SCS-C02 Threat Detection and Incident Response Practice Test 7 — 15 Questions

Question 1

A company has a multi-account AWS environment using AWS Organizations. The security team uses AWS Security Hub to consolidate findings. They notice that a critical finding in the production account is not being aggregated in Security Hub. The finding is generated by Amazon GuardDuty. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon GuardDuty is not enabled in the production account.. Amazon Security Hub aggregates findings from enabled security services across accounts. For GuardDuty findings to appear in Security Hub, GuardDuty must be enabled in the account where the finding is generated. If GuardDuty is not enabled in the production account, it cannot produce findings for Security Hub to consume, which is the most likely cause of the missing critical finding.

Answer

The IAM role for Security Hub does not have permissions to read GuardDuty findings.

Answer

AWS Config is not enabled in the production account.

Answer

VPC Flow Logs are not enabled in the production account.

Question 2

A security engineer is investigating a potential data exfiltration incident. The engineer suspects that an attacker is using an Amazon S3 bucket to exfiltrate data. Which AWS service can be used to analyze S3 access logs and detect anomalous patterns?

Accepted Answer

Amazon Athena. Amazon Athena is the correct choice because it allows you to run SQL queries directly against Amazon S3 access logs stored in S3, enabling you to analyze large volumes of log data for anomalous patterns such as unusual data transfer volumes, repeated access from unfamiliar IP ranges, or unexpected object reads. This serverless query service is purpose-built for ad-hoc analysis of structured and semi-structured data in S3 without needing to load data into a separate database, making it ideal for incident response investigations.

Answer

Amazon CloudFront

Answer

AWS Shield

Answer

AWS WAF

Question 3

A company's security team is designing an incident response plan for AWS resources. They want to ensure that when a security incident is detected in a production account, a pre-defined runbook is executed automatically. The runbook includes steps to isolate the compromised resource and collect forensic evidence. Which combination of services should the team use to implement this automation?

Accepted Answer

AWS Systems Manager Incident Manager and AWS Systems Manager Automation. AWS Systems Manager Incident Manager provides the incident management lifecycle, including automated response plans that trigger runbooks when an incident is detected. AWS Systems Manager Automation runbooks contain predefined steps (e.g., isolating EC2 instances, capturing memory dumps, and collecting logs) that can be executed automatically. This combination directly meets the requirement for a pre-defined runbook that isolates the compromised resource and collects forensic evidence.

Answer

Amazon EventBridge and AWS Lambda

Answer

AWS Config and Amazon EC2 Auto Scaling

Answer

AWS Step Functions and AWS Lambda

Question 4

A company uses AWS CloudTrail to log all API activity. The security team needs to retain the logs for 7 years and ensure they are tamper-proof. Additionally, the team must be able to query the logs for investigations. Which solution meets these requirements?

Accepted Answer

Store logs in an Amazon S3 bucket with S3 Object Lock enabled and query using Amazon Athena.. Amazon S3 Object Lock provides a write-once-read-many (WORM) model that prevents logs from being deleted or overwritten, ensuring tamper-proof retention for 7 years. Amazon Athena allows querying the logs directly in S3 using standard SQL, meeting the investigation requirement without needing to move data.

Answer

Store logs in AWS CloudTrail Lake and use the built-in query feature.

Answer

Store logs in Amazon CloudWatch Logs with a retention policy of 7 years.

Answer

Store logs in an Amazon S3 bucket with standard settings and use Amazon S3 Select for querying.

Question 5

A security engineer is analyzing a potential security incident involving an Amazon RDS for MySQL database. The engineer suspects that a SQL injection attack was successful. Which AWS service can the engineer use to review the actual SQL queries that were executed against the database?

Accepted Answer

Amazon RDS Audit Logs. Amazon RDS for MySQL supports audit logs that capture detailed records of database activities, including the actual SQL queries executed. By enabling the `audit_log` plugin and configuring the `server_audit_events` parameter, the engineer can review the exact SQL statements that were run, which is essential for identifying a SQL injection attack. This is the only AWS service that provides query-level visibility into RDS database operations.

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 6

A company uses Amazon GuardDuty to detect threats. The security team wants to be alerted when GuardDuty generates a finding with a severity level of HIGH or CRITICAL. Which AWS service should the team use to send notifications based on GuardDuty findings?

Accepted Answer

Amazon EventBridge and Amazon Simple Notification Service (SNS). Amazon EventBridge can capture GuardDuty findings as events using a rule that matches the 'GuardDuty Finding' event type. The rule can then invoke an SNS topic to send email or SMS notifications. This is the recommended pattern because EventBridge provides native integration with GuardDuty and supports filtering by finding severity using event patterns, while SNS handles the actual notification delivery.

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Lambda

Answer

Amazon CloudWatch Logs and Amazon Simple Notification Service (SNS)

Question 7

A company's incident response team is using AWS Systems Manager to run commands on EC2 instances for forensic analysis. The team needs to ensure that the commands are run with minimal latency and that the results are stored securely. Which Systems Manager capability should the team use?

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Run Command is the correct capability because it allows the incident response team to execute commands on EC2 instances with minimal latency by using the SSM Agent to run scripts or commands directly, and it can store command output in Amazon S3 or CloudWatch Logs for secure, durable storage. This meets the requirement for low-latency execution and secure result storage without requiring interactive sessions or complex automation workflows.

Answer

AWS Systems Manager Automation

Answer

AWS Systems Manager Session Manager

Answer

AWS Systems Manager Patch Manager

Question 8

A security engineer is investigating a potential compromise of an EC2 instance. The engineer wants to capture volatile memory data and create a forensic image of the instance's EBS volumes. Which TWO actions should the engineer take? (Choose 2.)

Accepted Answer

Use AWS Systems Manager Run Command to execute a memory capture script.. AWS Systems Manager Run Command allows you to remotely execute scripts on EC2 instances without needing SSH access, which is critical during incident response to capture volatile memory data before the instance is compromised further. Option D is correct because creating an EBS snapshot provides a point-in-time forensic image of the root volume that can be analyzed offline without altering the original evidence.

Answer

Enable AWS CloudTrail for the instance.

Answer

Use AWS Backup to create a backup of the instance.

Answer

Use Amazon Inspector to scan the instance for vulnerabilities.

Question 9

A company's security team is configuring Amazon GuardDuty to detect crypto-mining activities on EC2 instances. Which THREE indicators should the team monitor? (Choose 3.)

Accepted Answer

Outbound connections to IP addresses on port 3333.. Crypto-mining malware often uses port 3333 for communication with mining pools or command-and-control servers. GuardDuty can detect outbound connections to known malicious IP addresses on this port as part of its threat intelligence feeds, which include indicators of compromise (IOCs) associated with crypto-mining activity.

Answer

High volume of inbound network traffic.

Answer

High disk I/O operations.

Question 10

A company is designing an incident response plan for AWS. The plan must include the ability to collect forensic data from EC2 instances without requiring SSH key pairs. Which TWO AWS services can be used to acquire forensic data from EC2 instances without remote access? (Choose 2.)

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Run Command allows you to run scripts or commands on EC2 instances via the SSM Agent, without requiring SSH keys or direct network access. This enables forensic data collection (e.g., memory dumps, log files) by executing commands remotely through the AWS Systems Manager service, using IAM roles for authentication.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 11

Your company has a single AWS account with a production VPC that contains several EC2 instances running a web application. The security team has enabled Amazon GuardDuty and AWS CloudTrail. Recently, GuardDuty reported a finding 'UnauthorizedAccess:EC2/TorClient' for one of the instances. The finding indicates that the instance is making connections to Tor exit nodes. You need to investigate and contain the incident. The instance is critical to the application and cannot be terminated. You have a forensic analysis instance in a separate security group. What should you do FIRST?

Accepted Answer

Isolate the instance by modifying its security group to remove all inbound and outbound rules except for the forensic analysis instance.. The first step in incident response for a compromised instance that cannot be terminated is to contain the threat by isolating it from the network. Modifying the security group to remove all inbound and outbound rules except for a specific forensic analysis instance prevents the compromised EC2 instance from communicating with Tor exit nodes or other external hosts, while still allowing controlled forensic access. This containment is immediate and reversible, aligning with the AWS incident response best practice of 'isolate first, investigate later'.

Answer

Terminate the instance immediately and launch a replacement.

Answer

Take an EBS snapshot of the instance's root volume for analysis.

Answer

Use AWS Systems Manager Run Command to install a forensic agent on the instance.

Question 12

Your organization uses AWS Organizations with 50 member accounts. You are the security administrator for the root account. You have enabled AWS CloudTrail in all accounts and centralized the logs in an S3 bucket in the root account. You also enabled Amazon GuardDuty in the root account and have delegated an administrator account. Recently, you received an alert from GuardDuty about a potential credential compromise in a member account. The finding indicates that an IAM user in that account made an API call from an unusual IP address. You need to quickly gather all CloudTrail events for that user from the last 30 days across all accounts. The logs are stored in a single S3 bucket with a prefix structure like 'AWSLogs//CloudTrail////'. What is the MOST efficient way to query these logs?

Accepted Answer

Use Amazon Athena to query the CloudTrail logs by creating a table partitioned by account, region, and date.. Amazon Athena is the most efficient way to query CloudTrail logs stored in S3 because it allows you to run SQL queries directly on the data without moving or downloading it. By creating a table partitioned by account, region, and date, you can quickly filter for the specific IAM user's events across all 50 accounts for the last 30 days, leveraging partition pruning to scan only the relevant log files. This approach minimizes data scanned and cost, while providing near-instant results.

Answer

Enable AWS CloudTrail Lake and create a new event data store that includes the historical logs.

Answer

Download all log files from the S3 bucket for the last 30 days and parse them locally.

Answer

Use Amazon CloudWatch Logs Insights to query the logs from the member account.

Question 13

Your company has a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The security team enabled AWS CloudTrail and Amazon GuardDuty. GuardDuty generates a finding 'Recon:EC2/PortProbeUnprotectedPort' for an EC2 instance that does not exist in the account. Upon investigation, you realize that the finding is triggered by a misconfigured Network Load Balancer (NLB) that is exposing a port to the internet. The NLB is used by the API Gateway. You need to reduce false positives for this specific finding. What should you do?

Accepted Answer

Create a suppression rule in GuardDuty to filter out findings for the NLB's public IP and port.. GuardDuty suppression rules allow you to filter out findings that are known false positives based on specific criteria, such as the public IP and port of the NLB. Since the NLB is intentionally exposing a port for API Gateway, the port probe finding is expected behavior, not a real threat. Suppressing findings for that specific combination reduces noise without disabling GuardDuty for the entire account.

Answer

Change the NLB to an Application Load Balancer.

Answer

Enable AWS Shield Advanced to block the probes.

Answer

Disable GuardDuty for the account.

Question 14

A company uses AWS CloudTrail to log all API calls. The security team notices a series of `UpdateTrail` API calls from a user in the Security account, disabling logging on a multi-region trail. The user has a policy that allows `cloudtrail:UpdateTrail` only on trails with a specific tag. However, the trail does not have that tag. What is the MOST likely reason the call succeeded?

Accepted Answer

The trail did not have the required tag at the time of the API call due to a race condition.. AWS IAM policies are evaluated based on the resource's tags at the time of the API call. If the `UpdateTrail` API call was made while the trail's tag was being removed or added, a race condition could cause the trail to temporarily lack the required tag, allowing the action to succeed despite the policy's intent. This is a known edge case in IAM tag-based authorization, where eventual consistency of tag changes can lead to unintended access.

Answer

The trail had an explicit deny in the same policy that was overridden by a separate allow.

Answer

The user's permissions were granted through a service control policy (SCP) that allowed the action.

Answer

CloudTrail API calls are not logged and bypass IAM policies.

Question 15

A company uses AWS Organizations with multiple accounts. The security team wants to centrally collect and analyze VPC Flow Logs from all accounts. What is the MOST efficient way to achieve this?

Accepted Answer

Configure VPC Flow Logs to deliver to a central S3 bucket in the security account, and use a bucket policy that grants the source accounts permission to write.. It uses a central S3 bucket in the security account with a bucket policy that grants the PutObject permission to the VPC Flow Logs delivery service from each source account. This is the most efficient approach as it avoids per-account configuration overhead, eliminates the need for cross-account replication, and provides a single location for centralized analysis using services like Amazon Athena or Amazon QuickSight.

Answer

Use AWS Firewall Manager to deploy VPC Flow Logs and aggregate logs in a single account.

Answer

Configure VPC Flow Logs to deliver to a central CloudWatch Logs log group in the management account.

Answer

Set up VPC Flow Logs in each account to deliver to local S3 buckets, then use S3 replication to copy to a central bucket.