SCS-C02 Threat Detection and Incident Response Practice Test 7 — 15 Questions

Question 1

During a security incident, a security engineer needs to capture network traffic between an EC2 instance and an attacker's IP address for forensic analysis. The engineer has already identified the attacker's IP from CloudTrail logs. Which action captures the traffic without affecting the instance?

Accepted Answer

Create a VPC Traffic Mirroring session targeting the instance's ENI and mirror the traffic to a Network Load Balancer for capture.. Option D is correct because VPC Traffic Mirroring captures all network traffic at the Elastic Network Interface (ENI) level without any performance impact or configuration change on the EC2 instance itself. It copies the traffic to a Network Load Balancer (NLB) or another target for capture and analysis, making it ideal for forensic investigation without disrupting the running instance.

Answer

Update the network ACL to log all traffic to and from the attacker's IP.

Answer

Enable VPC Flow Logs on the subnet and query logs for the attacker's IP.

Answer

SSH into the instance and run tcpdump with a filter for the attacker's IP.

Question 2

A company has a serverless application using AWS Lambda functions that process sensitive data. The security team wants to detect potential data exfiltration via DNS queries from the Lambda functions. Which service should be enabled to monitor DNS requests?

Accepted Answer

Amazon Route 53 Resolver DNS Firewall. Amazon Route 53 Resolver DNS Firewall is the correct choice because it provides DNS-layer filtering for outbound DNS queries from VPCs, including those made by Lambda functions. It can log and block DNS requests to known malicious domains, enabling detection of data exfiltration attempts that use DNS tunneling or command-and-control (C2) communication. This service integrates with VPC flow logs and CloudWatch to monitor DNS query patterns specifically.

Answer

AWS WAF

Answer

Amazon CloudWatch Logs

Answer

AWS GuardDuty

Question 3

A security engineer is investigating a potential compromise of an IAM user. The engineer sees that the user's access keys were used from an IP address outside the company's allowed geography. Which AWS service can provide the most immediate notification of such anomalous API calls?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior, including anomalous API calls from unusual geographies. It uses machine learning and integrated threat intelligence to analyze CloudTrail events, VPC flow logs, and DNS logs in near real-time, enabling immediate notification of suspicious activity such as access key usage from an unexpected IP address.

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Answer

Amazon CloudWatch

Question 4

A company has a multi-account AWS environment with hundreds of accounts. The security team needs to ensure that all security findings from GuardDuty, Security Hub, and Detective are centrally collected and correlated. Which architecture is the MOST scalable and cost-effective?

Accepted Answer

Enable AWS Security Hub as the central aggregator, with GuardDuty and Detective integrated. Use Security Hub cross-account aggregation.. Option B is correct because AWS Security Hub natively supports cross-account aggregation via a delegated administrator, allowing findings from GuardDuty, Security Hub, and Detective to be centrally collected without custom code. This architecture is both scalable (handles hundreds of accounts without polling or custom infrastructure) and cost-effective (no additional Lambda, DynamoDB, or S3 query costs), leveraging built-in integrations and consolidated findings views.

Answer

Deploy a central Lambda function that polls each account's GuardDuty, Security Hub, and Detective APIs and stores findings in DynamoDB.

Answer

Configure each account to send findings to a central CloudWatch Logs log group and use CloudWatch Logs Insights to correlate.

Answer

Stream all findings from all services to a central Amazon S3 bucket and use Amazon Athena to query them.

Question 5

A security engineer is configuring an automated response to a GuardDuty finding that indicates a compromised EC2 instance. The engineer wants to isolate the instance by changing its security group to a 'quarantine' group. Which AWS service is BEST suited to automate this response?

Accepted Answer

Amazon EventBridge. Amazon EventBridge is the best choice because it can directly receive GuardDuty findings as events and trigger an automated response, such as invoking a Lambda function or Systems Manager Automation runbook to change the EC2 instance's security group to a quarantine group. EventBridge provides native integration with GuardDuty via its default event bus, enabling real-time, event-driven automation without additional orchestration overhead.

Answer

AWS Step Functions

Answer

AWS Config

Answer

AWS Systems Manager Automation

Question 6

During an incident response, a security engineer needs to collect memory forensics from a running EC2 instance without shutting it down. The instance is running Amazon Linux 2. Which tool is MOST appropriate?

Accepted Answer

LiME (Linux Memory Extractor). LiME (Linux Memory Extractor) is the most appropriate tool for capturing volatile memory from a running Amazon Linux 2 EC2 instance without shutting it down. It is specifically designed to dump RAM contents to a file or over a network, minimizing the footprint on the target system and ensuring the integrity of the forensic acquisition.

Answer

tcpdump

Answer

Volatility

Answer

dd command to capture /dev/mem

Question 7

A company uses AWS Organizations and has GuardDuty enabled in all accounts. The security team wants to suppress low-severity findings that are known false positives for a specific member account. How can this be achieved with minimal administrative overhead?

Accepted Answer

In the member account, create a suppression rule in GuardDuty for the specific finding types.. Option B is correct because GuardDuty supports suppression rules that can be created at the member account level to automatically archive low-severity findings that are known false positives. This approach allows the member account to manage its own findings without requiring changes to the GuardDuty configuration in the management account or other accounts, minimizing administrative overhead.

Answer

Disable GuardDuty for that member account and rely on other accounts.

Answer

Use AWS Security Hub insights to filter out those findings from the aggregated view.

Answer

Ask the delegated administrator to add a suppression rule in the GuardDuty console for that account.

Question 8

A security engineer is designing an incident response plan for a compromised S3 bucket. Which TWO actions should be taken to contain the incident? (Choose TWO.)

Accepted Answer

Enable CloudTrail data events for the bucket to log all object-level operations.. Enabling CloudTrail data events for the S3 bucket (Option C) is a critical detective control that logs all object-level operations (e.g., GetObject, PutObject, DeleteObject). This allows the security engineer to perform forensic analysis, identify the scope of the compromise, and understand the attacker's actions, which is essential for containment and remediation. While not a direct containment action, it is a necessary step to gather evidence before or during containment.

Answer

Delete the bucket and recreate it.

Answer

Enable MFA Delete on the bucket.

Answer

Enable default encryption for the bucket.

Question 9

An organization is using Amazon EKS for container workloads. The security team wants to detect container escape attempts. Which THREE AWS services or features should be enabled? (Choose THREE.)

Accepted Answer

AWS Security Hub. Amazon GuardDuty with EKS Runtime Monitoring (Option D) detects container escape attempts by monitoring Kubernetes audit logs and runtime behavior at the host and container level. AWS CloudTrail (Option E) records API calls to EKS, including suspicious actions like unauthorized pod creation or privilege escalation. AWS Security Hub (Option B) aggregates findings from GuardDuty and CloudTrail, providing a centralized view of container escape alerts and enabling automated incident response workflows.

Answer

AWS WAF

Answer

VPC Flow Logs

Question 10

A security engineer needs to detect and respond to malware on an EC2 instance. Which TWO AWS services can be used together to achieve this? (Choose TWO.)

Accepted Answer

AWS Lambda. AWS Lambda is correct because it can be used as a serverless compute target to automate incident response actions when malware is detected. For example, a Lambda function can be triggered by a GuardDuty finding to isolate the compromised EC2 instance by modifying security group rules or detaching the instance from an Auto Scaling group, enabling rapid, automated remediation without manual intervention.

Answer

Amazon Inspector

Answer

Amazon CloudWatch

Answer

AWS WAF

Question 11

A security engineer receives an Amazon GuardDuty finding for 'UnauthorizedAccess:EC2/SSHBruteForce'. The engineer needs to automatically isolate the compromised EC2 instance and then perform forensic analysis. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Create an Amazon EventBridge rule that triggers an AWS Lambda function to isolate the instance by modifying its security group and then take a forensic snapshot.. Option B is correct because it automates the isolation and forensic capture of the compromised EC2 instance with minimal operational overhead. An Amazon EventBridge rule listens for the specific GuardDuty finding and triggers an AWS Lambda function that modifies the instance's security group to deny all inbound/outbound traffic (isolation) and then creates an EBS snapshot for forensic analysis. This serverless, event-driven approach eliminates manual intervention and ensures consistent, rapid response.

Answer

Manually SSH into the instance, stop it, and create an AMI for analysis.

Answer

Use AWS Config rules to automatically stop the instance.

Answer

Configure an Auto Scaling lifecycle hook to terminate the instance and launch a new one.

Question 12

A company uses AWS CloudTrail to log API calls in all accounts. The security team wants to be notified immediately when an IAM user creates a new access key for another user. Which combination of services should the team use?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Logs, and Amazon Simple Notification Service (SNS).. Option D is correct because it uses CloudTrail to capture the CreateAccessKey API call, sends those logs to CloudWatch Logs, and then triggers a CloudWatch alarm that publishes to an SNS topic for immediate notification. This combination provides real-time alerting on the specific IAM event without requiring additional services.

Answer

AWS Config and Amazon Simple Email Service (SES).

Answer

Amazon GuardDuty and Amazon Simple Notification Service (SNS).

Answer

Amazon Macie and AWS Lambda.

Question 13

A company has a multi-account AWS environment using AWS Organizations. The security team uses AWS Security Hub to consolidate findings. They notice that a critical finding in the production account is not being aggregated in Security Hub. The finding is generated by Amazon GuardDuty. What is the MOST likely cause?

Accepted Answer

Amazon GuardDuty is not enabled in the production account.. Amazon Security Hub aggregates findings from enabled security services across accounts. For GuardDuty findings to appear in Security Hub, GuardDuty must be enabled in the account where the finding is generated. If GuardDuty is not enabled in the production account, it cannot produce findings for Security Hub to consume, which is the most likely cause of the missing critical finding.

Answer

The IAM role for Security Hub does not have permissions to read GuardDuty findings.

Answer

AWS Config is not enabled in the production account.

Answer

VPC Flow Logs are not enabled in the production account.

Question 14

A security engineer is investigating a potential data exfiltration incident. The engineer suspects that an attacker is using an Amazon S3 bucket to exfiltrate data. Which AWS service can be used to analyze S3 access logs and detect anomalous patterns?

Accepted Answer

Amazon Athena. Amazon Athena is the correct choice because it allows you to run SQL queries directly against Amazon S3 access logs stored in S3, enabling you to analyze large volumes of log data for anomalous patterns such as unusual data transfer volumes, repeated access from unfamiliar IP ranges, or unexpected object reads. This serverless query service is purpose-built for ad-hoc analysis of structured and semi-structured data in S3 without needing to load data into a separate database, making it ideal for incident response investigations.

Answer

Amazon CloudFront

Answer

AWS Shield

Answer

AWS WAF

Question 15

A company's security team is designing an incident response plan for AWS resources. They want to ensure that when a security incident is detected in a production account, a pre-defined runbook is executed automatically. The runbook includes steps to isolate the compromised resource and collect forensic evidence. Which combination of services should the team use to implement this automation?

Accepted Answer

AWS Systems Manager Incident Manager and AWS Systems Manager Automation. AWS Systems Manager Incident Manager provides the incident management lifecycle, including automated response plans that trigger runbooks when an incident is detected. AWS Systems Manager Automation runbooks contain predefined steps (e.g., isolating EC2 instances, capturing memory dumps, and collecting logs) that can be executed automatically. This combination directly meets the requirement for a pre-defined runbook that isolates the compromised resource and collects forensic evidence.

Answer

Amazon EventBridge and AWS Lambda

Answer

AWS Config and Amazon EC2 Auto Scaling

Answer

AWS Step Functions and AWS Lambda