SCS-C02 Threat Detection and Incident Response Practice Test 4 — 15 Questions

Question 1

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all CloudTrail trails are enabled and logging to a central S3 bucket. They need to detect any account that disables or modifies its CloudTrail trail. Which approach meets these requirements with the least operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Config rules with an aggregator in the management account to evaluate CloudTrail configuration across all accounts.. AWS Config rules with an aggregator in the management account can evaluate CloudTrail configuration across all accounts in AWS Organizations without deploying per-account resources. The aggregator collects configuration snapshots and changes from member accounts, allowing a single managed rule (e.g., cloud-trail-enabled) to detect when a trail is disabled or modified. This approach minimizes operational overhead because it uses native AWS services with no custom code or cross-account IAM roles to manage.

Answer

Enable CloudTrail Insights in all accounts to detect unusual activity.

Answer

Enable IAM Access Analyzer in each account to monitor CloudTrail changes.

Answer

Create a Lambda function that periodically checks CloudTrail status in each account via the API.

Question 2

A company uses Amazon GuardDuty and AWS Security Hub. The security team wants to automatically remediate high-severity GuardDuty findings that indicate an EC2 instance is communicating with a known command and control (C&C) server. The remediation should isolate the instance by modifying the security group to deny all inbound and outbound traffic. Which solution is the most efficient?

Accepted Answer

Send Security Hub findings to Amazon EventBridge, which triggers a Lambda function to modify the security group.. It leverages Security Hub as a central aggregation point for GuardDuty findings, then uses EventBridge to trigger a Lambda function that modifies the security group. This is the most efficient architecture as Security Hub normalizes findings from multiple sources, and EventBridge provides reliable, low-latency event routing to Lambda for custom remediation logic without requiring direct GuardDuty-to-security-group integration.

Answer

Use Amazon CloudWatch Events to directly modify the security group when a GuardDuty finding is published.

Answer

Configure GuardDuty to automatically update the security group when a finding is generated.

Answer

Create an AWS Config rule that triggers a Lambda function when a security group change is detected.

Question 3

During an incident response, a security engineer needs to collect volatile data from an EC2 instance running Linux. The instance is in a private subnet with no direct internet access. The engineer has IAM permissions to use AWS Systems Manager Session Manager. Which command should the engineer use to capture memory and process information?

Accepted Answer

aws ssm start-session --target i-1234567890abcdef0 --document-name AWS-StartInteractiveCommand. AWS Systems Manager Session Manager with the AWS-StartInteractiveCommand document allows the security engineer to establish an interactive shell session to the EC2 instance without requiring direct internet access, SSH keys, or a bastion host. From this interactive session, the engineer can run native Linux commands like 'cat /proc/meminfo' or 'ps aux' to capture volatile memory and process information directly, which is the appropriate method for collecting volatile data during incident response.

Answer

aws ec2 get-console-output --instance-id i-1234567890abcdef0

Answer

aws ssm send-command --instance-ids i-1234567890abcdef0 --document-name AWS-RunShellScript --parameters commands='volatility -f /dev/mem imageinfo'

Answer

aws ec2-instance-connect send-ssh-public-key --instance-id i-1234567890abcdef0 --instance-os-user ec2-user --ssh-public-key file://key.pub

Question 4

A security engineer needs to detect suspicious API calls across multiple AWS accounts. The engineer has enabled AWS CloudTrail in each account and is sending logs to a central S3 bucket. Which additional step should the engineer take to analyze the logs for potential threats?

Accepted Answer

Enable Amazon GuardDuty in each account.. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, including suspicious API calls, by analyzing CloudTrail management and data events, VPC Flow Logs, and DNS logs. By enabling GuardDuty in each account, the security engineer can automatically detect potential threats across all accounts without manual log analysis. This directly addresses the need to analyze CloudTrail logs for suspicious API calls at scale.

Answer

Enable AWS Config rules to monitor CloudTrail configuration.

Answer

Enable AWS Trusted Advisor in the management account.

Answer

Enable VPC Flow Logs in each account.

Question 5

A company's security policy requires that all S3 bucket access logs be delivered to a central S3 bucket in the security account. A security engineer notices that some buckets are not delivering logs. The engineer needs to identify which buckets are not logging and ensure compliance. Which service should the engineer use to continuously monitor and report on S3 bucket logging?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired policies. By using an AWS Config managed rule like `s3-bucket-logging-enabled`, the security engineer can automatically detect S3 buckets that do not have logging enabled and receive compliance notifications, ensuring ongoing adherence to the security policy.

Answer

Amazon Macie

Answer

Amazon S3 Inventory

Answer

AWS CloudTrail

Question 6

A security engineer is investigating a potential data breach. The engineer needs to identify which IAM user accessed a specific S3 object and when. Which AWS service should the engineer use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity for all AWS services, including S3 object-level operations such as GetObject, PutObject, and DeleteObject. By enabling data events on the specific S3 bucket, CloudTrail logs the IAM user, source IP, timestamp, and the exact object key accessed, providing the precise identity and time needed for breach investigation.

Answer

AWS Config

Answer

Amazon S3 server access logs

Answer

Amazon CloudWatch Logs

Question 7

A company uses Amazon GuardDuty and has enabled EKS audit logs as a data source. The security team wants to detect potential container escape attempts. Which TWO findings would indicate a container escape attempt? (Choose TWO.)

Accepted Answer

PrivilegeEscalation:EKS/KubernetesAPICallFromContainer. The PrivilegeEscalation:EKS/KubernetesAPICallFromContainer finding specifically detects when a container makes Kubernetes API calls that indicate an attempt to escalate privileges, such as creating pods with elevated permissions or accessing cluster-admin roles. This is a direct indicator of a container escape attempt, as the container is interacting with the Kubernetes control plane to gain unauthorized access to the host or other resources.

Answer

Execution:ECS/SuspiciousCommand

Answer

UnauthorizedAccess:EC2/SSHBruteForce

Answer

CryptoCurrency:EC2/BitcoinTool.B

Question 8

A security engineer is configuring automated incident response for Amazon GuardDuty findings. The engineer wants to isolate a compromised EC2 instance by changing its security group and stopping the instance. Which THREE services should the engineer use together to achieve this? (Choose THREE.)

Accepted Answer

AWS Systems Manager. AWS Systems Manager (SSM) is correct because it provides the Automation runbook capability that can be used to stop an EC2 instance and modify its security groups as part of an incident response workflow. SSM Automation can be triggered by an EventBridge rule and can invoke Lambda functions or run commands directly on the instance to isolate it. This allows the security engineer to automate the isolation and stopping of the compromised instance without manual intervention.

Answer

Amazon EC2

Answer

AWS Config

Question 9

A company wants to detect and respond to potential security threats in near real-time. Which TWO services should the company use together to achieve this? (Choose TWO.)

Accepted Answer

AWS Security Hub. AWS Security Hub (D) aggregates security findings from multiple AWS services, including Amazon GuardDuty, and provides a comprehensive view of security alerts and compliance status. Amazon GuardDuty (E) is a threat detection service that continuously monitors for malicious activity and unauthorized behavior using machine learning and integrated threat intelligence. Together, they enable near real-time detection and response by centralizing findings from GuardDuty in Security Hub, which can trigger automated remediation workflows via Amazon EventBridge.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 10

Refer to the exhibit. A security engineer is reviewing a resource-based policy attached to an AWS Lambda function. The engineer notices that the policy allows any Lambda function in the account to invoke the function. Which security concern should the engineer address?

Accepted Answer

The policy allows invocation from any Lambda function across all AWS accounts.. The resource-based policy on the Lambda function uses a principal of `*` without any condition key (such as `aws:SourceAccount` or `aws:SourceArn`) to restrict invocation to only the same account. This means any Lambda function in any AWS account can invoke this function, which is a security concern as it allows cross-account invocation without authorization.

Answer

The policy grants excessive permissions by allowing all actions.

Answer

The policy does not specify a resource ARN, so it applies to all functions.

Answer

The policy allows the Lambda service to modify the function code.

Question 11

Refer to the exhibit. A security engineer runs the AWS CLI command to look up console login events. The output shows two successful login events for user1 within 5 minutes. What should the engineer suspect?

Accepted Answer

The user's credentials may be compromised.. Two successful console login events for the same user within 5 minutes, especially from different source IP addresses or user agents, is a strong indicator of credential compromise. An attacker who has obtained the user's password can log in while the legitimate user is also active, creating overlapping sessions. AWS CloudTrail records the `ConsoleLogin` event with details like `sourceIPAddress` and `userAgent`, which the engineer should examine to confirm whether the logins originated from different locations or devices.

Answer

The user created a new access key.

Answer

The user's account is being used by multiple users.

Answer

The user has disabled multi-factor authentication (MFA).

Question 12

Refer to the exhibit. A security engineer is reviewing an S3 bucket policy. The policy is intended to allow access only from the corporate network (10.0.0.0/8). What is a potential security issue with this policy?

Accepted Answer

The policy allows anonymous access from the specified IP range.. The policy's `Principal: "*"` element allows anonymous access from any IP address, and the `Condition` block only restricts the source IP to 10.0.0.0/8. This means any unauthenticated request originating from within the corporate network (10.0.0.0/8) is permitted, effectively granting anonymous access to the S3 bucket. The intended goal of restricting access to authenticated corporate users is not achieved, as no `aws:userid` or `aws:username` condition is enforced.

Answer

The policy grants access to all actions, not just GetObject.

Answer

The policy resource is incorrect; it should be the bucket ARN without the /*.

Answer

The policy does not include a condition to require MFA.

Question 13

A security engineer is reviewing CloudTrail logs and notices API calls from an unknown IP address. The engineer needs to immediately block the IP address and receive alerts for any future suspicious activity. Which combination of actions should the engineer take?

Accepted Answer

Add the IP address to a VPC NACL with a DENY rule and update a CloudWatch metric filter to create an alarm on the IP address.. VPC Network ACLs (NACLs) are stateless and can explicitly deny traffic from a specific IP address at the subnet level, providing immediate blocking without affecting existing security group rules. A CloudWatch metric filter on CloudTrail logs can trigger an alarm for any future API calls from that IP, enabling proactive alerting. This combination addresses both the immediate blocking and ongoing monitoring requirements.

Answer

Create an AWS WAF IP set and associate it with the CloudFront distribution. Configure CloudFront to block the IP.

Answer

Add the IP address to a security group with a DENY rule and enable AWS Security Hub to send alerts.

Answer

Revoke IAM permissions for the user associated with the IP and enable GuardDuty for alerting.

Question 14

A company uses AWS Organizations and has enabled GuardDuty in the management account. The security team wants to view GuardDuty findings for all member accounts from a single delegated administrator account. Which configuration step is required?

Accepted Answer

Designate a delegated administrator account in Organizations, then enable GuardDuty in that account. GuardDuty will automatically aggregate findings from member accounts.. AWS Organizations allows you to designate a delegated administrator account for GuardDuty, which can then manage and view findings from all member accounts without needing to enable GuardDuty individually in each account. Once the delegated administrator is set up, GuardDuty automatically aggregates findings from all member accounts in the organization, providing a single-pane-of-glass view for the security team.

Answer

Enable GuardDuty in each member account and configure cross-account IAM roles to aggregate findings in the management account.

Answer

Enable GuardDuty only in the management account and share findings via CloudWatch Logs cross-account subscription.

Answer

Enable GuardDuty in the management account and use CloudWatch cross-account dashboard to view findings from member accounts.

Question 15

During a security incident, a security engineer needs to capture network traffic between an EC2 instance and an attacker's IP address for forensic analysis. The engineer has already identified the attacker's IP from CloudTrail logs. Which action captures the traffic without affecting the instance?

Accepted Answer

Create a VPC Traffic Mirroring session targeting the instance's ENI and mirror the traffic to a Network Load Balancer for capture.. VPC Traffic Mirroring captures all network traffic at the Elastic Network Interface (ENI) level without any performance impact or configuration change on the EC2 instance itself. It copies the traffic to a Network Load Balancer (NLB) or another target for capture and analysis, making it ideal for forensic investigation without disrupting the running instance.

Answer

Update the network ACL to log all traffic to and from the attacker's IP.

Answer

Enable VPC Flow Logs on the subnet and query logs for the attacker's IP.

Answer

SSH into the instance and run tcpdump with a filter for the attacker's IP.