VPC Flow Logs on the ENI and stream to Amazon S3 for analysis.

Answer

Attach a security group to the instance that logs all traffic to CloudWatch Logs.

Answer

Enable AWS Network Firewall on the VPC and configure a rule to log all traffic to the malicious IP.

Question 4

Drag and drop the steps to configure AWS WAF with rate-based rules in the correct order.

Question 5

Drag and drop the steps to implement a secure CI/CD pipeline with AWS CodePipeline and IAM in the correct order.

Question 6

Match each AWS service to its primary security function.

Question 7

Match each AWS IAM policy type to its description.

Question 8

A security engineer notices that an IAM role used by an EC2 instance is generating a large number of API calls to an S3 bucket that is not part of the company's account. Which AWS service should be used to detect and alert on this suspicious activity?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is the correct service because it uses machine learning and anomaly detection to analyze AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs. It can detect unusual API calls, such as an EC2 instance role making a high volume of requests to an S3 bucket outside the company's account, which is a classic indicator of compromised credentials or data exfiltration. GuardDuty generates findings and can integrate with Amazon CloudWatch Events to trigger alerts or automated remediation.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Config

Question 9

A company has an AWS Lambda function that processes sensitive data. The security team wants to ensure that any errors or suspicious behavior are immediately investigated. Which combination of services should be used to send real-time notifications for anomalous function executions?

Accepted Answer

CloudWatch Logs and SNS. Option A is correct because CloudWatch Logs can capture Lambda function execution logs, and a CloudWatch Logs metric filter can be configured to detect patterns indicative of errors or suspicious behavior (e.g., 'ERROR', 'Exception', or custom anomaly patterns). When the metric filter triggers a CloudWatch alarm, it can publish a message directly to an Amazon SNS topic, which then sends real-time notifications (e.g., email, SMS, or HTTP endpoint) to the security team for immediate investigation.

Answer

CloudTrail and SNS

Answer

AWS Config and SQS

Answer

Amazon Detective and SES

Question 10

During a security incident, a security engineer needs to preserve forensic evidence from an EC2 instance that may be compromised. The instance is running a critical application. Which approach minimizes data loss while ensuring the integrity of the evidence?

Accepted Answer

Create an EBS snapshot, then isolate the instance by modifying the security group and removing it from the load balancer.. Option A is correct because creating an EBS snapshot preserves the disk state at the point of the incident, capturing forensic evidence without altering the running instance. Isolating the instance by modifying the security group (e.g., removing all inbound/outbound rules) and removing it from the load balancer stops network traffic and prevents further compromise, minimizing data loss while maintaining the integrity of the evidence for later analysis.

Answer

Immediately terminate the instance to stop any ongoing malicious activity.

Answer

SSH into the instance and run forensic tools to capture memory.

Answer

Detach the instance from the Auto Scaling group and leave it running without changes.

Question 11

A company's security team wants to detect unauthorized S3 bucket access attempts in real time. Which service should they use to generate alerts when an IAM user attempts to access a bucket without proper permissions?

Accepted Answer

AWS CloudTrail with CloudWatch alarms. AWS CloudTrail logs all API calls made to S3, including access denied errors. By creating a CloudWatch alarm on the `S3 AccessDenied` event in CloudTrail logs, the security team can receive real-time alerts when an IAM user attempts to access a bucket without proper permissions. This approach directly captures the unauthorized attempt at the API level, enabling immediate detection.

Answer

Amazon GuardDuty

Answer

S3 server access logs

Answer

AWS Config

Question 12

An organization uses AWS Organizations with multiple accounts. The security team needs a centralized location to collect and analyze security findings from GuardDuty, Inspector, and Macie. Which AWS service should they use?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct service because it provides a centralized view of security alerts and compliance status across multiple AWS accounts. It aggregates findings from GuardDuty, Inspector, and Macie, normalizing them into the AWS Security Finding Format (ASFF), enabling the security team to analyze and prioritize threats in a single dashboard.

Answer

Amazon Detective

Answer

Amazon CloudWatch

Answer

AWS Config

Question 13

A security engineer is investigating a potential compromise of an EC2 instance. The instance was launched from a custom AMI. The engineer needs to determine if the AMI itself contains malicious software. Which approach provides the most thorough analysis without risking the production environment?

Accepted Answer

Launch a test instance from the AMI in an isolated VPC and run Amazon Inspector.. Option A is correct because launching a test instance from the AMI in an isolated VPC allows you to run Amazon Inspector, which performs automated vulnerability assessments and network reachability checks against the instance. This approach provides a thorough analysis of the AMI's software and configuration without exposing the production environment to any potential malicious activity. Amazon Inspector uses a knowledge base of common vulnerabilities and exposures (CVEs) and CIS benchmarks to identify security issues, making it effective for detecting malicious software embedded in the AMI.

Answer

Use AWS Systems Manager to run a compliance scan on the running instance.

Answer

Create an EBS snapshot from the AMI and scan the snapshot with Amazon Detective.

Answer

Launch a test instance from the AMI in an isolated VPC and analyze its behavior.

Question 14

A company wants to ensure that any deleted CloudTrail logs are detected and alerted within minutes. Which approach should they use?

Accepted Answer

Configure CloudTrail to send logs to CloudWatch Logs, create a metric filter for DeleteTrail events, and set a CloudWatch alarm to send an SNS notification.. Option B is correct because CloudTrail management events (including DeleteTrail) are delivered to CloudWatch Logs, where a metric filter can match the exact event name. A CloudWatch alarm on that metric triggers an SNS notification within minutes, meeting the detection and alerting requirement. This approach directly monitors the CloudTrail API call that deletes the trail itself, not just the log files.

Answer

Enable S3 event notifications on the CloudTrail bucket for DELETE events.

Answer

Use AWS Config to track CloudTrail configuration changes and trigger a Lambda function.

Answer

Enable Amazon GuardDuty to monitor CloudTrail management events.

Question 15

A security team discovers that an IAM user's credentials are being used from an unusual geographic location. Which AWS service can provide automated response to revoke the user's access immediately?

Accepted Answer

AWS Systems Manager Automation. AWS Systems Manager Automation is correct because it can be triggered by Amazon GuardDuty findings (e.g., UnauthorizedAccess:IAMUser/AnomalousBehavior) via Amazon EventBridge to run an automation document that immediately revokes the IAM user's access keys and applies a deny-all policy. This provides a fully automated, low-latency response without requiring manual intervention or custom code.

Answer

Amazon GuardDuty

Answer

AWS Lambda

Answer

AWS Config

SCS-C02 Threat Detection and Incident Response Practice Test 2 — 15 Questions

Exhibit

SCS-C02 Threat Detection and Incident Response Practice Test 2 — 15 Questions

Exhibit