← SCS-C02·Amazon Web Services

Question 34 of 1,738

Threat Detection and Incident Response →hardMultiple ChoiceObjective-mapped

SCS-C02 Threat Detection and Incident Response Practice Question

This SCS-C02 practice question tests your understanding of threat detection and incident response. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application processes sensitive customer data. The Security team has enabled VPC Flow Logs, CloudTrail, and GuardDuty. Recently, the team received a GuardDuty finding indicating a potential SSH brute force attack originating from an external IP address 203.0.113.50 targeting one of the EC2 instances. The Security Engineer needs to automatically isolate the affected instance and capture forensic evidence for analysis. The company has strict requirements: the instance must be isolated immediately, and a snapshot of the EBS volume must be taken before any remediation actions are taken. The instance is part of an Auto Scaling group, and the Security Engineer wants to minimize manual intervention. The Security Engineer has access to AWS Systems Manager and AWS Lambda. Which combination of steps should the Security Engineer implement to meet the requirements?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "minimum / minimize"
Why it matters: Asks for the least resource use — fewest addresses, smallest subnet, lowest overhead. Eliminate over-provisioned options even if they would technically work.
Clue: "immediately / without restart"
Why it matters: Time or reboot constraint — the correct answer must take effect right away without requiring a reboot or reload.

Question 1hardmultiple choice

Read the full NAT/PAT explanation →

A
Use AWS Systems Manager to automatically connect to the instance via EC2 Instance Connect, run commands to capture forensic data, and then modify the security group to deny all inbound traffic.
Why wrong: EC2 Instance Connect requires manual initiation and does not automatically respond to GuardDuty findings. Also, it may not trigger automatically.
B
Create a CloudWatch Logs metric filter on the VPC Flow Logs for the attacker IP. When the metric breaches a threshold, trigger an SNS topic that runs an AWS Systems Manager Automation document to isolate the instance and take an EBS snapshot.
Why wrong: CloudWatch Logs does not directly trigger on GuardDuty findings. GuardDuty integrates with EventBridge. Also, VPC Flow Logs may not capture the attack as quickly as GuardDuty.
C
Configure Amazon EventBridge to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function first calls the EC2 CreateSnapshot API to capture a forensic snapshot of the instance's EBS volume. Then, it uses AWS Systems Manager Automation to run a pre-defined automation document that isolates the instance by modifying the instance's security group to only allow traffic from a trusted management IP, and then stops the instance.
This correctly automates the response: EventBridge triggers on GuardDuty finding, Lambda takes a snapshot first for evidence, then Systems Manager Automation isolates and stops the instance.
D
Configure a CloudWatch Events rule to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function terminates the EC2 instance and then takes a snapshot of the EBS volume for forensic analysis.
Why wrong: Terminating the instance before taking a snapshot loses the evidence. The snapshot must be taken first.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Configure Amazon EventBridge to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function first calls the EC2 CreateSnapshot API to capture a forensic snapshot of the instance's EBS volume. Then, it uses AWS Systems Manager Automation to run a pre-defined automation document that isolates the instance by modifying the instance's security group to only allow traffic from a trusted management IP, and then stops the instance.

Option D is correct because EventBridge can trigger a Lambda function on GuardDuty findings. The Lambda function takes an EBS snapshot for forensic analysis, then uses Systems Manager Automation to isolate the instance by modifying the security group and stopping the instance. This ensures isolation and evidence capture in an automated manner. Option A is wrong because terminating the instance before taking a snapshot loses forensic data. Option B is wrong because EC2 Instance Connect is for direct access, not for automated isolation. Option C is wrong because CloudWatch Logs does not trigger on GuardDuty findings; EventBridge is the appropriate service.

Key principle: NAT direction and interface roles matter as much as the IP address mapping. Inside/outside designation controls which traffic is translated.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use AWS Systems Manager to automatically connect to the instance via EC2 Instance Connect, run commands to capture forensic data, and then modify the security group to deny all inbound traffic.
Why it's wrong here
EC2 Instance Connect requires manual initiation and does not automatically respond to GuardDuty findings. Also, it may not trigger automatically.
✗
Create a CloudWatch Logs metric filter on the VPC Flow Logs for the attacker IP. When the metric breaches a threshold, trigger an SNS topic that runs an AWS Systems Manager Automation document to isolate the instance and take an EBS snapshot.
Why it's wrong here
CloudWatch Logs does not directly trigger on GuardDuty findings. GuardDuty integrates with EventBridge. Also, VPC Flow Logs may not capture the attack as quickly as GuardDuty.
✓
Configure Amazon EventBridge to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function first calls the EC2 CreateSnapshot API to capture a forensic snapshot of the instance's EBS volume. Then, it uses AWS Systems Manager Automation to run a pre-defined automation document that isolates the instance by modifying the instance's security group to only allow traffic from a trusted management IP, and then stops the instance.
Why this is correct
This correctly automates the response: EventBridge triggers on GuardDuty finding, Lambda takes a snapshot first for evidence, then Systems Manager Automation isolates and stops the instance.
Clue confirmation
The clue words "minimum / minimize", "immediately / without restart" in the question point toward this answer.
Related concept
Static NAT maps one inside address to one outside address.
✗
Configure a CloudWatch Events rule to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function terminates the EC2 instance and then takes a snapshot of the EBS volume for forensic analysis.
Why it's wrong here
Terminating the instance before taking a snapshot loses the evidence. The snapshot must be taken first.

Common exam traps

Common exam trap: NAT rules depend on direction and matching traffic

NAT is not only about the public address. The inside/outside interface roles and the ACL or rule that matches traffic are just as important.

Detailed technical explanation

How to think about this question

NAT questions usually test address translation, overload/PAT behaviour, static mappings and whether the right traffic is being translated. Read the interface direction and address terms carefully.

KKey Concepts to Remember

Static NAT maps one inside address to one outside address.
PAT allows many inside hosts to share one public address using ports.
Inside local and inside global describe the private and translated addresses.
NAT ACLs identify traffic for translation, not always security filtering.

TExam Day Tips

Identify inside and outside interfaces first.
Check whether the scenario needs static NAT, dynamic NAT or PAT.
Do not confuse NAT matching ACLs with normal packet-filtering intent.

Key takeaway

NAT direction and interface roles matter as much as the IP address mapping. Inside/outside designation controls which traffic is translated.

Real-world example

How this comes up in practice

A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.

What to study next

Got this wrong? Here's your next step.

Review the four NAT address types (inside local, inside global, outside local, outside global), PAT port overload, and static vs dynamic NAT use cases. Then practise related SCS-C02 NAT questions on configuration and troubleshooting.

Related SCS-C02 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Threat Detection and Incident Response practice questions

Practise SCS-C02 questions linked to Threat Detection and Incident Response.

Security Logging and Monitoring practice questions

Practise SCS-C02 questions linked to Security Logging and Monitoring.

Identity and Access Management practice questions

Practise SCS-C02 questions linked to Identity and Access Management.

Management and Security Governance practice questions

Practise SCS-C02 questions linked to Management and Security Governance.

Infrastructure Security practice questions

Practise SCS-C02 questions linked to Infrastructure Security.

Data Protection practice questions

Practise SCS-C02 questions linked to Data Protection.

SCS-C02 fundamentals practice questions

Practise SCS-C02 questions linked to SCS-C02 fundamentals.

SCS-C02 scenario practice questions

Practise SCS-C02 questions linked to SCS-C02 scenario.

SCS-C02 troubleshooting practice questions

Practise SCS-C02 questions linked to SCS-C02 troubleshooting.

Practice this exam

Start a free SCS-C02 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

SCS-C02 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this SCS-C02 question test?

Threat Detection and Incident Response — This question tests Threat Detection and Incident Response — Static NAT maps one inside address to one outside address..

What is the correct answer to this question?

The correct answer is: Configure Amazon EventBridge to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function first calls the EC2 CreateSnapshot API to capture a forensic snapshot of the instance's EBS volume. Then, it uses AWS Systems Manager Automation to run a pre-defined automation document that isolates the instance by modifying the instance's security group to only allow traffic from a trusted management IP, and then stops the instance. — Option D is correct because EventBridge can trigger a Lambda function on GuardDuty findings. The Lambda function takes an EBS snapshot for forensic analysis, then uses Systems Manager Automation to isolate the instance by modifying the security group and stopping the instance. This ensures isolation and evidence capture in an automated manner. Option A is wrong because terminating the instance before taking a snapshot loses forensic data. Option B is wrong because EC2 Instance Connect is for direct access, not for automated isolation. Option C is wrong because CloudWatch Logs does not trigger on GuardDuty findings; EventBridge is the appropriate service.

What should I do if I get this SCS-C02 question wrong?

Are there clue words in this question I should notice?

Yes — watch for: "minimum / minimize", "immediately / without restart". Asks for the least resource use — fewest addresses, smallest subnet, lowest overhead. Eliminate over-provisioned options even if they would technically work.

What is the key concept behind this question?

Static NAT maps one inside address to one outside address.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.