SCS-C02 Threat Detection and Incident Response Practice Test 5 — 15 Questions

Question 1

A security engineer is configuring automated incident response for an Amazon EC2 instance that has been compromised. The engineer needs to isolate the instance while preserving forensic data. Which solution meets these requirements?

Accepted Answer

Create an AMI of the instance, then remove the instance from the security group to isolate it.. Option C is correct because creating an AMI preserves the EBS volumes and their forensic data, while removing the instance from the security group effectively isolates it by denying all network traffic. This approach allows the engineer to later launch a forensic instance from the AMI in a controlled environment for analysis, without losing the compromised instance's state.

Answer

Detach the EBS volumes and attach them to a new instance in a different VPC.

Answer

Terminate the instance immediately to prevent further damage.

Answer

Stop the instance and change the security group to deny all traffic.

Question 2

A company has enabled AWS CloudTrail and wants to receive real-time notifications when specific API calls, such as DeleteTrail, are made. Which service should be used to trigger an alert based on CloudTrail log events?

Accepted Answer

Amazon CloudWatch Events / Amazon EventBridge. Amazon CloudWatch Events (now part of Amazon EventBridge) is the correct service to trigger real-time alerts based on CloudTrail log events. You can create a rule that matches specific API calls, such as DeleteTrail, and route the event to a target like an SNS topic or Lambda function for immediate notification. CloudTrail delivers log events to CloudWatch Logs, and EventBridge can directly consume those events for pattern matching and alerting.

Answer

AWS CloudTrail console notifications

Answer

Amazon VPC Flow Logs

Answer

Amazon S3 event notifications

Question 3

During a security review, a security engineer notices that an S3 bucket contains sensitive data but has a bucket policy that allows access from any principal in the account. The engineer needs to identify any unintended cross-account access to this bucket. Which AWS service should be used?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer helps identify resources that are shared with external principals by analyzing resource-based policies (like S3 bucket policies). In this scenario, the bucket policy allows access from any principal in the account, but IAM Access Analyzer can detect if the policy also grants access to principals outside the AWS account (cross-account access). It generates findings for any policy that allows access from an external entity, making it the correct service to identify unintended cross-account access.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon Macie

Question 4

A security engineer suspects that an EC2 instance is communicating with a known malicious IP address. The engineer needs to capture the full network packets for analysis. Which approach should be taken?

Accepted Answer

Use VPC Traffic Mirroring to mirror the instance's ENI to a monitoring appliance.. VPC Traffic Mirroring captures and copies all network traffic from an EC2 instance's Elastic Network Interface (ENI) and forwards it to a monitoring appliance (e.g., a security appliance or packet analyzer) for full packet-level analysis. This is the only option that provides raw, full network packets (including headers and payloads) without impacting the instance's performance or requiring software installation on the instance itself.

Answer

Enable AWS Security Hub to detect and capture malicious traffic.

Answer

Install the Amazon CloudWatch agent on the instance to capture network logs.

Answer

Enable VPC Flow Logs on the subnet and analyze the logs.

Question 5

A company wants to automatically trigger a Lambda function when a new security finding is generated in AWS Security Hub. Which service should be used to invoke the Lambda function?

Accepted Answer

Amazon EventBridge. Amazon EventBridge is the correct service because AWS Security Hub automatically sends all findings to the default EventBridge bus as events. You can create an EventBridge rule that matches the 'Security Hub Findings - Imported' event pattern and targets a Lambda function for invocation. This is the native, recommended integration for event-driven responses to Security Hub findings.

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS Security Hub itself

Answer

AWS CloudTrail

Question 6

A security engineer is investigating a potential data exfiltration from an S3 bucket that is configured to allow public access. The engineer wants to determine who accessed the bucket and from which IP addresses. Which AWS capability should be used?

Accepted Answer

AWS CloudTrail data events for S3. AWS CloudTrail data events for S3 capture detailed API activity at the object level, including GetObject, PutObject, and DeleteObject calls. This allows the security engineer to identify exactly who accessed the bucket (via the user identity) and from which IP address (via the sourceIPAddress field in the CloudTrail event). Unlike management events, data events must be explicitly enabled and provide the granularity needed for this investigation.

Answer

Amazon S3 server access logs

Answer

AWS IAM Access Analyzer

Answer

Amazon VPC Flow Logs

Question 7

A company uses AWS Systems Manager Patch Manager to apply patches to EC2 instances. The security team wants to ensure that instances are patched within 7 days of a patch release. Which service should be used to monitor and report compliance?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of your AWS resource configurations, including patch compliance status via Systems Manager Patch Manager. You can create an AWS Config rule (e.g., 'ec2-managedinstance-patch-compliance-status') that checks whether instances have the required patches installed within a specified time frame (e.g., 7 days). AWS Config then reports noncompliant resources, enabling the security team to track and remediate patching gaps.

Answer

AWS Security Hub

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 8

A security engineer is designing a threat detection solution for a multi-account AWS environment. The engineer needs to detect and respond to suspicious API activity across all accounts. Which TWO services should be used together to achieve this? (Choose two.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior across AWS accounts, including suspicious API activity. By enabling GuardDuty in all accounts and aggregating findings to a central administrator account, it provides the necessary detection layer for multi-account environments.

Answer

Amazon CloudWatch

Answer

Amazon Inspector

Answer

AWS Config

Question 9

A security engineer is investigating a security incident where an EC2 instance was used to launch an outbound denial-of-service (DoS) attack. The engineer needs to collect forensic evidence. Which THREE actions should the engineer take? (Choose three.)

Accepted Answer

Create an Amazon EBS snapshot of the instance's root volume.. Option C is correct because creating an Amazon EBS snapshot of the instance's root volume preserves the file system, logs, binaries, and any persistent artifacts (e.g., malware scripts, modified configuration files) at the time of the incident. This snapshot can be used for offline forensic analysis without altering the original evidence, which is critical for incident response and potential legal proceedings.

Answer

Reboot the instance to clear any malicious processes.

Answer

Delete the CloudTrail logs that show the instance's API calls.

Answer

Terminate the instance to stop the attack immediately.

Question 10

A company wants to ensure that all API calls made to AWS are logged for security analysis. Which TWO services can be used to achieve this? (Choose two.)

Accepted Answer

Amazon S3 server access logs. Amazon S3 server access logs capture detailed records of requests made to an S3 bucket, including the requester, bucket name, request time, and action. This enables security analysis of API calls specifically targeting S3 resources. AWS CloudTrail records all API calls made to the AWS Management Console, SDKs, and CLI across the entire AWS account, providing a comprehensive audit trail for security analysis.

Answer

Amazon VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 11

Refer to the exhibit. A security engineer reviews an S3 bucket policy that is intended to allow the root user of account 123456789012 to get objects only from the 10.0.0.0/24 IP range. However, the policy is not working as expected. What is the MOST likely reason?

Accepted Answer

The condition should use 'aws:VpcSourceIp' instead of 'aws:SourceIp' when requests come through a VPC endpoint.. Option C is correct because when requests to an S3 bucket originate from a VPC endpoint (such as a gateway VPC endpoint for S3), the source IP address is translated to the private IP of the VPC endpoint, and the `aws:SourceIp` condition key cannot be used to evaluate the original client IP. Instead, you must use the `aws:VpcSourceIp` condition key to restrict access based on the IP address of the VPC endpoint. The policy as written would fail to match any requests coming through the VPC endpoint, causing the intended restriction to not work.

Answer

The principal is set to root, which cannot be used in bucket policies.

Answer

The resource ARN is incorrect because it should include the bucket name without /*.

Answer

The condition key 'aws:SourceIp' is not supported for S3 bucket policies.

Question 12

Refer to the exhibit. A security engineer is analyzing a CloudTrail log entry for an EC2 RunInstances call. The engineer needs to determine if the instance launch was authorized by an IAM policy. Which field should the engineer check to identify the IAM policy that was used to authorize the action?

Accepted Answer

The 'userIdentity' field to identify the IAM user or role that made the call.. The 'userIdentity' field in a CloudTrail log entry contains details about the IAM user or role that made the API call, including the ARN and the access key ID. To identify the specific IAM policy that authorized the action, the security engineer must first know the identity (user/role) from the 'userIdentity' field, then cross-reference that identity with the IAM policies attached to it. The policy itself is not directly listed in the log entry, but the identity is the key to tracing authorization.

Answer

The 'vpcEndpointId' field to see if the call came through a VPC endpoint.

Answer

The 'sourceIP' field to identify the IP address.

Answer

The 'eventType' field to determine the type of event.

Question 13

Refer to the exhibit. A security engineer is analyzing VPC Flow Logs and notices a pattern of outbound traffic from an EC2 instance to an external IP on port 22 (SSH). The engineer wants to identify which instances are initiating SSH connections to the internet. Which field in the flow log record indicates the source of the connection?

Accepted Answer

The first IP address in the log entry (srcaddr). In VPC Flow Logs, the `srcaddr` field records the source IP address of the traffic. Since the engineer is looking for which EC2 instances are initiating outbound SSH connections (port 22), the source IP in the flow log entry (srcaddr) directly identifies the instance that started the connection. The direction of the traffic is determined by the source and destination fields, not by the port numbers alone.

Answer

The second IP address (dstaddr)

Answer

The first port number (srcport)

Answer

The second port number (dstport)

Question 14

A security engineer notices that an EC2 instance is sending outbound traffic to a known malicious IP address. The engineer needs to immediately block the traffic and capture a packet capture for forensic analysis. Which combination of actions should the engineer take?

Accepted Answer

Add a network ACL deny rule for the malicious IP, and enable VPC Traffic Mirroring.. Option B is correct because a network ACL (NACL) is a stateless firewall that operates at the subnet level, allowing immediate blocking of traffic to/from a specific IP address without affecting the instance's security group rules. Enabling VPC Traffic Mirroring captures a full packet-level copy of the traffic for forensic analysis, which is superior to VPC Flow Logs (which only capture metadata). This combination provides both rapid containment and deep forensic data.

Answer

Use Amazon GuardDuty to block the IP and enable VPC Traffic Mirroring.

Answer

Stop the EC2 instance and enable VPC Flow Logs.

Answer

Modify the security group to deny outbound traffic to the IP, and enable VPC Flow Logs.

Question 15

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all CloudTrail trails are enabled and logging to a central S3 bucket. They need to detect any account that disables or modifies its CloudTrail trail. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Use AWS Config rules with an aggregator in the management account to evaluate CloudTrail configuration across all accounts.. AWS Config rules with an aggregator in the management account can evaluate CloudTrail configuration across all accounts in AWS Organizations without deploying per-account resources. The aggregator collects configuration snapshots and changes from member accounts, allowing a single managed rule (e.g., cloud-trail-enabled) to detect when a trail is disabled or modified. This approach minimizes operational overhead because it uses native AWS services with no custom code or cross-account IAM roles to manage.

Answer

Enable CloudTrail Insights in all accounts to detect unusual activity.

Answer

Enable IAM Access Analyzer in each account to monitor CloudTrail changes.

Answer

Create a Lambda function that periodically checks CloudTrail status in each account via the API.