SCS-C02 Threat Detection and Incident Response Practice Test 5 — 15 Questions

Question 1

Drag and drop the steps to implement a secure CI/CD pipeline with AWS CodePipeline and IAM in the correct order.

Accepted Answer

First, create IAM roles with least privilege for CodePipeline and CodeBuild. Then, create an encrypted S3 bucket for storing artifacts. Next, create a source repository (e.g., AWS CodeCommit). After that, create a build project configured with security scanning tools. Finally, create the CodePipeline that integrates the source, build, and deployment stages.. Secure pipeline requires encrypted artifact bucket, IAM roles, source repo, build project with security scanning, and pipeline.

Answer

First, create an encrypted S3 bucket. Then, create a source repository. Next, create IAM roles. After that, create a build project with security scanning. Finally, create the pipeline.

Answer

First, create the pipeline. Then, create a source repository. Next, create a build project with security scanning. After that, create IAM roles. Finally, create an encrypted S3 bucket.

Answer

First, create a source repository. Then, create a build project with security scanning. Next, create IAM roles. After that, create the pipeline. Finally, create an encrypted S3 bucket.

Question 2

Match each AWS service to its primary security function.

Accepted Answer

AWS WAF: Web application firewall that protects against common web exploits.. These are core AWS security services with distinct purposes.

Answer

AWS WAF: Managed DDoS protection service.

Answer

AWS Shield: Threat detection service.

Question 3

A security engineer notices that an IAM role used by an EC2 instance is generating a large number of API calls to an S3 bucket that is not part of the company's account. Which AWS service should be used to detect and alert on this suspicious activity?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is the correct service because it uses machine learning and anomaly detection to analyze AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs. It can detect unusual API calls, such as an EC2 instance role making a high volume of requests to an S3 bucket outside the company's account, which is a classic indicator of compromised credentials or data exfiltration. GuardDuty generates findings and can integrate with Amazon CloudWatch Events to trigger alerts or automated remediation.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Config

Question 4

A company has an AWS Lambda function that processes sensitive data. The security team wants to ensure that any errors or suspicious behavior are immediately investigated. Which combination of services should be used to send real-time notifications for anomalous function executions?

Accepted Answer

CloudWatch Logs and SNS. CloudWatch Logs can capture Lambda function execution logs, and a CloudWatch Logs metric filter can be configured to detect patterns indicative of errors or suspicious behavior (e.g., 'ERROR', 'Exception', or custom anomaly patterns). When the metric filter triggers a CloudWatch alarm, it can publish a message directly to an Amazon SNS topic, which then sends real-time notifications (e.g., email, SMS, or HTTP endpoint) to the security team for immediate investigation.

Answer

CloudTrail and SNS

Answer

AWS Config and SQS

Answer

Amazon Detective and SES

Question 5

During a security incident, a security engineer needs to preserve forensic evidence from an EC2 instance that may be compromised. The instance is running a critical application. Which approach minimizes data loss while ensuring the integrity of the evidence?

Accepted Answer

Create an EBS snapshot, then isolate the instance by modifying the security group and removing it from the load balancer.. Creating an EBS snapshot preserves the disk state at the point of the incident, capturing forensic evidence without altering the running instance. Isolating the instance by modifying the security group (e.g., removing all inbound/outbound rules) and removing it from the load balancer stops network traffic and prevents further compromise, minimizing data loss while maintaining the integrity of the evidence for later analysis.

Answer

Immediately terminate the instance to stop any ongoing malicious activity.

Answer

SSH into the instance and run forensic tools to capture memory.

Answer

Detach the instance from the Auto Scaling group and leave it running without changes.

Question 6

A company's security team wants to detect unauthorized S3 bucket access attempts in real time. Which service should they use to generate alerts when an IAM user attempts to access a bucket without proper permissions?

Accepted Answer

AWS CloudTrail with CloudWatch alarms. AWS CloudTrail logs all API calls made to S3, including access denied errors. By creating a CloudWatch alarm on the `S3 AccessDenied` event in CloudTrail logs, the security team can receive real-time alerts when an IAM user attempts to access a bucket without proper permissions. This approach directly captures the unauthorized attempt at the API level, enabling immediate detection.

Answer

Amazon GuardDuty

Answer

S3 server access logs

Answer

AWS Config

Question 7

An organization uses AWS Organizations with multiple accounts. The security team needs a centralized location to collect and analyze security findings from GuardDuty, Inspector, and Macie. Which AWS service should they use?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct service because it provides a centralized view of security alerts and compliance status across multiple AWS accounts. It aggregates findings from GuardDuty, Inspector, and Macie, normalizing them into the AWS Security Finding Format (ASFF), enabling the security team to analyze and prioritize threats in a single dashboard.

Answer

Amazon Detective

Answer

Amazon CloudWatch

Answer

AWS Config

Question 8

A security engineer is investigating a potential compromise of an EC2 instance. The instance was launched from a custom AMI. The engineer needs to determine if the AMI itself contains malicious software. Which approach provides the most thorough analysis without risking the production environment?

Accepted Answer

Launch a test instance from the AMI in an isolated VPC and run Amazon Inspector.. Launching a test instance from the AMI in an isolated VPC allows you to run Amazon Inspector, which performs automated vulnerability assessments and network reachability checks against the instance. This approach provides a thorough analysis of the AMI's software and configuration without exposing the production environment to any potential malicious activity. Amazon Inspector uses a knowledge base of common vulnerabilities and exposures (CVEs) and CIS benchmarks to identify security issues, making it effective for detecting malicious software embedded in the AMI.

Answer

Use AWS Systems Manager to run a compliance scan on the running instance.

Answer

Create an EBS snapshot from the AMI and scan the snapshot with Amazon Detective.

Answer

Launch a test instance from the AMI in an isolated VPC and analyze its behavior.

Question 9

A security team discovers that an IAM user's credentials are being used from an unusual geographic location. Which AWS service can provide automated response to revoke the user's access immediately?

Accepted Answer

AWS Systems Manager Automation. AWS Systems Manager Automation is correct because it can be triggered by Amazon GuardDuty findings (e.g., UnauthorizedAccess:IAMUser/AnomalousBehavior) via Amazon EventBridge to run an automation document that immediately revokes the IAM user's access keys and applies a deny-all policy. This provides a fully automated, low-latency response without requiring manual intervention or custom code.

Answer

Amazon GuardDuty

Answer

AWS Lambda

Answer

AWS Config

Question 10

Which TWO actions should a security engineer take to investigate a potential AWS API credential leak? (Choose two.)

Accepted Answer

Use AWS CloudTrail to review API calls made with the compromised keys.. AWS CloudTrail logs all API calls made within an AWS account, including those using compromised access keys. By reviewing these logs, a security engineer can identify the scope of the breach, such as which resources were accessed, from which IP addresses, and at what times. This is a critical first step in incident response to understand the impact and gather forensic evidence.

Answer

Change the IAM user's password.

Answer

Disable all AWS services in the account.

Answer

Delete the IAM user and recreate it with the same permissions.

Question 11

Which THREE services can be used to detect and alert on suspicious API activity across an AWS organization? (Choose three.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior, including suspicious API activity. It uses machine learning, anomaly detection, and integrated threat intelligence to analyze AWS CloudTrail management events, VPC Flow Logs, and DNS logs across an AWS organization, and can trigger alerts via Amazon EventBridge or Security Hub.

Answer

Amazon Inspector

Answer

AWS Config

Question 12

Which TWO are best practices for securing an AWS account's root user? (Choose two.)

Accepted Answer

Enable multi-factor authentication (MFA) on the root user.. Enabling multi-factor authentication (MFA) on the root user adds a second layer of security beyond the password and is the single most effective control to prevent unauthorized access to the most privileged account in an AWS environment. AWS strongly recommends MFA for the root user as it mitigates the risk of credential theft or compromise, which could lead to full account takeover and irreversible damage.

Answer

Share the root user credentials with the security team.

Answer

Delete the root user account.

Answer

Use the root user for daily administrative tasks.

Question 13

A security engineer needs to detect and alert on suspicious API calls made from a compromised EC2 instance. The instance is associated with an IAM role that has permissions to call various AWS APIs. Which AWS service should the engineer use to monitor API calls and trigger alerts?

Accepted Answer

AWS CloudTrail combined with Amazon CloudWatch Events. AWS CloudTrail records all API calls made by or on behalf of the EC2 instance's IAM role. By sending these logs to Amazon CloudWatch Events (now Amazon EventBridge), you can create rules that match specific API actions (e.g., 'ec2:TerminateInstances') and trigger alerts via SNS, Lambda, or other targets. This combination provides real-time monitoring and alerting for suspicious API activity from a compromised instance.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

VPC Flow Logs

Question 14

A company is using Amazon GuardDuty to detect threats. They notice that GuardDuty is generating a high volume of 'UnauthorizedAccess:EC2/SSHBruteForce' findings from an internal EC2 instance that is used for vulnerability scanning. The security team wants to reduce false positives without disabling GuardDuty entirely. What should they do?

Accepted Answer

Create a suppression rule for findings originating from the vulnerability scanner's IP address.. Amazon GuardDuty's suppression rules allow you to filter out findings based on criteria such as IP address, without disabling the detector or any finding types. By creating a suppression rule that matches the vulnerability scanner's IP address, you automatically archive and suppress future 'UnauthorizedAccess:EC2/SSHBruteForce' findings from that specific source, reducing false positives while maintaining full threat detection coverage for all other instances.

Answer

Change the security group of the vulnerability scanner to block SSH traffic.

Answer

Disable GuardDuty for the subnet where the vulnerability scanner is located.

Answer

Disable the 'UnauthorizedAccess:EC2/SSHBruteForce' finding type in GuardDuty.

Question 15

A security engineer is investigating a potential compromise of an S3 bucket. The engineer needs to determine if any objects were accessed by an unauthorized user. Which AWS service can provide detailed access logs for S3 objects?

Accepted Answer

S3 server access logs. S3 server access logs provide detailed records of requests made to an S3 bucket, including the requester, bucket name, request time, action, and response status. This granularity is essential for identifying unauthorized access to specific objects, as it logs every GET, PUT, DELETE, and HEAD request at the object level. AWS CloudTrail, while useful for management events, does not log data-level operations like object reads by default unless data events are explicitly enabled, and even then, it may not capture all object-level access details as comprehensively as server access logs.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon Inspector