SCS-C02 Threat Detection and Incident Response Practice Test 6 — 15 Questions

Question 1

A security engineer is analyzing a potential security incident involving an Amazon RDS for MySQL database. The engineer suspects that a SQL injection attack was successful. Which AWS service can the engineer use to review the actual SQL queries that were executed against the database?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon RDS Audit Logs. Amazon RDS for MySQL supports audit logs that capture detailed records of database activities, including the actual SQL queries executed. By enabling the `audit_log` plugin and configuring the `server_audit_events` parameter, the engineer can review the exact SQL statements that were run, which is essential for identifying a SQL injection attack. This is the only AWS service that provides query-level visibility into RDS database operations.

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 2

A company uses Amazon GuardDuty to detect threats. The security team wants to be alerted when GuardDuty generates a finding with a severity level of HIGH or CRITICAL. Which AWS service should the team use to send notifications based on GuardDuty findings?

Accepted Answer

Amazon EventBridge and Amazon Simple Notification Service (SNS). Amazon EventBridge can capture GuardDuty findings as events using a rule that matches the 'GuardDuty Finding' event type. The rule can then invoke an SNS topic to send email or SMS notifications. This is the recommended pattern because EventBridge provides native integration with GuardDuty and supports filtering by finding severity using event patterns, while SNS handles the actual notification delivery.

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Lambda

Answer

Amazon CloudWatch Logs and Amazon Simple Notification Service (SNS)

Question 3

A company's incident response team is using AWS Systems Manager to run commands on EC2 instances for forensic analysis. The team needs to ensure that the commands are run with minimal latency and that the results are stored securely. Which Systems Manager capability should the team use?

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Run Command is the correct capability because it allows the incident response team to execute commands on EC2 instances with minimal latency by using the SSM Agent to run scripts or commands directly, and it can store command output in Amazon S3 or CloudWatch Logs for secure, durable storage. This meets the requirement for low-latency execution and secure result storage without requiring interactive sessions or complex automation workflows.

Answer

AWS Systems Manager Automation

Answer

AWS Systems Manager Session Manager

Answer

AWS Systems Manager Patch Manager

Question 4

A security engineer is investigating a potential compromise of an EC2 instance. The engineer wants to capture volatile memory data and create a forensic image of the instance's EBS volumes. Which TWO actions should the engineer take? (Choose 2.)

Accepted Answer

Use AWS Systems Manager Run Command to execute a memory capture script.. AWS Systems Manager Run Command allows you to remotely execute scripts on EC2 instances without needing SSH access, which is critical during incident response to capture volatile memory data before the instance is compromised further. Option D is correct because creating an EBS snapshot provides a point-in-time forensic image of the root volume that can be analyzed offline without altering the original evidence.

Answer

Enable AWS CloudTrail for the instance.

Answer

Use AWS Backup to create a backup of the instance.

Answer

Use Amazon Inspector to scan the instance for vulnerabilities.

Question 5

A company's security team is configuring Amazon GuardDuty to detect crypto-mining activities on EC2 instances. Which THREE indicators should the team monitor? (Choose 3.)

Accepted Answer

Outbound connections to IP addresses on port 3333.. Crypto-mining malware often uses port 3333 for communication with mining pools or command-and-control servers. GuardDuty can detect outbound connections to known malicious IP addresses on this port as part of its threat intelligence feeds, which include indicators of compromise (IOCs) associated with crypto-mining activity.

Answer

High volume of inbound network traffic.

Answer

High disk I/O operations.

Question 6

A company is designing an incident response plan for AWS. The plan must include the ability to collect forensic data from EC2 instances without requiring SSH key pairs. Which TWO AWS services can be used to acquire forensic data from EC2 instances without remote access? (Choose 2.)

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Run Command allows you to run scripts or commands on EC2 instances via the SSM Agent, without requiring SSH keys or direct network access. This enables forensic data collection (e.g., memory dumps, log files) by executing commands remotely through the AWS Systems Manager service, using IAM roles for authentication.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 7

Your company has a single AWS account with a production VPC that contains several EC2 instances running a web application. The security team has enabled Amazon GuardDuty and AWS CloudTrail. Recently, GuardDuty reported a finding 'UnauthorizedAccess:EC2/TorClient' for one of the instances. The finding indicates that the instance is making connections to Tor exit nodes. You need to investigate and contain the incident. The instance is critical to the application and cannot be terminated. You have a forensic analysis instance in a separate security group. What should you do FIRST?

Accepted Answer

Isolate the instance by modifying its security group to remove all inbound and outbound rules except for the forensic analysis instance.. The first step in incident response for a compromised instance that cannot be terminated is to contain the threat by isolating it from the network. Modifying the security group to remove all inbound and outbound rules except for a specific forensic analysis instance prevents the compromised EC2 instance from communicating with Tor exit nodes or other external hosts, while still allowing controlled forensic access. This containment is immediate and reversible, aligning with the AWS incident response best practice of 'isolate first, investigate later'.

Answer

Terminate the instance immediately and launch a replacement.

Answer

Take an EBS snapshot of the instance's root volume for analysis.

Answer

Use AWS Systems Manager Run Command to install a forensic agent on the instance.

Question 8

Your organization uses AWS Organizations with 50 member accounts. You are the security administrator for the root account. You have enabled AWS CloudTrail in all accounts and centralized the logs in an S3 bucket in the root account. You also enabled Amazon GuardDuty in the root account and have delegated an administrator account. Recently, you received an alert from GuardDuty about a potential credential compromise in a member account. The finding indicates that an IAM user in that account made an API call from an unusual IP address. You need to quickly gather all CloudTrail events for that user from the last 30 days across all accounts. The logs are stored in a single S3 bucket with a prefix structure like 'AWSLogs//CloudTrail////'. What is the MOST efficient way to query these logs?

Accepted Answer

Use Amazon Athena to query the CloudTrail logs by creating a table partitioned by account, region, and date.. Amazon Athena is the most efficient way to query CloudTrail logs stored in S3 because it allows you to run SQL queries directly on the data without moving or downloading it. By creating a table partitioned by account, region, and date, you can quickly filter for the specific IAM user's events across all 50 accounts for the last 30 days, leveraging partition pruning to scan only the relevant log files. This approach minimizes data scanned and cost, while providing near-instant results.

Answer

Enable AWS CloudTrail Lake and create a new event data store that includes the historical logs.

Answer

Download all log files from the S3 bucket for the last 30 days and parse them locally.

Answer

Use Amazon CloudWatch Logs Insights to query the logs from the member account.

Question 9

Your company has a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The security team enabled AWS CloudTrail and Amazon GuardDuty. GuardDuty generates a finding 'Recon:EC2/PortProbeUnprotectedPort' for an EC2 instance that does not exist in the account. Upon investigation, you realize that the finding is triggered by a misconfigured Network Load Balancer (NLB) that is exposing a port to the internet. The NLB is used by the API Gateway. You need to reduce false positives for this specific finding. What should you do?

Accepted Answer

Create a suppression rule in GuardDuty to filter out findings for the NLB's public IP and port.. GuardDuty suppression rules allow you to filter out findings that are known false positives based on specific criteria, such as the public IP and port of the NLB. Since the NLB is intentionally exposing a port for API Gateway, the port probe finding is expected behavior, not a real threat. Suppressing findings for that specific combination reduces noise without disabling GuardDuty for the entire account.

Answer

Change the NLB to an Application Load Balancer.

Answer

Enable AWS Shield Advanced to block the probes.

Answer

Disable GuardDuty for the account.

Question 10

A company uses AWS CloudTrail to log all API calls. The security team notices a series of `UpdateTrail` API calls from a user in the Security account, disabling logging on a multi-region trail. The user has a policy that allows `cloudtrail:UpdateTrail` only on trails with a specific tag. However, the trail does not have that tag. What is the MOST likely reason the call succeeded?

Accepted Answer

The trail did not have the required tag at the time of the API call due to a race condition.. AWS IAM policies are evaluated based on the resource's tags at the time of the API call. If the `UpdateTrail` API call was made while the trail's tag was being removed or added, a race condition could cause the trail to temporarily lack the required tag, allowing the action to succeed despite the policy's intent. This is a known edge case in IAM tag-based authorization, where eventual consistency of tag changes can lead to unintended access.

Answer

The trail had an explicit deny in the same policy that was overridden by a separate allow.

Answer

The user's permissions were granted through a service control policy (SCP) that allowed the action.

Answer

CloudTrail API calls are not logged and bypass IAM policies.

Question 11

A company uses AWS Organizations with multiple accounts. The security team wants to centrally collect and analyze VPC Flow Logs from all accounts. What is the MOST efficient way to achieve this?

Accepted Answer

Configure VPC Flow Logs to deliver to a central S3 bucket in the security account, and use a bucket policy that grants the source accounts permission to write.. It uses a central S3 bucket in the security account with a bucket policy that grants the PutObject permission to the VPC Flow Logs delivery service from each source account. This is the most efficient approach as it avoids per-account configuration overhead, eliminates the need for cross-account replication, and provides a single location for centralized analysis using services like Amazon Athena or Amazon QuickSight.

Answer

Use AWS Firewall Manager to deploy VPC Flow Logs and aggregate logs in a single account.

Answer

Configure VPC Flow Logs to deliver to a central CloudWatch Logs log group in the management account.

Answer

Set up VPC Flow Logs in each account to deliver to local S3 buckets, then use S3 replication to copy to a central bucket.

Question 12

A security engineer is investigating a potential compromise. The engineer has captured a memory dump from an EC2 instance and needs to analyze it for malware. Which TWO actions should the engineer take to preserve the chain of custody? (Choose TWO.)

Accepted Answer

Record the date, time, and digital signature of the acquisition.. Recording the date, time, and digital signature of the acquisition establishes a clear audit trail, which is essential for proving that the evidence has not been tampered with. In forensic investigations, this metadata is part of the standard chain-of-custody documentation that demonstrates who collected the evidence, when, and that it remains unaltered. A digital signature (e.g., using a tool like gpg or a signed hash) provides non-repudiation and integrity verification beyond a simple hash.

Answer

Create an EBS snapshot of the instance's root volume.

Answer

Analyze the memory dump on the same EC2 instance.

Answer

Upload the memory dump to a public S3 bucket for analysis.

Question 13

A company wants to detect anomalous behavior in their AWS environment. Which THREE AWS services can be used for threat detection? (Choose THREE.)

Accepted Answer

AWS Security Hub. AWS Security Hub is correct because it aggregates and prioritizes security findings from multiple AWS services (like GuardDuty, Inspector, and Macie) and third-party tools, providing a comprehensive view of security alerts and compliance status. It uses integrated findings to detect anomalous behavior across accounts and regions, making it a central threat detection service.

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 14

An organization uses AWS CloudTrail with a multi-region trail. The security team suspects that an attacker has deleted logs. Which THREE findings would indicate that log deletion occurred? (Choose THREE.)

Accepted Answer

A `StopLogging` API call from an unknown IP address.. A `StopLogging` API call from an unknown IP address indicates that logging was deliberately disabled, which an attacker could do to cover their tracks. CloudTrail records all `StopLogging` events, and an unexpected source IP is a strong indicator of unauthorized activity. This directly suggests log deletion or suppression, as stopping the trail prevents further log delivery.

Answer

An S3 bucket with MFA Delete enabled.

Answer

Multiple `StartLogging` API calls in the logs.

Question 15

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team receives an alert from Amazon GuardDuty that one of the EC2 instances is generating outbound traffic to a known command-and-control (C2) IP address. The instance is part of an Auto Scaling group (ASG) with a minimum of 2 and maximum of 10 instances. The security incident response playbook instructs the team to isolate the compromised instance without affecting the application's availability. The team needs to preserve the instance for forensic analysis. Which action should the team take first?

Accepted Answer

Remove the instance from the ALB target group and attach a security group that denies all traffic.. Removing the instance from the ALB target group immediately stops new traffic from reaching the application, while attaching a security group that denies all traffic (e.g., a custom security group with no inbound/outbound rules) effectively isolates the instance at the network layer. This preserves the instance for forensic analysis and does not affect application availability, as the ASG will not automatically terminate the instance (since it is still running and healthy from the ASG's perspective). The ALB will continue to route traffic to the remaining healthy instances in the target group, maintaining service continuity.

Answer

Terminate the compromised EC2 instance and allow the ASG to launch a replacement.

Answer

Detach the EBS root volume from the instance and attach it to a forensic instance.

Answer

Shut down the instance from within the OS using AWS Systems Manager Run Command.