SCS-C02 Threat Detection and Incident Response Practice Test 4 — 15 Questions

Question 1

A security engineer is investigating a potential data exfiltration incident. The engineer suspects that an EC2 instance is sending data to an external IP address. Which TWO AWS services can provide evidence of outbound data transfer? (Select TWO.)

Accepted Answer

S3 server access logs. S3 server access logs provide detailed records of requests made to an S3 bucket, including the source IP address, request type, and bytes transferred. If the EC2 instance is exfiltrating data to an external IP by first uploading it to an S3 bucket, these logs can reveal the instance's private or public IP, the amount of data sent, and the target bucket. This makes them a valid source of evidence for outbound data transfer from the EC2 instance to S3.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 2

A security engineer is investigating a potential data exfiltration from an S3 bucket. Which AWS service should be used to analyze the VPC Flow Logs for the S3 bucket's endpoint?

Accepted Answer

Amazon Detective. Amazon Detective is the correct service because it can ingest and analyze VPC Flow Logs, including those for a VPC endpoint used to access an S3 bucket. Detective uses machine learning, statistical analysis, and graph theory to identify the root cause of suspicious network traffic patterns, such as unusual data volumes or connections to external IPs, which are indicative of data exfiltration.

Answer

Amazon Macie

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 3

During an incident response, a security team needs to capture a memory dump of an Amazon EC2 instance running Linux. What is the recommended approach?

Accepted Answer

Use AWS Systems Manager Run Command to run a script that extracts memory using LiME.. Option A is correct because AWS Systems Manager Run Command allows you to execute a script on a running EC2 instance without needing SSH access, and LiME (Linux Memory Extractor) is a trusted tool for capturing volatile memory. This approach preserves the memory state for forensic analysis while maintaining the instance's running state, which is critical for incident response.

Answer

Use Amazon Inspector to collect memory dumps.

Answer

Stop the instance and create an EBS snapshot for memory analysis.

Answer

Use the EC2 console to take a screenshot and capture memory from the hypervisor.

Question 4

A company has multiple AWS accounts in AWS Organizations. The security team wants to centralize threat detection and automate incident response. Which combination of services should they use?

Accepted Answer

GuardDuty + Amazon EventBridge + AWS Lambda. Option B is correct because GuardDuty generates threat detection findings, which are sent to Amazon EventBridge as events. EventBridge then triggers an AWS Lambda function to automate incident response actions, such as isolating an EC2 instance or revoking IAM credentials. This combination provides a fully serverless, event-driven pipeline for centralized threat detection and automated remediation across multiple AWS accounts in Organizations.

Answer

GuardDuty + Security Hub + Step Functions

Answer

Amazon Macie + AWS Config + SNS

Answer

CloudTrail + CloudWatch Logs + Lambda

Question 5

A security engineer needs to ensure that all API calls in an AWS account are logged for incident response. Which AWS service should be enabled?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made in an AWS account, including the identity of the caller, the time of the call, the source IP address, and the request parameters. This logging is essential for incident response to reconstruct events and identify unauthorized or malicious activity.

Answer

Amazon GuardDuty

Answer

VPC Flow Logs

Answer

AWS Config

Question 6

An organization uses AWS Organizations and wants to centrally manage Amazon GuardDuty across multiple accounts. What is the correct architecture?

Accepted Answer

Designate a delegated administrator account in Organizations and enable GuardDuty in that account.. Option C is correct because AWS Organizations allows you to designate a delegated administrator account for Amazon GuardDuty, which can then centrally manage GuardDuty across all member accounts in the organization. This architecture simplifies enabling GuardDuty and managing findings without needing to configure each account individually, as the delegated administrator can enable GuardDuty for all accounts in the organization from a single point.

Answer

Enable GuardDuty only in the master account; it will automatically monitor all member accounts.

Answer

Use AWS CloudFormation StackSets to deploy GuardDuty in all accounts and regions.

Answer

Enable GuardDuty in each region separately and use cross-region aggregation.

Question 7

During an incident, a security engineer needs to isolate a compromised Amazon EC2 instance without losing the ability to capture forensic data from its EBS volumes. What is the best course of action?

Accepted Answer

Take a snapshot of the EBS volumes, then detach the instance from the Auto Scaling group and modify the security group to deny all traffic.. Option B is correct because taking a snapshot of the EBS volumes preserves the forensic data before any changes occur, while detaching the instance from the Auto Scaling group prevents automatic replacement, and modifying the security group to deny all traffic isolates the instance without losing the running state or the ability to capture additional volatile data. This approach balances isolation with forensic preservation, ensuring the instance remains available for further analysis if needed.

Answer

Terminate the instance immediately and take a snapshot after termination.

Answer

Stop the instance, detach the volumes, and attach them to a forensic instance.

Answer

Change the security group to restrict traffic to only the forensic team's IP addresses.

Question 8

A company is using AWS WAF to protect a web application. The security team wants to receive alerts when a specific rule block is triggered. Which AWS service should they use to achieve this?

Accepted Answer

CloudWatch Alarms with SNS. AWS WAF integrates with Amazon CloudWatch to provide metrics for each rule, including the 'BlockedRequests' count. By creating a CloudWatch Alarm on this metric, you can trigger an SNS notification when the threshold is exceeded, alerting the security team. This is the standard pattern for receiving alerts on WAF rule actions, as CloudWatch Alarms with SNS provide the necessary monitoring and notification pipeline.

Answer

Amazon EventBridge

Answer

Amazon S3

Answer

Amazon SNS

Question 9

A security engineer needs to analyze large volumes of VPC Flow Logs stored in Amazon S3 to identify anomalous traffic patterns. Which approach is MOST cost-effective and scalable?

Accepted Answer

Use Amazon Athena with partitioned data in S3.. Amazon Athena is the most cost-effective and scalable solution for querying large volumes of VPC Flow Logs stored in S3 because it uses a serverless, pay-per-query model with no infrastructure to manage. By partitioning the data (e.g., by date or region), Athena minimizes the amount of data scanned per query, directly reducing costs while enabling complex SQL-based analysis for anomaly detection.

Answer

Use AWS Glue to catalog and query the logs.

Answer

Download the logs to an EC2 instance and use grep commands.

Answer

Use Amazon QuickSight to directly query the logs.

Question 10

An organization uses AWS Organizations with hundreds of accounts. The security team wants to automatically respond to a specific GuardDuty finding by isolating the affected EC2 instance. What is the recommended architecture?

Accepted Answer

Use EventBridge to trigger a Lambda function in the delegated administrator account, which assumes an IAM role in the affected account to isolate the instance.. Option A is correct because it follows the recommended architecture for cross-account automated response to GuardDuty findings. EventBridge in the delegated administrator account captures the finding and triggers a Lambda function, which then assumes an IAM role (using STS AssumeRole) in the affected member account to perform the isolation. This pattern centralizes management while respecting the security boundary between accounts.

Answer

Configure GuardDuty to invoke a Lambda function in the affected account directly.

Answer

Use EventBridge to send the finding to a Step Functions workflow that isolates the instance.

Answer

Use AWS Systems Manager Automation to isolate the instance across accounts.

Question 11

Which TWO AWS services can be used to detect unauthorized access to an S3 bucket? (Select TWO.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads. It uses machine learning, anomaly detection, and integrated threat intelligence to analyze S3 data events (e.g., GetObject, PutObject) logged via CloudTrail management and data events, identifying suspicious patterns such as unusual access from a known malicious IP address or an anonymous user gaining access to an S3 bucket.

Answer

AWS WAF

Answer

AWS CloudTrail

Answer

AWS Config

Question 12

Which THREE actions should be taken when preserving forensic evidence from an EC2 instance during an incident? (Select THREE.)

Accepted Answer

Create an EBS snapshot of all volumes.. Option B is correct because creating an EBS snapshot preserves the exact state of the volume at the time of the incident, including any malicious files, logs, or artifacts. This snapshot can be used for offline forensic analysis without altering the original evidence. AWS recommends this as a first step in forensic acquisition to maintain chain of custody.

Answer

Reboot the instance to clear any malicious processes.

Answer

Terminate the instance to prevent further compromise.

Question 13

Which TWO AWS services can be used to automatically block malicious IP addresses at the network perimeter? (Select TWO.)

Accepted Answer

Network ACLs. Network ACLs (NACLs) are stateless virtual firewalls that operate at the subnet level in a VPC. They can be configured with inbound and outbound rules to explicitly deny traffic from specific IP addresses, effectively blocking malicious IPs at the network perimeter before they reach the instances.

Answer

Amazon Route 53

Answer

Security Groups

Answer

AWS Shield Advanced

Question 14

A security engineer needs to detect and respond to potential credential theft where an IAM user's access key is being used from an unusual geographic location. Which AWS service should be used to generate alerts based on this anomaly?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is the correct choice because it is a threat detection service that uses machine learning and integrated threat intelligence to identify anomalous behavior, such as an IAM access key being used from an unusual geographic location. It specifically analyzes CloudTrail management and data events, VPC flow logs, and DNS logs to detect credential theft patterns like a new geolocation or an impossible travel scenario, and can trigger alerts via Amazon EventBridge or SNS for automated response.

Answer

AWS IAM Access Analyzer

Answer

AWS CloudTrail

Answer

AWS Config

Question 15

A company uses AWS Organizations with multiple accounts. The security team wants a centralized view of all security alerts and findings from services like GuardDuty, Security Hub, and Inspector across all accounts. What is the MOST efficient way to achieve this?

Accepted Answer

Use AWS Security Hub with cross-account aggregation in the management account.. AWS Security Hub is designed to aggregate findings from multiple security services (GuardDuty, Inspector, etc.) across accounts. By enabling cross-account aggregation in the management account of AWS Organizations, Security Hub provides a single, centralized dashboard for all security alerts and findings without needing to collect raw logs or build custom dashboards. This is the most efficient and native approach for a multi-account environment.

Answer

Use AWS Systems Manager OpsCenter to centrally view all security findings.

Answer

Use individual service consoles (GuardDuty, Security Hub, Inspector) for each account.

Answer

Use Amazon CloudWatch Logs to collect logs from each account and create custom dashboards.