SCS-C02 Threat Detection and Incident Response Practice Test 3 — 15 Questions

Question 1

During an incident response, a security engineer needs to capture a forensic image of an EC2 instance's root volume for analysis. The instance is running and cannot be stopped. What is the recommended approach to capture the volume without stopping the instance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a snapshot while the volume is attached to the instance.. The correct approach is to create a snapshot of the EBS root volume while it is still attached to the running instance (Option C). Snapshots can be taken of in-use volumes without stopping the instance, providing a point-in-time copy for forensic analysis. Option B is incorrect because you cannot detach the root volume of a running instance without first stopping it, which contradicts the requirement not to stop the instance.

Answer

Use the dd command via AWS Systems Manager to create a raw image and store it in S3.

Answer

Detach the volume from the instance, create a snapshot, and then attach it to a forensic analysis instance.

Answer

Use AWS Systems Manager to run a command that copies the volume content to S3.

Question 2

A security engineer is setting up automated incident response for a compromised EC2 instance. The engineer wants to isolate the instance immediately upon detection of a GuardDuty finding. Which AWS service can be used to automatically trigger a Lambda function that modifies the instance's security group?

Accepted Answer

Amazon CloudWatch Events. Amazon CloudWatch Events (now part of Amazon EventBridge) can be configured with a rule that matches specific GuardDuty finding events. When a finding is detected, the rule triggers a Lambda function that can modify the EC2 instance's security group to isolate it, for example by removing all inbound rules or replacing the group with a restrictive one. This provides the automated, event-driven response required.

Answer

AWS Step Functions

Answer

Amazon Inspector

Answer

AWS Config

Question 3

Which AWS service can be used to detect and alert on suspicious network traffic patterns within a VPC, such as port scanning or unusual outbound traffic?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors VPC Flow Logs, DNS logs, and CloudTrail events to identify suspicious network traffic patterns such as port scanning, unusual outbound traffic, and other malicious activities. It uses machine learning, anomaly detection, and integrated threat intelligence to generate security alerts without requiring manual rules or signatures.

Answer

AWS WAF

Answer

AWS Network Firewall

Answer

VPC Flow Logs

Question 4

During an incident response, a security engineer needs to capture a forensic image of an EC2 instance's root volume for analysis. The instance is running and cannot be stopped. What is the recommended approach to capture the volume without stopping the instance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Systems Manager Run Command to create a memory dump and store it in S3.. During an incident response, preserving volatile data (such as memory contents) is critical before any other action that might alter the system state. AWS Systems Manager Run Command can execute a command (e.g., using `dd` or `LiME`) to capture a memory dump and store it in Amazon S3 without interrupting the production workload. This ensures that forensic artifacts like running processes, network connections, and encryption keys are preserved before any disk-level operations that could overwrite or modify evidence.

Answer

Run the dd command to clone the root volume to another EBS volume.

Answer

Create an AMI from the instance while it is running.

Answer

Take a snapshot of the attached EBS volumes while the instance is running.

Question 5

A security engineer is configuring AWS CloudTrail to monitor data events for S3 objects. Which TWO of the following must be enabled to log object-level operations? (Select TWO.)

Accepted Answer

Enable data events in the CloudTrail trail.. CloudTrail data events capture S3 object-level operations such as GetObject, PutObject, and DeleteObject. To enable this, you must explicitly select 'Data events' in the CloudTrail trail configuration, as management events only cover bucket-level operations like CreateBucket.

Answer

Enable S3 server access logs on the bucket.

Answer

Enable management events in the CloudTrail trail.

Answer

Enable S3 Object Lambda.

Question 6

A company wants to implement automated remediation of security findings from Amazon GuardDuty. Which THREE AWS services can be used together to create an automated response workflow? (Select THREE.)

Accepted Answer

Amazon CloudWatch Events (EventBridge). Amazon GuardDuty sends findings to Amazon CloudWatch Events (EventBridge) as events. You can configure an EventBridge rule to match specific GuardDuty findings and trigger an AWS Lambda function for automated remediation. AWS Step Functions can orchestrate complex remediation workflows involving multiple Lambda functions or other AWS services, providing retry logic and error handling.

Answer

Amazon SQS

Answer

AWS Config

Question 7

A security engineer is investigating a potential data exfiltration incident. The engineer suspects that an EC2 instance is sending data to an external IP address. Which TWO AWS services can provide evidence of outbound data transfer? (Select TWO.)

Accepted Answer

S3 server access logs. S3 server access logs provide detailed records of requests made to an S3 bucket, including the source IP address, request type, and bytes transferred. If the EC2 instance is exfiltrating data to an external IP by first uploading it to an S3 bucket, these logs can reveal the instance's private or public IP, the amount of data sent, and the target bucket. This makes them a valid source of evidence for outbound data transfer from the EC2 instance to S3.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 8

A security engineer is investigating a potential data exfiltration from an S3 bucket. Which AWS service should be used to analyze the VPC Flow Logs for the S3 bucket's endpoint?

Accepted Answer

Amazon Detective. Amazon Detective is the correct service because it can ingest and analyze VPC Flow Logs, including those for a VPC endpoint used to access an S3 bucket. Detective uses machine learning, statistical analysis, and graph theory to identify the root cause of suspicious network traffic patterns, such as unusual data volumes or connections to external IPs, which are indicative of data exfiltration.

Answer

Amazon Macie

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 9

During an incident response, a security team needs to capture a memory dump of an Amazon EC2 instance running Linux. What is the recommended approach?

Accepted Answer

Use AWS Systems Manager Run Command to run a script that extracts memory using LiME.. AWS Systems Manager Run Command allows you to execute a script on a running EC2 instance without needing SSH access, and LiME (Linux Memory Extractor) is a trusted tool for capturing volatile memory. This approach preserves the memory state for forensic analysis while maintaining the instance's running state, which is critical for incident response.

Answer

Use Amazon Inspector to collect memory dumps.

Answer

Stop the instance and create an EBS snapshot for memory analysis.

Answer

Use the EC2 console to take a screenshot and capture memory from the hypervisor.

Question 10

A company has multiple AWS accounts in AWS Organizations. The security team wants to centralize threat detection and automate incident response. Which combination of services should they use?

Accepted Answer

GuardDuty + Amazon EventBridge + AWS Lambda. GuardDuty generates threat detection findings, which are sent to Amazon EventBridge as events. EventBridge then triggers an AWS Lambda function to automate incident response actions, such as isolating an EC2 instance or revoking IAM credentials. This combination provides a fully serverless, event-driven pipeline for centralized threat detection and automated remediation across multiple AWS accounts in Organizations.

Answer

GuardDuty + Security Hub + Step Functions

Answer

Amazon Macie + AWS Config + SNS

Answer

CloudTrail + CloudWatch Logs + Lambda

Question 11

A security engineer needs to ensure that all API calls in an AWS account are logged for incident response. Which AWS service should be enabled?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made in an AWS account, including the identity of the caller, the time of the call, the source IP address, and the request parameters. This logging is essential for incident response to reconstruct events and identify unauthorized or malicious activity.

Answer

Amazon GuardDuty

Answer

VPC Flow Logs

Answer

AWS Config

Question 12

An organization uses AWS Organizations and wants to centrally manage Amazon GuardDuty across multiple accounts. What is the correct architecture?

Accepted Answer

Designate a delegated administrator account in Organizations and enable GuardDuty in that account.. AWS Organizations allows you to designate a delegated administrator account for Amazon GuardDuty, which can then centrally manage GuardDuty across all member accounts in the organization. This architecture simplifies enabling GuardDuty and managing findings without needing to configure each account individually, as the delegated administrator can enable GuardDuty for all accounts in the organization from a single point.

Answer

Enable GuardDuty only in the master account; it will automatically monitor all member accounts.

Answer

Use AWS CloudFormation StackSets to deploy GuardDuty in all accounts and regions.

Answer

Enable GuardDuty in each region separately and use cross-region aggregation.

Question 13

During an incident, a security engineer needs to isolate a compromised Amazon EC2 instance without losing the ability to capture forensic data from its EBS volumes. What is the best course of action?

Accepted Answer

Take a snapshot of the EBS volumes, then detach the instance from the Auto Scaling group and modify the security group to deny all traffic.. Taking a snapshot of the EBS volumes preserves the forensic data before any changes occur, while detaching the instance from the Auto Scaling group prevents automatic replacement, and modifying the security group to deny all traffic isolates the instance without losing the running state or the ability to capture additional volatile data. This approach balances isolation with forensic preservation, ensuring the instance remains available for further analysis if needed.

Answer

Terminate the instance immediately and take a snapshot after termination.

Answer

Stop the instance, detach the volumes, and attach them to a forensic instance.

Answer

Change the security group to restrict traffic to only the forensic team's IP addresses.

Question 14

A company is using AWS WAF to protect a web application. The security team wants to receive alerts when a specific rule block is triggered. Which AWS service should they use to achieve this?

Accepted Answer

CloudWatch Alarms with SNS. AWS WAF integrates with Amazon CloudWatch to provide metrics for each rule, including the 'BlockedRequests' count. By creating a CloudWatch Alarm on this metric, you can trigger an SNS notification when the threshold is exceeded, alerting the security team. This is the standard pattern for receiving alerts on WAF rule actions, as CloudWatch Alarms with SNS provide the necessary monitoring and notification pipeline.

Answer

Amazon EventBridge

Answer

Amazon S3

Answer

Amazon SNS

Question 15

A security engineer needs to analyze large volumes of VPC Flow Logs stored in Amazon S3 to identify anomalous traffic patterns. Which approach is MOST cost-effective and scalable?

Accepted Answer

Use Amazon Athena with partitioned data in S3.. Amazon Athena is the most cost-effective and scalable solution for querying large volumes of VPC Flow Logs stored in S3 because it uses a serverless, pay-per-query model with no infrastructure to manage. By partitioning the data (e.g., by date or region), Athena minimizes the amount of data scanned per query, directly reducing costs while enabling complex SQL-based analysis for anomaly detection.

Answer

Use AWS Glue to catalog and query the logs.

Answer

Download the logs to an EC2 instance and use grep commands.

Answer

Use Amazon QuickSight to directly query the logs.