SCS-C02 Threat Detection and Incident Response Practice Test 6 — 15 Questions

Question 1

A company uses AWS Organizations with multiple accounts. The security team wants to centrally collect and analyze CloudTrail logs from all accounts in a single S3 bucket. What is the most efficient way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a single organization trail in the management account that logs all accounts.. AWS Organizations supports creating a single organization trail in the management account that automatically logs CloudTrail events for all accounts in the organization. This centralizes log collection into one S3 bucket without needing to configure trails per account, making it the most efficient and scalable approach for multi-account environments.

Answer

Create a CloudTrail trail in each account and configure the same S3 bucket as the destination.

Answer

Use CloudWatch Logs subscription filter to send logs from each account to a central account.

Answer

Use S3 cross-region replication to copy logs from each account's bucket to a central bucket.

Question 2

During an incident response, a security engineer needs to capture a forensic image of an EC2 instance's root volume for analysis. The instance is running and cannot be stopped. What is the recommended approach to capture the volume without stopping the instance?

Accepted Answer

Create a snapshot while the volume is attached to the instance.. The correct approach is to create a snapshot of the EBS root volume while it is still attached to the running instance (Option C). Snapshots can be taken of in-use volumes without stopping the instance, providing a point-in-time copy for forensic analysis. Option B is incorrect because you cannot detach the root volume of a running instance without first stopping it, which contradicts the requirement not to stop the instance.

Answer

Use the dd command via AWS Systems Manager to create a raw image and store it in S3.

Answer

Detach the volume from the instance, create a snapshot, and then attach it to a forensic analysis instance.

Answer

Use AWS Systems Manager to run a command that copies the volume content to S3.

Question 3

A company uses Amazon GuardDuty and receives a finding of type 'Backdoor:EC2/C&CActivity.B!DNS' for an EC2 instance. What does this finding indicate?

Accepted Answer

The instance is communicating with a known command and control server.. The finding 'Backdoor:EC2/C&CActivity.B!DNS' indicates that GuardDuty has detected DNS queries from the EC2 instance to a domain associated with known command and control (C&C) infrastructure. This is based on GuardDuty's threat intelligence feeds that map DNS request patterns to known malicious domains, signaling that the instance may be compromised and communicating with an attacker's server.

Answer

The instance is being targeted by an SSH brute force attack.

Answer

The instance is exfiltrating data to an S3 bucket.

Answer

The instance is being used in a DDoS attack.

Question 4

A security engineer is setting up automated incident response for a compromised EC2 instance. The engineer wants to isolate the instance immediately upon detection of a GuardDuty finding. Which AWS service can be used to automatically trigger a Lambda function that modifies the instance's security group?

Accepted Answer

Amazon CloudWatch Events. Amazon CloudWatch Events (now part of Amazon EventBridge) can be configured with a rule that matches specific GuardDuty finding events. When a finding is detected, the rule triggers a Lambda function that can modify the EC2 instance's security group to isolate it, for example by removing all inbound rules or replacing the group with a restrictive one. This provides the automated, event-driven response required.

Answer

AWS Step Functions

Answer

Amazon Inspector

Answer

AWS Config

Question 5

Which AWS service can be used to detect and alert on suspicious network traffic patterns within a VPC, such as port scanning or unusual outbound traffic?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors VPC Flow Logs, DNS logs, and CloudTrail events to identify suspicious network traffic patterns such as port scanning, unusual outbound traffic, and other malicious activities. It uses machine learning, anomaly detection, and integrated threat intelligence to generate security alerts without requiring manual rules or signatures.

Answer

AWS WAF

Answer

AWS Network Firewall

Answer

VPC Flow Logs

Question 6

During an incident response, a security engineer needs to preserve the state of an EC2 instance for forensic analysis. The instance is running a production workload that cannot be interrupted. Which of the following actions should the engineer take FIRST to ensure data integrity?

Accepted Answer

Use AWS Systems Manager Run Command to create a memory dump and store it in S3.. During an incident response, preserving volatile data (such as memory contents) is critical before any other action that might alter the system state. AWS Systems Manager Run Command can execute a command (e.g., using `dd` or `LiME`) to capture a memory dump and store it in Amazon S3 without interrupting the production workload. This ensures that forensic artifacts like running processes, network connections, and encryption keys are preserved before any disk-level operations that could overwrite or modify evidence.

Answer

Run the dd command to clone the root volume to another EBS volume.

Answer

Create an AMI from the instance while it is running.

Answer

Take a snapshot of the attached EBS volumes while the instance is running.

Question 7

A security engineer is configuring AWS CloudTrail to monitor data events for S3 objects. Which TWO of the following must be enabled to log object-level operations? (Select TWO.)

Accepted Answer

Enable data events in the CloudTrail trail.. CloudTrail data events capture S3 object-level operations such as GetObject, PutObject, and DeleteObject. To enable this, you must explicitly select 'Data events' in the CloudTrail trail configuration, as management events only cover bucket-level operations like CreateBucket.

Answer

Enable S3 server access logs on the bucket.

Answer

Enable management events in the CloudTrail trail.

Answer

Enable S3 Object Lambda.

Question 8

A company wants to implement automated remediation of security findings from Amazon GuardDuty. Which THREE AWS services can be used together to create an automated response workflow? (Select THREE.)

Accepted Answer

Amazon CloudWatch Events (EventBridge). Amazon GuardDuty sends findings to Amazon CloudWatch Events (EventBridge) as events. You can configure an EventBridge rule to match specific GuardDuty findings and trigger an AWS Lambda function for automated remediation. AWS Step Functions can orchestrate complex remediation workflows involving multiple Lambda functions or other AWS services, providing retry logic and error handling.

Answer

Amazon SQS

Answer

AWS Config

Question 9

A security engineer is investigating a potential data exfiltration from an S3 bucket. Which AWS service should be used to analyze the VPC Flow Logs for the S3 bucket's endpoint?

Accepted Answer

Amazon Detective. Amazon Detective is the correct service because it can ingest and analyze VPC Flow Logs, including those for a VPC endpoint used to access an S3 bucket. Detective uses machine learning, statistical analysis, and graph theory to identify the root cause of suspicious network traffic patterns, such as unusual data volumes or connections to external IPs, which are indicative of data exfiltration.

Answer

Amazon Macie

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 10

During an incident response, a security team needs to capture a memory dump of an Amazon EC2 instance running Linux. What is the recommended approach?

Accepted Answer

Use AWS Systems Manager Run Command to run a script that extracts memory using LiME.. AWS Systems Manager Run Command allows you to execute a script on a running EC2 instance without needing SSH access, and LiME (Linux Memory Extractor) is a trusted tool for capturing volatile memory. This approach preserves the memory state for forensic analysis while maintaining the instance's running state, which is critical for incident response.

Answer

Use Amazon Inspector to collect memory dumps.

Answer

Stop the instance and create an EBS snapshot for memory analysis.

Answer

Use the EC2 console to take a screenshot and capture memory from the hypervisor.

Question 11

A company has multiple AWS accounts in AWS Organizations. The security team wants to centralize threat detection and automate incident response. Which combination of services should they use?

Accepted Answer

GuardDuty + Amazon EventBridge + AWS Lambda. GuardDuty generates threat detection findings, which are sent to Amazon EventBridge as events. EventBridge then triggers an AWS Lambda function to automate incident response actions, such as isolating an EC2 instance or revoking IAM credentials. This combination provides a fully serverless, event-driven pipeline for centralized threat detection and automated remediation across multiple AWS accounts in Organizations.

Answer

GuardDuty + Security Hub + Step Functions

Answer

Amazon Macie + AWS Config + SNS

Answer

CloudTrail + CloudWatch Logs + Lambda

Question 12

A security engineer needs to ensure that all API calls in an AWS account are logged for incident response. Which AWS service should be enabled?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made in an AWS account, including the identity of the caller, the time of the call, the source IP address, and the request parameters. This logging is essential for incident response to reconstruct events and identify unauthorized or malicious activity.

Answer

Amazon GuardDuty

Answer

VPC Flow Logs

Answer

AWS Config

Question 13

An organization uses AWS Organizations and wants to centrally manage Amazon GuardDuty across multiple accounts. What is the correct architecture?

Accepted Answer

Designate a delegated administrator account in Organizations and enable GuardDuty in that account.. AWS Organizations allows you to designate a delegated administrator account for Amazon GuardDuty, which can then centrally manage GuardDuty across all member accounts in the organization. This architecture simplifies enabling GuardDuty and managing findings without needing to configure each account individually, as the delegated administrator can enable GuardDuty for all accounts in the organization from a single point.

Answer

Enable GuardDuty only in the master account; it will automatically monitor all member accounts.

Answer

Use AWS CloudFormation StackSets to deploy GuardDuty in all accounts and regions.

Answer

Enable GuardDuty in each region separately and use cross-region aggregation.

Question 14

During an incident, a security engineer needs to isolate a compromised Amazon EC2 instance without losing the ability to capture forensic data from its EBS volumes. What is the best course of action?

Accepted Answer

Take a snapshot of the EBS volumes, then detach the instance from the Auto Scaling group and modify the security group to deny all traffic.. Taking a snapshot of the EBS volumes preserves the forensic data before any changes occur, while detaching the instance from the Auto Scaling group prevents automatic replacement, and modifying the security group to deny all traffic isolates the instance without losing the running state or the ability to capture additional volatile data. This approach balances isolation with forensic preservation, ensuring the instance remains available for further analysis if needed.

Answer

Terminate the instance immediately and take a snapshot after termination.

Answer

Stop the instance, detach the volumes, and attach them to a forensic instance.

Answer

Change the security group to restrict traffic to only the forensic team's IP addresses.

Question 15

A company is using AWS WAF to protect a web application. The security team wants to receive alerts when a specific rule block is triggered. Which AWS service should they use to achieve this?

Accepted Answer

CloudWatch Alarms with SNS. AWS WAF integrates with Amazon CloudWatch to provide metrics for each rule, including the 'BlockedRequests' count. By creating a CloudWatch Alarm on this metric, you can trigger an SNS notification when the threshold is exceeded, alerting the security team. This is the standard pattern for receiving alerts on WAF rule actions, as CloudWatch Alarms with SNS provide the necessary monitoring and notification pipeline.

Answer

Amazon EventBridge

Answer

Amazon S3

Answer

Amazon SNS