SCS-C02 Threat Detection and Incident Response Practice Test 7 — 15 Questions

Question 1

A security engineer needs to analyze large volumes of VPC Flow Logs stored in Amazon S3 to identify anomalous traffic patterns. Which approach is MOST cost-effective and scalable?

Accepted Answer

Use Amazon Athena with partitioned data in S3.. Amazon Athena is the most cost-effective and scalable solution for querying large volumes of VPC Flow Logs stored in S3 because it uses a serverless, pay-per-query model with no infrastructure to manage. By partitioning the data (e.g., by date or region), Athena minimizes the amount of data scanned per query, directly reducing costs while enabling complex SQL-based analysis for anomaly detection.

Answer

Use AWS Glue to catalog and query the logs.

Answer

Download the logs to an EC2 instance and use grep commands.

Answer

Use Amazon QuickSight to directly query the logs.

Question 2

An organization uses AWS Organizations with hundreds of accounts. The security team wants to automatically respond to a specific GuardDuty finding by isolating the affected EC2 instance. What is the recommended architecture?

Accepted Answer

Use EventBridge to trigger a Lambda function in the delegated administrator account, which assumes an IAM role in the affected account to isolate the instance.. It follows the recommended architecture for cross-account automated response to GuardDuty findings. EventBridge in the delegated administrator account captures the finding and triggers a Lambda function, which then assumes an IAM role (using STS AssumeRole) in the affected member account to perform the isolation. This pattern centralizes management while respecting the security boundary between accounts.

Answer

Configure GuardDuty to invoke a Lambda function in the affected account directly.

Answer

Use EventBridge to send the finding to a Step Functions workflow that isolates the instance.

Answer

Use AWS Systems Manager Automation to isolate the instance across accounts.

Question 3

Which TWO AWS services can be used to detect unauthorized access to an S3 bucket? (Select TWO.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads. It uses machine learning, anomaly detection, and integrated threat intelligence to analyze S3 data events (e.g., GetObject, PutObject) logged via CloudTrail management and data events, identifying suspicious patterns such as unusual access from a known malicious IP address or an anonymous user gaining access to an S3 bucket.

Answer

AWS WAF

Answer

AWS CloudTrail

Answer

AWS Config

Question 4

Which THREE actions should be taken when preserving forensic evidence from an EC2 instance during an incident? (Select THREE.)

Accepted Answer

Create an EBS snapshot of all volumes.. Option B is correct because creating an EBS snapshot of all attached volumes captures a point-in-time, block-level copy of the instance's disk data (including the root volume) that can later be restored and analyzed without altering the original evidence. Option D is correct because volatile memory contains artifacts such as running processes, network connections, and encryption keys that are lost on shutdown, so capturing a memory dump with a tool like LiME preserves this critical evidence. Option E is correct because modifying the security group to remove inbound/outbound rules isolates the instance from the network, preventing further compromise or data exfiltration while keeping the instance running so volatile evidence remains intact. Option A is not appropriate because rebooting destroys volatile memory and can trigger anti-forensic behavior, and Option C is not appropriate because terminating the instance destroys the ephemeral storage and volatile state and may delete the very evidence needed for investigation.

Answer

Reboot the instance to clear any malicious processes.

Answer

Terminate the instance to prevent further compromise.

Question 5

Which TWO AWS services can be used to automatically block malicious IP addresses at the network perimeter? (Select TWO.)

Accepted Answer

Network ACLs. Network ACLs (NACLs) are stateless virtual firewalls that operate at the subnet level in a VPC. They can be configured with inbound and outbound rules to explicitly deny traffic from specific IP addresses, effectively blocking malicious IPs at the network perimeter before they reach the instances.

Answer

Amazon Route 53

Answer

Security Groups

Answer

AWS Shield Advanced

Question 6

A security engineer needs to detect and respond to potential credential theft where an IAM user's access key is being used from an unusual geographic location. Which AWS service should be used to generate alerts based on this anomaly?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is the correct choice because it is a threat detection service that uses machine learning and integrated threat intelligence to identify anomalous behavior, such as an IAM access key being used from an unusual geographic location. It specifically analyzes CloudTrail management and data events, VPC flow logs, and DNS logs to detect credential theft patterns like a new geolocation or an impossible travel scenario, and can trigger alerts via Amazon EventBridge or SNS for automated response.

Answer

AWS IAM Access Analyzer

Answer

AWS CloudTrail

Answer

AWS Config

Question 7

A company uses AWS Organizations with multiple accounts. The security team wants a centralized view of all security alerts and findings from services like GuardDuty, Security Hub, and Inspector across all accounts. What is the MOST efficient way to achieve this?

Accepted Answer

Use AWS Security Hub with cross-account aggregation in the management account.. AWS Security Hub is designed to aggregate findings from multiple security services (GuardDuty, Inspector, etc.) across accounts. By enabling cross-account aggregation in the management account of AWS Organizations, Security Hub provides a single, centralized dashboard for all security alerts and findings without needing to collect raw logs or build custom dashboards. This is the most efficient and native approach for a multi-account environment.

Answer

Use AWS Systems Manager OpsCenter to centrally view all security findings.

Answer

Use individual service consoles (GuardDuty, Security Hub, Inspector) for each account.

Answer

Use Amazon CloudWatch Logs to collect logs from each account and create custom dashboards.

Question 8

A security engineer is configuring automated incident response for an Amazon EC2 instance that has been compromised. The engineer needs to isolate the instance while preserving forensic data. Which solution meets these requirements?

Accepted Answer

Create an AMI of the instance, then remove the instance from the security group to isolate it.. Creating an AMI preserves the EBS volumes and their forensic data, while removing the instance from the security group effectively isolates it by denying all network traffic. This approach allows the engineer to later launch a forensic instance from the AMI in a controlled environment for analysis, without losing the compromised instance's state.

Answer

Detach the EBS volumes and attach them to a new instance in a different VPC.

Answer

Terminate the instance immediately to prevent further damage.

Answer

Stop the instance and change the security group to deny all traffic.

Question 9

During a security review, a security engineer notices that an S3 bucket contains sensitive data but has a bucket policy that allows access from any principal in the account. The engineer needs to identify any unintended cross-account access to this bucket. Which AWS service should be used?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer helps identify resources that are shared with external principals by analyzing resource-based policies (like S3 bucket policies). In this scenario, the bucket policy allows access from any principal in the account, but IAM Access Analyzer can detect if the policy also grants access to principals outside the AWS account (cross-account access). It generates findings for any policy that allows access from an external entity, making it the correct service to identify unintended cross-account access.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon Macie

Question 10

A security engineer suspects that an EC2 instance is communicating with a known malicious IP address. The engineer needs to capture the full network packets for analysis. Which approach should be taken?

Accepted Answer

Use VPC Traffic Mirroring to mirror the instance's ENI to a monitoring appliance.. VPC Traffic Mirroring captures and copies all network traffic from an EC2 instance's Elastic Network Interface (ENI) and forwards it to a monitoring appliance (e.g., a security appliance or packet analyzer) for full packet-level analysis. This is the only option that provides raw, full network packets (including headers and payloads) without impacting the instance's performance or requiring software installation on the instance itself.

Answer

Enable AWS Security Hub to detect and capture malicious traffic.

Answer

Install the Amazon CloudWatch agent on the instance to capture network logs.

Answer

Enable VPC Flow Logs on the subnet and analyze the logs.

Question 11

A company wants to automatically trigger a Lambda function when a new security finding is generated in AWS Security Hub. Which service should be used to invoke the Lambda function?

Accepted Answer

Amazon EventBridge. Amazon EventBridge is the correct service because AWS Security Hub automatically sends all findings to the default EventBridge bus as events. You can create an EventBridge rule that matches the 'Security Hub Findings - Imported' event pattern and targets a Lambda function for invocation. This is the native, recommended integration for event-driven responses to Security Hub findings.

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS Security Hub itself

Answer

AWS CloudTrail

Question 12

A security engineer is investigating a potential data exfiltration from an S3 bucket that is configured to allow public access. The engineer wants to determine who accessed the bucket and from which IP addresses. Which AWS capability should be used?

Accepted Answer

AWS CloudTrail data events for S3. AWS CloudTrail data events for S3 capture detailed API activity at the object level, including GetObject, PutObject, and DeleteObject calls. This allows the security engineer to identify exactly who accessed the bucket (via the user identity) and from which IP address (via the sourceIPAddress field in the CloudTrail event). Unlike management events, data events must be explicitly enabled and provide the granularity needed for this investigation.

Answer

Amazon S3 server access logs

Answer

AWS IAM Access Analyzer

Answer

Amazon VPC Flow Logs

Question 13

A company uses AWS Systems Manager Patch Manager to apply patches to EC2 instances. The security team wants to ensure that instances are patched within 7 days of a patch release. Which service should be used to monitor and report compliance?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides continuous monitoring and evaluation of your AWS resource configurations, including patch compliance status via Systems Manager Patch Manager. You can create an AWS Config rule (e.g., 'ec2-managedinstance-patch-compliance-status') that checks whether instances have the required patches installed within a specified time frame (e.g., 7 days). AWS Config then reports noncompliant resources, enabling the security team to track and remediate patching gaps.

Answer

AWS Security Hub

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 14

A security engineer is designing a threat detection solution for a multi-account AWS environment. The engineer needs to detect and respond to suspicious API activity across all accounts. Which TWO services should be used together to achieve this? (Choose two.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior across AWS accounts, including suspicious API activity. By enabling GuardDuty in all accounts and aggregating findings to a central administrator account, it provides the necessary detection layer for multi-account environments.

Answer

Amazon CloudWatch

Answer

Amazon Inspector

Answer

AWS Config

Question 15

A security engineer is investigating a security incident where an EC2 instance was used to launch an outbound denial-of-service (DoS) attack. The engineer needs to collect forensic evidence. Which THREE actions should the engineer take? (Choose three.)

Accepted Answer

Create an Amazon EBS snapshot of the instance's root volume.. Creating an Amazon EBS snapshot preserves persistent data for offline analysis. Option D is correct because capturing memory preserves volatile evidence. Option E is correct because after collecting forensic evidence, terminating the instance stops the attack immediately and prevents further damage. Options A and B are incorrect because they destroy evidence (reboot clears memory, deletion removes logs).

Answer

Reboot the instance to clear any malicious processes.

Answer

Delete the CloudTrail logs that show the instance's API calls.