SCS-C02 Threat Detection and Incident Response Practice Test 6 — 15 Questions

Question 1

A security engineer is investigating a potential compromise of an EC2 instance. The engineer wants to capture memory and disk forensics without shutting down the instance. Which service should the engineer use?

Accepted Answer

AWS Systems Manager. AWS Systems Manager (SSM) is the correct service because it provides the capability to perform forensic data collection on a running EC2 instance without shutting it down. Specifically, SSM Automation documents like AWS-RunShellScript or AWS-GatherEC2InstanceInfo can execute commands to capture memory (e.g., using LiME or fmem) and disk forensics (e.g., dd or volume snapshots) via the SSM Agent, which runs as a system service and does not require instance termination.

Answer

AWS Config

Answer

EC2 Instance Connect

Answer

Amazon CloudWatch Logs

Question 2

A company uses Amazon GuardDuty and AWS Security Hub. The security team wants to automatically remediate high-severity GuardDuty findings that indicate an EC2 instance is communicating with a known command and control (C&C) server. The remediation should isolate the instance by modifying the security group to deny all inbound and outbound traffic. Which solution is the most efficient?

Accepted Answer

Send Security Hub findings to Amazon EventBridge, which triggers a Lambda function to modify the security group.. Option B is correct because it leverages Security Hub as a central aggregation point for GuardDuty findings, then uses EventBridge to trigger a Lambda function that modifies the security group. This is the most efficient architecture as Security Hub normalizes findings from multiple sources, and EventBridge provides reliable, low-latency event routing to Lambda for custom remediation logic without requiring direct GuardDuty-to-security-group integration.

Answer

Use Amazon CloudWatch Events to directly modify the security group when a GuardDuty finding is published.

Answer

Configure GuardDuty to automatically update the security group when a finding is generated.

Answer

Create an AWS Config rule that triggers a Lambda function when a security group change is detected.

Question 3

During an incident response, a security engineer needs to collect volatile data from an EC2 instance running Linux. The instance is in a private subnet with no direct internet access. The engineer has IAM permissions to use AWS Systems Manager Session Manager. Which command should the engineer use to capture memory and process information?

Accepted Answer

aws ssm start-session --target i-1234567890abcdef0 --document-name AWS-StartInteractiveCommand. Option D is correct because AWS Systems Manager Session Manager with the AWS-StartInteractiveCommand document allows the security engineer to establish an interactive shell session to the EC2 instance without requiring direct internet access, SSH keys, or a bastion host. From this interactive session, the engineer can run native Linux commands like 'cat /proc/meminfo' or 'ps aux' to capture volatile memory and process information directly, which is the appropriate method for collecting volatile data during incident response.

Answer

aws ec2 get-console-output --instance-id i-1234567890abcdef0

Answer

aws ssm send-command --instance-ids i-1234567890abcdef0 --document-name AWS-RunShellScript --parameters commands='volatility -f /dev/mem imageinfo'

Answer

aws ec2-instance-connect send-ssh-public-key --instance-id i-1234567890abcdef0 --instance-os-user ec2-user --ssh-public-key file://key.pub

Question 4

A security engineer needs to detect suspicious API calls across multiple AWS accounts. The engineer has enabled AWS CloudTrail in each account and is sending logs to a central S3 bucket. Which additional step should the engineer take to analyze the logs for potential threats?

Accepted Answer

Enable Amazon GuardDuty in each account.. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, including suspicious API calls, by analyzing CloudTrail management and data events, VPC Flow Logs, and DNS logs. By enabling GuardDuty in each account, the security engineer can automatically detect potential threats across all accounts without manual log analysis. This directly addresses the need to analyze CloudTrail logs for suspicious API calls at scale.

Answer

Enable AWS Config rules to monitor CloudTrail configuration.

Answer

Enable AWS Trusted Advisor in the management account.

Answer

Enable VPC Flow Logs in each account.

Question 5

A company's security policy requires that all S3 bucket access logs be delivered to a central S3 bucket in the security account. A security engineer notices that some buckets are not delivering logs. The engineer needs to identify which buckets are not logging and ensure compliance. Which service should the engineer use to continuously monitor and report on S3 bucket logging?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired policies. By using an AWS Config managed rule like `s3-bucket-logging-enabled`, the security engineer can automatically detect S3 buckets that do not have logging enabled and receive compliance notifications, ensuring ongoing adherence to the security policy.

Answer

Amazon Macie

Answer

Amazon S3 Inventory

Answer

AWS CloudTrail

Question 6

A security engineer is designing an incident response plan for a containerized application running on Amazon ECS with Fargate. The engineer needs to ensure that if a container is compromised, the incident response team can capture a memory dump and disk snapshot for forensic analysis. The containers are stateless and use ephemeral storage. Which approach provides the necessary forensic data?

Accepted Answer

Use ECS Exec to access the container and capture a memory dump; snapshot the task's ephemeral storage.. Option C is correct because ECS Exec allows interactive access to a running container without stopping it, enabling the capture of a memory dump (e.g., via `gcore` or `/proc/kcore`). Additionally, the task's ephemeral storage can be snapshotted while the container is still running, preserving disk state for forensic analysis. This approach aligns with incident response best practices for stateless containers on Fargate, where traditional host-level forensics are unavailable.

Answer

Configure the container to stream /dev/mem to CloudWatch Logs.

Answer

Enable ECS task memory dumps to CloudWatch Logs.

Answer

Stop the task and create a new task from the same image.

Question 7

A security engineer is investigating a potential data breach. The engineer needs to identify which IAM user accessed a specific S3 object and when. Which AWS service should the engineer use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity for all AWS services, including S3 object-level operations such as GetObject, PutObject, and DeleteObject. By enabling data events on the specific S3 bucket, CloudTrail logs the IAM user, source IP, timestamp, and the exact object key accessed, providing the precise identity and time needed for breach investigation.

Answer

AWS Config

Answer

Amazon S3 server access logs

Answer

Amazon CloudWatch Logs

Question 8

A company uses Amazon GuardDuty and has enabled EKS audit logs as a data source. The security team wants to detect potential container escape attempts. Which TWO findings would indicate a container escape attempt? (Choose TWO.)

Accepted Answer

PrivilegeEscalation:EKS/KubernetesAPICallFromContainer. Option D is correct because the PrivilegeEscalation:EKS/KubernetesAPICallFromContainer finding specifically detects when a container makes Kubernetes API calls that indicate an attempt to escalate privileges, such as creating pods with elevated permissions or accessing cluster-admin roles. This is a direct indicator of a container escape attempt, as the container is interacting with the Kubernetes control plane to gain unauthorized access to the host or other resources.

Answer

Execution:ECS/SuspiciousCommand

Answer

UnauthorizedAccess:EC2/SSHBruteForce

Answer

CryptoCurrency:EC2/BitcoinTool.B

Question 9

A security engineer is configuring automated incident response for Amazon GuardDuty findings. The engineer wants to isolate a compromised EC2 instance by changing its security group and stopping the instance. Which THREE services should the engineer use together to achieve this? (Choose THREE.)

Accepted Answer

AWS Systems Manager. AWS Systems Manager (SSM) is correct because it provides the Automation runbook capability that can be used to stop an EC2 instance and modify its security groups as part of an incident response workflow. SSM Automation can be triggered by an EventBridge rule and can invoke Lambda functions or run commands directly on the instance to isolate it. This allows the security engineer to automate the isolation and stopping of the compromised instance without manual intervention.

Answer

Amazon EC2

Answer

AWS Config

Question 10

A company wants to detect and respond to potential security threats in near real-time. Which TWO services should the company use together to achieve this? (Choose TWO.)

Accepted Answer

AWS Security Hub. AWS Security Hub (D) aggregates security findings from multiple AWS services, including Amazon GuardDuty, and provides a comprehensive view of security alerts and compliance status. Amazon GuardDuty (E) is a threat detection service that continuously monitors for malicious activity and unauthorized behavior using machine learning and integrated threat intelligence. Together, they enable near real-time detection and response by centralizing findings from GuardDuty in Security Hub, which can trigger automated remediation workflows via Amazon EventBridge.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 11

Refer to the exhibit. A security engineer is reviewing a resource-based policy attached to an AWS Lambda function. The engineer notices that the policy allows any Lambda function in the account to invoke the function. Which security concern should the engineer address?

Accepted Answer

The policy allows invocation from any Lambda function across all AWS accounts.. Option C is correct because the resource-based policy on the Lambda function uses a principal of `*` without any condition key (such as `aws:SourceAccount` or `aws:SourceArn`) to restrict invocation to only the same account. This means any Lambda function in any AWS account can invoke this function, which is a security concern as it allows cross-account invocation without authorization.

Answer

The policy grants excessive permissions by allowing all actions.

Answer

The policy does not specify a resource ARN, so it applies to all functions.

Answer

The policy allows the Lambda service to modify the function code.

Question 12

Refer to the exhibit. A security engineer runs the AWS CLI command to look up console login events. The output shows two successful login events for user1 within 5 minutes. What should the engineer suspect?

Accepted Answer

The user's credentials may be compromised.. Two successful console login events for the same user within 5 minutes, especially from different source IP addresses or user agents, is a strong indicator of credential compromise. An attacker who has obtained the user's password can log in while the legitimate user is also active, creating overlapping sessions. AWS CloudTrail records the `ConsoleLogin` event with details like `sourceIPAddress` and `userAgent`, which the engineer should examine to confirm whether the logins originated from different locations or devices.

Answer

The user created a new access key.

Answer

The user's account is being used by multiple users.

Answer

The user has disabled multi-factor authentication (MFA).

Question 13

Refer to the exhibit. A security engineer is reviewing an S3 bucket policy. The policy is intended to allow access only from the corporate network (10.0.0.0/8). What is a potential security issue with this policy?

Accepted Answer

The policy allows anonymous access from the specified IP range.. Option A is correct because the policy's `Principal: "*"` element allows anonymous access from any IP address, and the `Condition` block only restricts the source IP to 10.0.0.0/8. This means any unauthenticated request originating from within the corporate network (10.0.0.0/8) is permitted, effectively granting anonymous access to the S3 bucket. The intended goal of restricting access to authenticated corporate users is not achieved, as no `aws:userid` or `aws:username` condition is enforced.

Answer

The policy grants access to all actions, not just GetObject.

Answer

The policy resource is incorrect; it should be the bucket ARN without the /*.

Answer

The policy does not include a condition to require MFA.

Question 14

A security engineer is reviewing CloudTrail logs and notices API calls from an unknown IP address. The engineer needs to immediately block the IP address and receive alerts for any future suspicious activity. Which combination of actions should the engineer take?

Accepted Answer

Add the IP address to a VPC NACL with a DENY rule and update a CloudWatch metric filter to create an alarm on the IP address.. Option D is correct because VPC Network ACLs (NACLs) are stateless and can explicitly deny traffic from a specific IP address at the subnet level, providing immediate blocking without affecting existing security group rules. A CloudWatch metric filter on CloudTrail logs can trigger an alarm for any future API calls from that IP, enabling proactive alerting. This combination addresses both the immediate blocking and ongoing monitoring requirements.

Answer

Create an AWS WAF IP set and associate it with the CloudFront distribution. Configure CloudFront to block the IP.

Answer

Add the IP address to a security group with a DENY rule and enable AWS Security Hub to send alerts.

Answer

Revoke IAM permissions for the user associated with the IP and enable GuardDuty for alerting.

Question 15

A company uses AWS Organizations and has enabled GuardDuty in the management account. The security team wants to view GuardDuty findings for all member accounts from a single delegated administrator account. Which configuration step is required?

Accepted Answer

Designate a delegated administrator account in Organizations, then enable GuardDuty in that account. GuardDuty will automatically aggregate findings from member accounts.. Option C is correct because AWS Organizations allows you to designate a delegated administrator account for GuardDuty, which can then manage and view findings from all member accounts without needing to enable GuardDuty individually in each account. Once the delegated administrator is set up, GuardDuty automatically aggregates findings from all member accounts in the organization, providing a single-pane-of-glass view for the security team.

Answer

Enable GuardDuty in each member account and configure cross-account IAM roles to aggregate findings in the management account.

Answer

Enable GuardDuty only in the management account and share findings via CloudWatch Logs cross-account subscription.

Answer

Enable GuardDuty in the management account and use CloudWatch cross-account dashboard to view findings from member accounts.