SCS-C02 Threat Detection and Incident Response Practice Test 3 — 15 Questions

Question 1

A security engineer is investigating a potential data exfiltration from an S3 bucket. The engineer has enabled S3 server access logs and CloudTrail data events. Which log source would provide the most granular details about the request, including the requester's IP address and user agent?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon S3 server access logs. Amazon S3 server access logs provide detailed records of requests made to an S3 bucket, including the requester's IP address, user agent, request URI, HTTP status, and error codes. This granularity makes them the best source for investigating data exfiltration, as they capture per-request metadata that CloudTrail data events and VPC Flow Logs do not.

Answer

VPC Flow Logs

Answer

AWS CloudTrail data events

Answer

Amazon CloudWatch Logs

Question 2

A security engineer notices that an EC2 instance is sending outbound traffic to a known malicious IP address. The engineer needs to quickly block all traffic to that IP while preserving the instance for forensic analysis. Which approach is the most effective?

Accepted Answer

Add a network ACL rule to deny outbound traffic from the instance's subnet to the malicious IP.. Modifying the network ACL to deny outbound traffic to the malicious IP is the most effective approach. Network ACLs are stateless and can explicitly deny traffic, applying at the subnet level. This blocks the traffic immediately while preserving the instance for forensic analysis, as it does not require stopping the instance or affecting its state.

Answer

Stop the instance immediately.

Answer

Modify the instance's security group to deny outbound traffic to the malicious IP.

Answer

Modify the route table to route traffic to the malicious IP to a blackhole.

Question 3

Which TWO AWS services can be used to detect anomalous behavior in an AWS environment?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty (B) is correct because it is a managed threat-detection service that continuously analyzes VPC Flow Logs, AWS CloudTrail management and S3 data events, and DNS logs using machine learning and threat intelligence to identify anomalous and malicious behavior such as cryptocurrency mining, credential compromise, and reconnaissance. AWS Security Hub (E) is correct because it aggregates and correlates findings from GuardDuty, Inspector, Macie, Firewall Manager, and partner tools, applying automated security checks and insights that surface anomalous or suspicious activity across accounts and Regions. AWS Config (A) is incorrect because it records resource configuration changes and evaluates compliance against rules, not behavioral anomalies. AWS CloudTrail (C) is incorrect because it only logs API activity for auditing and governance; it does not itself detect anomalies. Amazon Inspector (D) is incorrect because it performs automated vulnerability management scans on EC2 instances, container images, and Lambda functions rather than detecting anomalous behavior.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 4

Refer to the exhibit. A security engineer is reviewing an S3 bucket policy. The policy is intended to allow read access to objects in the bucket only from the corporate network (203.0.113.0/24). However, users outside the network can still access the bucket. What is the most likely reason?

Accepted Answer

The bucket policy does not include an explicit Deny statement for IP addresses outside the allowed range.. The bucket policy only grants read access to requests originating from the corporate network (203.0.113.0/24) using an Allow effect with a condition. This Allow statement does not explicitly deny other IP addresses. If there are other applicable Allow permissions (e.g., from IAM user policies or a bucket ACL), they can still allow access from outside the network. To restrict access only to the corporate network, add an explicit Deny for s3:GetObject when aws:SourceIp is not in 203.0.113.0/24.

Answer

The s3:GetObject action is misspelled; it should be s3:GetObjectVersion.

Answer

The condition key should be aws:SourceIp instead of aws:SourceIp.

Answer

The bucket policy must be attached to the bucket's ACL instead.

Question 5

A company uses a multi-account AWS Organizations setup with hundreds of accounts. The security team uses AWS Security Hub in the management account to aggregate findings from all accounts. They have configured Amazon GuardDuty in all accounts and enabled AWS Config with recording. Recently, they noticed that Security Hub is not displaying any findings from GuardDuty in member accounts, even though GuardDuty is generating sample findings. The security team has verified that the Security Hub integration with GuardDuty is enabled in the management account. What is the most likely reason for the missing findings?

Accepted Answer

The member accounts have not enabled the integration between GuardDuty and Security Hub.. In a multi-account AWS Organizations setup, Security Hub in the management account aggregates findings from member accounts only if each member account has explicitly enabled the integration between GuardDuty and Security Hub. Even if GuardDuty is generating sample findings in member accounts, Security Hub will not display those findings unless the member account has enabled the GuardDuty-to-SecurityHub integration (via the Security Hub console or API). The management account enabling the integration does not automatically propagate the integration to member accounts.

Answer

The IAM role for Security Hub in the management account lacks permissions to read findings from member accounts.

Answer

AWS Security Hub is not enabled in the member accounts.

Answer

Amazon GuardDuty is not enabled in the member accounts.

Question 6

A company uses AWS Lambda functions that process sensitive data. The security team wants to ensure that any unauthorized invocation of the functions is detected and alerted. The team has enabled AWS CloudTrail and is monitoring for Lambda Invoke API calls. However, they are concerned about missing events that occur within the Lambda service itself (e.g., internal retries). What should the team do to capture all relevant events?

Accepted Answer

Enable CloudTrail data events for Lambda functions.. To detect unauthorized invocations, you need to capture the Invoke API calls that initiate Lambda executions. CloudTrail data events for Lambda functions record each Invoke API call, including caller identity, source IP, and timestamp. Lambda Insights is a performance monitoring tool and does not provide security audit details. Internal retries are not separate unauthorized invocations, so they are not relevant here.

Answer

Enable VPC Flow Logs for the Lambda function's VPC.

Answer

Configure CloudWatch Logs to capture all Lambda function logs.

Answer

Enable Amazon CloudWatch Lambda Insights.

Question 7

A company uses AWS Lambda functions to process data from an S3 bucket. The security team wants to detect any unauthorized attempts to invoke the Lambda function from outside the company's VPC. The Lambda function is configured to be VPC-enabled and is attached to a VPC with a security group. The team has enabled CloudTrail and VPC Flow Logs. However, they are not seeing any logs for the Lambda invocations in CloudTrail. The team has checked that CloudTrail is logging management events and that the Lambda function is being invoked. What is the most likely reason for the missing CloudTrail logs?

Accepted Answer

CloudTrail is not logging Lambda Invoke API calls because they are data events, not management events.. CloudTrail management events do not include Lambda Invoke API calls because these are data events, not management events. To log Lambda invocations, data events must be explicitly enabled in the CloudTrail trail configuration. Option B is incorrect because Lambda functions do not need to be configured to send logs to CloudTrail; CloudTrail automatically captures API calls if configured. Option C is incorrect as the issue is not about configuring data events; the question states data events are not enabled. Option D is incorrect because VPC Flow Logs capture network traffic, not Lambda invocations.

Answer

The Lambda function is not configured to send logs to CloudTrail.

Answer

The CloudTrail trail is not configured to log data events for Lambda.

Answer

VPC Flow Logs are not enabled for the Lambda function's VPC.

Question 8

A security engineer at a financial services company is reviewing AWS CloudTrail logs in a centralized security account. The engineer notices a series of API calls from an unfamiliar IAM role in a member account that attempted to modify S3 bucket policies and disable AWS Config recording. The engineer needs to quickly determine if these actions were authorized and, if not, initiate containment. Which AWS service should the engineer use FIRST to correlate the suspicious API activity with related findings and get a prioritized incident view?

Accepted Answer

AWS Security Hub. AWS Security Hub aggregates findings from GuardDuty, AWS Config, IAM Access Analyzer, and other services into a single, prioritized view. This allows the security engineer to quickly see the suspicious IAM role activity in context with related findings, assess whether the actions were authorized, and initiate containment. Other services like CloudTrail Insights, Amazon Detective, and AWS Config provide valuable data but do not offer the same centralized, prioritized incident correlation.

Answer

AWS CloudTrail Insights

Answer

AWS Config

Answer

Amazon Detective

Question 9

A security engineer is investigating a suspected compromise of an AWS account. The engineer needs to determine which IAM principal initiated a specific API call and from which IP address, but the account has CloudTrail management events enabled only in the current Region. The API call in question was made to a service endpoint in a different Region. What should the engineer do to obtain this information?

Accepted Answer

Check the CloudTrail event history in the other Region, because the event history provides 90 days of management event records for the Region where the API call was made.. CloudTrail event history is scoped per Region and retains 90 days of management events. When an API call is made to a service endpoint in a different Region, the event is recorded in that Region's event history. Switching to the correct Region allows the engineer to retrieve the event details, including the principal and source IP, without needing a pre-existing trail.

Answer

Query Amazon CloudWatch Logs Insights against the CloudTrail log group for the other Region, because CloudTrail automatically delivers all management events to a single log group.

Answer

Use AWS CloudTrail Lake to run a query against the event data store, because CloudTrail Lake automatically ingests events from all Regions regardless of trail configuration.

Answer

Enable a multi-Region trail in CloudTrail and then query the trail's S3 bucket for the event, because the event was already recorded by the service in the other Region.

Question 10

A security engineer is configuring an automated response to a GuardDuty finding indicating that an EC2 instance is communicating with a known malicious IP address. The engineer wants to isolate the instance by replacing its security group with a restrictive one that allows only outbound traffic to a forensic analysis server, while preserving the instance's current state for later investigation. Which combination of steps should the engineer take to achieve this with minimal disruption?

Accepted Answer

Create a new security group with the required restrictive rules, then use AWS Lambda to modify the instance's network interfaces to associate the new security group, and remove the old security group.. The most effective way to isolate an EC2 instance while preserving its state is to replace its security group with a restrictive one that allows only necessary outbound traffic. This can be automated with AWS Lambda by modifying the instance's network interfaces. Stopping the instance, modifying local firewall rules, or detaching network interfaces all disrupt the instance or fail to provide robust network isolation. The correct approach maintains the instance's runtime state for forensic analysis while cutting off malicious communication.

Answer

Use AWS Systems Manager Session Manager to run a script on the instance that modifies the local firewall rules to block all traffic except to the forensic server.

Answer

Stop the instance, create an AMI, and then launch a new instance from the AMI with the restrictive security group.

Answer

Detach the instance's network interface and attach it to a new instance in a quarantine subnet, then apply a restrictive security group to the new instance.

Question 11

A security team is building an automated incident response solution for Amazon EC2 instances flagged by Amazon GuardDuty. The team wants to isolate a compromised instance while preserving forensic evidence. The instance is in a private subnet with no internet gateway. The team needs to capture memory and disk artifacts before terminating the instance. Which TWO actions should the team take to meet these requirements? (Choose two.)

Accepted Answer

Create an Amazon EBS snapshot of the instance's root volume and attach it to a forensic workstation for analysis.. To preserve both disk and memory evidence from a compromised EC2 instance in a private subnet, the team should snapshot the root volume for disk analysis and use Session Manager to capture memory without network exposure. These actions allow isolation while retaining forensic artifacts. Stopping the instance or detaching the root volume would lose volatile memory and may not be supported while running.

Answer

Detach the root volume from the running instance and attach it to another instance for analysis.

Answer

Modify the instance's security group to allow all outbound traffic so that forensic tools can upload data to an external server.

Answer

Stop the instance and then create an AMI from it to preserve the memory state.

Question 12

A security analyst is investigating a potential security incident in an AWS account. The analyst needs to collect and preserve volatile evidence from a running EC2 instance before isolating it. Which TWO actions should the analyst take to capture volatile data in a forensically sound manner? (Choose two.)

Accepted Answer

Capture the instance's memory using a tool like LiME or AVML and store the memory dump in an S3 bucket with versioning enabled.. To capture volatile evidence from a running EC2 instance, the analyst should capture memory using a tool like LiME or AVML and store it in a secure, versioned S3 bucket. Additionally, taking EBS snapshots of all attached volumes preserves disk-based evidence. These actions ensure that both volatile and non-volatile data are preserved for forensic analysis. Stopping the instance or relying solely on script outputs or CloudTrail logs would result in loss of critical volatile evidence.

Answer

Enable AWS CloudTrail data events for the instance's EBS volumes to log all read and write operations.

Answer

Use AWS Systems Manager Run Command to execute a script that lists all running processes and network connections, and save the output to a file on the instance's root volume.

Answer

Stop the instance immediately to prevent further malicious activity, then create an AMI from the stopped instance.

Question 13

A security engineer is configuring an AWS Lambda function to automatically remediate Amazon GuardDuty findings. The engineer wants the function to be triggered only for findings with a severity of HIGH or CRITICAL. The engineer creates an Amazon EventBridge rule with an event pattern that filters on the GuardDuty finding severity. However, the function is not being invoked. What is the most likely cause?

Accepted Answer

The EventBridge event pattern is using the wrong field name for severity; GuardDuty findings use 'severity' as a number, not a string, and the pattern must match the numeric value.. GuardDuty findings are published to EventBridge with severity as a numeric value. An event pattern that expects a string such as 'HIGH' will not match. The correct pattern uses numeric comparison, for example, matching severity greater than or equal to 7. This explains why the Lambda function is not invoked despite the rule being created.

Answer

The EventBridge rule is missing the required IAM role to invoke the Lambda function.

Answer

GuardDuty findings are not delivered to EventBridge by default; the engineer must enable the 'Findings export' option in GuardDuty settings.

Answer

The Lambda function's execution role lacks permissions to read GuardDuty findings.

Question 14

A security engineer is investigating an incident where an IAM user's access key was compromised and used to launch a large number of EC2 instances for cryptocurrency mining. The engineer has revoked the access key and terminated the instances. To prevent similar incidents, the engineer wants to implement a detective control that alerts on anomalous IAM user behavior, such as unusual API calls or spikes in resource creation. Which AWS service should the engineer use to achieve this?

Accepted Answer

AWS CloudTrail Insights. AWS CloudTrail Insights analyzes management events to establish a baseline of normal API activity and then detects unusual patterns, such as spikes in resource creation or unusual API call rates. This makes it ideal for detecting anomalous IAM user behavior indicative of compromised credentials. While GuardDuty can also detect some IAM anomalies, CloudTrail Insights is purpose-built for operational anomaly detection. Trusted Advisor and Security Hub do not provide this specific detection capability.

Answer

AWS Security Hub

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 15

A security engineer is configuring an AWS environment to detect and respond to potential security threats. Which AWS service can be used to automate the remediation of unwanted access to Amazon S3 buckets by invoking AWS Lambda functions?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads. It can integrate with AWS Lambda functions via CloudWatch Events to automate remediation actions, such as blocking unwanted access to S3 buckets by updating bucket policies or removing public access. This makes GuardDuty the correct choice for detecting and automatically responding to security threats against S3 resources.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS WAF