SCS-C02 Threat Detection and Incident Response Practice Test 3 — 15 Questions

Question 1

During incident response, a security engineer needs to capture network traffic from an EC2 instance for forensic analysis. The instance is part of an Auto Scaling group. Which action preserves the most evidence while minimizing disruption?

Accepted Answer

Enable VPC Flow Logs for the subnet and analyze the logs.. Option A is correct because VPC Flow Logs capture metadata (IP addresses, ports, protocols, packet sizes) of all traffic to/from the EC2 instance at the subnet level, preserving a forensic record without any disruption to the running instance or Auto Scaling group. This approach avoids stopping, terminating, or modifying the instance, ensuring the incident environment remains intact for further investigation.

Answer

Take an EBS snapshot and analyze network logs from the snapshot.

Answer

Use AWS Traffic Mirroring to mirror traffic to a monitoring appliance.

Answer

Terminate the instance and launch a new one to capture network logs.

Question 2

Which TWO actions should a security engineer take to investigate a potential AWS API credential leak? (Choose two.)

Accepted Answer

Use AWS CloudTrail to review API calls made with the compromised keys.. AWS CloudTrail logs all API calls made within an AWS account, including those using compromised access keys. By reviewing these logs, a security engineer can identify the scope of the breach, such as which resources were accessed, from which IP addresses, and at what times. This is a critical first step in incident response to understand the impact and gather forensic evidence.

Answer

Change the IAM user's password.

Answer

Disable all AWS services in the account.

Answer

Delete the IAM user and recreate it with the same permissions.

Question 3

Which THREE services can be used to detect and alert on suspicious API activity across an AWS organization? (Choose three.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior, including suspicious API activity. It uses machine learning, anomaly detection, and integrated threat intelligence to analyze AWS CloudTrail management events, VPC Flow Logs, and DNS logs across an AWS organization, and can trigger alerts via Amazon EventBridge or Security Hub.

Answer

Amazon Inspector

Answer

AWS Config

Question 4

Which TWO are best practices for securing an AWS account's root user? (Choose two.)

Accepted Answer

Enable multi-factor authentication (MFA) on the root user.. Option C is correct because enabling multi-factor authentication (MFA) on the root user adds a second layer of security beyond the password and is the single most effective control to prevent unauthorized access to the most privileged account in an AWS environment. AWS strongly recommends MFA for the root user as it mitigates the risk of credential theft or compromise, which could lead to full account takeover and irreversible damage.

Answer

Share the root user credentials with the security team.

Answer

Delete the root user account.

Answer

Use the root user for daily administrative tasks.

Question 5

A security engineer needs to detect and alert on suspicious API calls made from a compromised EC2 instance. The instance is associated with an IAM role that has permissions to call various AWS APIs. Which AWS service should the engineer use to monitor API calls and trigger alerts?

Accepted Answer

AWS CloudTrail combined with Amazon CloudWatch Events. AWS CloudTrail records all API calls made by or on behalf of the EC2 instance's IAM role. By sending these logs to Amazon CloudWatch Events (now Amazon EventBridge), you can create rules that match specific API actions (e.g., 'ec2:TerminateInstances') and trigger alerts via SNS, Lambda, or other targets. This combination provides real-time monitoring and alerting for suspicious API activity from a compromised instance.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

VPC Flow Logs

Question 6

A company is using Amazon GuardDuty to detect threats. They notice that GuardDuty is generating a high volume of 'UnauthorizedAccess:EC2/SSHBruteForce' findings from an internal EC2 instance that is used for vulnerability scanning. The security team wants to reduce false positives without disabling GuardDuty entirely. What should they do?

Accepted Answer

Create a suppression rule for findings originating from the vulnerability scanner's IP address.. Option D is correct because Amazon GuardDuty's suppression rules allow you to filter out findings based on criteria such as IP address, without disabling the detector or any finding types. By creating a suppression rule that matches the vulnerability scanner's IP address, you automatically archive and suppress future 'UnauthorizedAccess:EC2/SSHBruteForce' findings from that specific source, reducing false positives while maintaining full threat detection coverage for all other instances.

Answer

Change the security group of the vulnerability scanner to block SSH traffic.

Answer

Disable GuardDuty for the subnet where the vulnerability scanner is located.

Answer

Disable the 'UnauthorizedAccess:EC2/SSHBruteForce' finding type in GuardDuty.

Question 7

A security engineer is investigating a potential compromise of an S3 bucket. The engineer needs to determine if any objects were accessed by an unauthorized user. Which AWS service can provide detailed access logs for S3 objects?

Accepted Answer

S3 server access logs. S3 server access logs provide detailed records of requests made to an S3 bucket, including the requester, bucket name, request time, action, and response status. This granularity is essential for identifying unauthorized access to specific objects, as it logs every GET, PUT, DELETE, and HEAD request at the object level. AWS CloudTrail, while useful for management events, does not log data-level operations like object reads by default unless data events are explicitly enabled, and even then, it may not capture all object-level access details as comprehensively as server access logs.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon Inspector

Question 8

A company uses AWS Organizations with multiple accounts. The security team wants to centrally collect and analyze CloudTrail logs from all accounts in a single S3 bucket. What is the most efficient way to achieve this?

Accepted Answer

Create a single organization trail in the management account that logs all accounts.. Option C is correct because AWS Organizations supports creating a single organization trail in the management account that automatically logs CloudTrail events for all accounts in the organization. This centralizes log collection into one S3 bucket without needing to configure trails per account, making it the most efficient and scalable approach for multi-account environments.

Answer

Create a CloudTrail trail in each account and configure the same S3 bucket as the destination.

Answer

Use CloudWatch Logs subscription filter to send logs from each account to a central account.

Answer

Use S3 cross-region replication to copy logs from each account's bucket to a central bucket.

Question 9

During an incident response, a security engineer needs to capture a forensic image of an EC2 instance's root volume for analysis. The instance is running and cannot be stopped. What is the recommended approach to capture the volume without stopping the instance?

Accepted Answer

Detach the volume from the instance, create a snapshot, and then attach it to a forensic analysis instance.. Option B is correct because detaching the root volume from a running instance is not possible without stopping it first, but the recommended approach is to create a snapshot of the attached volume while the instance is running, then use that snapshot to create a new volume and attach it to a forensic analysis instance. This ensures a point-in-time copy without halting the instance, preserving volatile data and minimizing disruption.

Answer

Use the dd command via AWS Systems Manager to create a raw image and store it in S3.

Answer

Create a snapshot while the volume is attached to the instance.

Answer

Use AWS Systems Manager to run a command that copies the volume content to S3.

Question 10

A company uses Amazon GuardDuty and receives a finding of type 'Backdoor:EC2/C&CActivity.B!DNS' for an EC2 instance. What does this finding indicate?

Accepted Answer

The instance is communicating with a known command and control server.. The finding 'Backdoor:EC2/C&CActivity.B!DNS' indicates that GuardDuty has detected DNS queries from the EC2 instance to a domain associated with known command and control (C&C) infrastructure. This is based on GuardDuty's threat intelligence feeds that map DNS request patterns to known malicious domains, signaling that the instance may be compromised and communicating with an attacker's server.

Answer

The instance is being targeted by an SSH brute force attack.

Answer

The instance is exfiltrating data to an S3 bucket.

Answer

The instance is being used in a DDoS attack.

Question 11

A security engineer is setting up automated incident response for a compromised EC2 instance. The engineer wants to isolate the instance immediately upon detection of a GuardDuty finding. Which AWS service can be used to automatically trigger a Lambda function that modifies the instance's security group?

Accepted Answer

Amazon CloudWatch Events. Amazon CloudWatch Events (now part of Amazon EventBridge) can be configured with a rule that matches specific GuardDuty finding events. When a finding is detected, the rule triggers a Lambda function that can modify the EC2 instance's security group to isolate it, for example by removing all inbound rules or replacing the group with a restrictive one. This provides the automated, event-driven response required.

Answer

AWS Step Functions

Answer

Amazon Inspector

Answer

AWS Config

Question 12

Which AWS service can be used to detect and alert on suspicious network traffic patterns within a VPC, such as port scanning or unusual outbound traffic?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors VPC Flow Logs, DNS logs, and CloudTrail events to identify suspicious network traffic patterns such as port scanning, unusual outbound traffic, and other malicious activities. It uses machine learning, anomaly detection, and integrated threat intelligence to generate security alerts without requiring manual rules or signatures.

Answer

AWS WAF

Answer

AWS Network Firewall

Answer

VPC Flow Logs

Question 13

During an incident response, a security engineer needs to preserve the state of an EC2 instance for forensic analysis. The instance is running a production workload that cannot be interrupted. Which of the following actions should the engineer take FIRST to ensure data integrity?

Accepted Answer

Use AWS Systems Manager Run Command to create a memory dump and store it in S3.. Option D is correct because during an incident response, preserving volatile data (such as memory contents) is critical before any other action that might alter the system state. AWS Systems Manager Run Command can execute a command (e.g., using `dd` or `LiME`) to capture a memory dump and store it in Amazon S3 without interrupting the production workload. This ensures that forensic artifacts like running processes, network connections, and encryption keys are preserved before any disk-level operations that could overwrite or modify evidence.

Answer

Run the dd command to clone the root volume to another EBS volume.

Answer

Create an AMI from the instance while it is running.

Answer

Take a snapshot of the attached EBS volumes while the instance is running.

Question 14

A security engineer is configuring AWS CloudTrail to monitor data events for S3 objects. Which TWO of the following must be enabled to log object-level operations? (Select TWO.)

Accepted Answer

Enable data events in the CloudTrail trail.. Option A is correct because CloudTrail data events capture S3 object-level operations such as GetObject, PutObject, and DeleteObject. To enable this, you must explicitly select 'Data events' in the CloudTrail trail configuration, as management events only cover bucket-level operations like CreateBucket.

Answer

Enable S3 server access logs on the bucket.

Answer

Enable management events in the CloudTrail trail.

Answer

Enable S3 Object Lambda.

Question 15

A company wants to implement automated remediation of security findings from Amazon GuardDuty. Which THREE AWS services can be used together to create an automated response workflow? (Select THREE.)

Accepted Answer

Amazon CloudWatch Events (EventBridge). Amazon GuardDuty sends findings to Amazon CloudWatch Events (EventBridge) as events. You can configure an EventBridge rule to match specific GuardDuty findings and trigger an AWS Lambda function for automated remediation. AWS Step Functions can orchestrate complex remediation workflows involving multiple Lambda functions or other AWS services, providing retry logic and error handling.

Answer

Amazon SQS

Answer

AWS Config