SCS-C02 Threat Detection and Incident Response Practice Test 8 — 15 Questions

Question 1

A company uses AWS Organizations with multiple accounts. The security team wants to centrally aggregate and analyze VPC Flow Logs from all accounts. Which solution is MOST efficient and scalable?

Accepted Answer

Configure VPC Flow Logs to send to Amazon Kinesis Data Firehose in each account, which delivers to a central Amazon OpenSearch Service domain.. Amazon Kinesis Data Firehose can directly receive VPC Flow Logs from each account and deliver them to a centralized Amazon OpenSearch Service domain, enabling near-real-time aggregation and analysis without intermediate storage or replication overhead. This architecture is serverless, scales automatically, and avoids the complexity of managing cross-account S3 replication or EC2 instances, making it the most efficient and scalable solution for centralized log analysis.

Answer

Configure VPC Flow Logs to send to an S3 bucket in each account and use S3 Cross-Region Replication to a central bucket.

Answer

Launch Amazon EC2 instances in each account to run tcpdump and send logs to a central S3 bucket.

Answer

Configure VPC Flow Logs to send to CloudWatch Logs in each account and use cross-account CloudWatch dashboards.

Question 2

A security engineer receives an AWS GuardDuty finding for 'UnauthorizedAccess:EC2/SSHBruteForce'. The affected EC2 instance has a public IP and is in a public subnet. What is the IMMEDIATE step to contain the threat?

Accepted Answer

Update the security group to deny inbound SSH from the attacker's IP address.. Updating the security group to deny inbound SSH from the attacker's IP address immediately blocks the brute force attempts at the instance level without disrupting legitimate traffic from other sources. Security groups are stateful and act as a virtual firewall for EC2 instances, so denying the specific attacker IP for port 22 (SSH) stops the attack while preserving the instance's availability and other services.

Answer

Stop the EC2 instance to stop the brute force attempts.

Answer

Change the security group name to 'Quarantine' and remove all rules.

Answer

Modify the network ACL to deny all inbound traffic from the attacker's IP address range.

Question 3

A company's AWS Lambda function that processes sensitive data is triggering unexpectedly. The security team wants to investigate using AWS CloudTrail. What should they look for?

Accepted Answer

`Invoke` events in CloudTrail from the Lambda service.. `Invoke` events in CloudTrail record every invocation of a Lambda function, including the source (e.g., AWS service, SDK, or console) and the identity that triggered it. By analyzing these events, the security team can identify unexpected triggers, such as unauthorized IAM users or roles invoking the function, or anomalous invocation patterns that indicate a potential security issue.

Answer

`UpdateFunctionConfiguration` events in CloudTrail from the Lambda service.

Answer

`CreateFunction` events in CloudTrail from the Lambda service.

Answer

`PutSubscriptionFilter` events in CloudTrail from CloudWatch Logs.

Question 4

During a security incident, a security engineer needs to collect EBS snapshots of multiple EC2 instances across different accounts in AWS Organizations. The snapshots must be copied to a central forensics account. Which combination of steps is MOST efficient?

Accepted Answer

Use AWS Backup to create backup plans in each account and enable cross-account backup copy to the forensics account.. AWS Backup is the most efficient solution because it natively supports cross-account backup copy, allowing you to create backup plans in each account and automatically copy EBS snapshots to a central forensics account without custom scripting or manual intervention. This integrates directly with AWS Organizations, enabling centralized management of backup policies across multiple accounts, which is ideal for incident response scenarios requiring rapid, consistent snapshot collection.

Answer

Use Amazon Data Lifecycle Manager (DLM) to create snapshots and copy them to the forensics account using S3 cross-region replication.

Answer

Use AWS CloudFormation StackSets to deploy a stack that creates snapshots and copies them manually.

Answer

Use AWS Systems Manager Automation to run scripts in each account that create snapshots and copy them to the forensics account via Lambda.

Question 5

A security engineer is reviewing AWS CloudTrail and notices `AssumeRole` API calls to a role that should not be assumed by the source identity. What is the FIRST step in the incident response process?

Accepted Answer

Investigate the source IP address and user agent of the `AssumeRole` calls.. The first step in any incident response process is to investigate and gather evidence to understand the scope and impact of the potential security event. Option C is correct because analyzing the source IP address and user agent of the `AssumeRole` API calls provides critical forensic data to determine if the activity is malicious or a false positive, without disrupting operations or destroying evidence. AWS CloudTrail logs these details, enabling the security engineer to trace the origin of the unauthorized assumption before taking any containment or remediation actions.

Answer

Enable AWS GuardDuty to detect future anomalies.

Answer

Delete the IAM role immediately.

Answer

Disable the AWS account and contact support.

Question 6

A company uses Amazon S3 to store sensitive data. The security team wants to detect and alert on public read access to S3 buckets. Which combination of AWS services is MOST appropriate?

Accepted Answer

Amazon Macie with automated discovery jobs and Amazon CloudWatch Events to send alerts.. Amazon Macie is purpose-built for discovering and protecting sensitive data in S3, and its automated discovery jobs can detect public read access to buckets. By integrating with Amazon CloudWatch Events, Macie can trigger alerts in real-time when such access is identified, making it the most appropriate choice for this detection and alerting requirement.

Answer

AWS CloudTrail and Amazon CloudWatch Logs with metric filters for `PutBucketPolicy` events.

Answer

Amazon GuardDuty and AWS Lambda.

Answer

AWS Config with managed rules like `s3-bucket-public-read-prohibited` and Amazon SNS.

Question 7

A security engineer is investigating a potential data exfiltration from an AWS account. Which TWO CloudTrail events would be MOST indicative of data exfiltration via S3?

Accepted Answer

`CopyObject` API calls from a production bucket to a bucket in another AWS account.. `CopyObject` API calls from a production bucket to a bucket in another AWS account indicate data being replicated or moved across account boundaries, which is a strong signal of potential data exfiltration. This action bypasses typical network controls and can transfer large volumes of data without requiring a download, making it a common exfiltration technique.

Answer

`PutObject` API calls from a known internal IP.

Answer

`ListObjects` API calls from an EC2 instance in the same VPC.

Answer

`DeleteObject` API calls from the root user.

Question 8

A security team is implementing automated response to AWS GuardDuty findings. Which THREE actions should be taken to ensure proper incident response?

Accepted Answer

Create an AWS Lambda function that automatically modifies the security group of the affected instance to block all traffic.. Isolating the affected instance by modifying its security group to block all traffic is a common containment strategy that stops malicious network activity without destroying evidence. This approach allows the security team to perform forensic analysis and remediation while preventing further compromise, aligning with AWS incident response best practices.

Answer

Terminate the affected instance immediately to neutralize the threat.

Answer

Disable AWS CloudTrail to prevent further logging of malicious activity.

Question 9

Which TWO AWS services can be used to detect anomalous API calls in an AWS account?

Accepted Answer

AWS CloudTrail with Amazon CloudWatch Logs metric filters.. AWS CloudTrail with Amazon CloudWatch Logs metric filters is correct because CloudTrail records all API calls, and you can create metric filters on CloudWatch Logs to match patterns indicative of anomalous activity (e.g., unauthorized API calls, root user activity). When the filter triggers a threshold, it can send an alarm via Amazon SNS, enabling detection of anomalous API calls in near real-time.

Answer

AWS Shield Advanced.

Answer

AWS Config with managed rules.

Answer

AWS WAF.

Question 10

A security engineer is analyzing VPC Flow Logs and sees the entry above. The source IP 203.0.113.5 is flagged as suspicious. What additional information would help determine if this is malicious?

Accepted Answer

CloudTrail logs for any `ConsoleLogin` or `AssumeRole` events from 203.0.113.5.. VPC Flow Logs capture network traffic metadata (IPs, ports, protocols) but not the identity or authentication context of the source. CloudTrail logs record API calls, including ConsoleLogin and AssumeRole events, which can reveal whether 203.0.113.5 is associated with an authenticated user or role. If no such events exist, the traffic is likely from an unauthenticated external source, strengthening the case for malicious activity.

Answer

The source port used by 203.0.113.5.

Answer

Network ACL changes associated with the destination subnet.

Answer

Amazon GuardDuty findings for the destination 10.0.1.5.

Question 11

A security engineer creates an Amazon CloudWatch Events rule with this event pattern to trigger an AWS Lambda function for automated response to GuardDuty findings. However, the Lambda function is not triggered for new findings. What is the MOST likely cause?

Accepted Answer

The event pattern does not match the actual structure of GuardDuty findings.. The event pattern provided in the CloudWatch Events rule must exactly match the JSON structure of a GuardDuty finding as it is published to the default event bus. GuardDuty findings are delivered with a specific schema that includes a `detail` object containing `type`, `severity`, and other fields. If the event pattern uses incorrect field names, nesting, or missing required elements (e.g., `source` must be `aws.guardduty`), CloudWatch Events will not match the incoming events, and the Lambda function will not be triggered.

Answer

The finding type is not specified in the pattern.

Answer

CloudTrail is not enabled in the account.

Answer

The Lambda function does not have permission to be invoked by CloudWatch Events.

Question 12

A security engineer is investigating a potential data exfiltration from an S3 bucket. The engineer needs to identify which IAM role or user accessed the bucket and from which IP address. Which AWS service should the engineer use to obtain this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to S3, including the IAM role or user identity (via the `userIdentity` field) and the source IP address (via the `sourceIPAddress` field). For data exfiltration investigation, you need these specific details from management events or data events (e.g., `GetObject`, `PutObject`), which CloudTrail captures. Other services either lack identity-level detail or focus on network-level traffic without user attribution.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Question 13

A security engineer is designing an automated incident response workflow for an Amazon EC2 instance that is compromised. The workflow must isolate the instance by removing it from the security group that allows SSH access. The engineer wants to use AWS Systems Manager Automation to run a document. What is the most secure way to grant the automation the necessary permissions to modify the security group?

Accepted Answer

Create a Systems Manager Automation service role with a least-privilege policy that includes ec2:ModifySecurityGroupRules and use that role in the automation.. Systems Manager Automation can assume a dedicated service role with a least-privilege IAM policy that includes the specific action `ec2:ModifySecurityGroupRules`. This follows the security best practice of granting only the permissions required for the automation to modify the security group, without exposing broader privileges or relying on user or instance credentials.

Answer

Create an AWS Lambda function with permissions to modify the security group and call it from the automation.

Answer

Use the IAM user's permissions that trigger the automation.

Answer

Attach an IAM policy to the EC2 instance's instance profile that allows ec2:ModifySecurityGroupRules.

Question 14

A company uses AWS Organizations with multiple accounts. The security team wants to centrally aggregate and analyze VPC Flow Logs from all accounts. Which solution is MOST efficient and scalable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VPC Flow Logs cannot be published directly to an S3 bucket in a different account. The logs must be published to a bucket in the same account as the VPC, and then replicated to the central account.. VPC Flow Logs cannot be published directly to an S3 bucket in a different AWS account. The destination S3 bucket must reside in the same account as the VPC from which the logs are generated. To centralize logs, you must first publish them to a bucket in the same account as the VPC, then use S3 cross-region replication or a similar mechanism to copy them to the central logging account. This is a fundamental limitation of the VPC Flow Logs service.

Answer

AWS CloudTrail is not enabled in the member accounts.

Answer

The VPC Flow Logs must be delivered to CloudWatch Logs first, then exported to S3.

Answer

The S3 bucket policy does not allow the s3:PutObject action for the member accounts.

Question 15

A security engineer is configuring Amazon GuardDuty in a multi-account environment using AWS Organizations. The engineer wants to designate a delegated administrator account to manage GuardDuty for all member accounts. Which AWS service must be used to enable GuardDuty for all accounts?

Accepted Answer

AWS Organizations. AWS Organizations is the foundational service required to designate a delegated administrator for Amazon GuardDuty in a multi-account environment. GuardDuty integrates directly with Organizations to allow a management account to enable GuardDuty for all member accounts and delegate administration to a specified account, which then manages threat detection across the organization without needing additional services.

Answer

AWS CloudFormation StackSets

Answer

AWS Control Tower

Answer

AWS Config