SCS-C02 Threat Detection and Incident Response Practice Question
Exhibit
Refer to the exhibit.
```
{
"Records": [
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"arn": "arn:aws:iam::123456789012:user/JohnDoe",
"accountId": "123456789012",
"accessKeyId": "AKIAIOSFODNN7EXAMPLE"
},
"eventTime": "2024-08-01T12:34:56Z",
"eventSource": "ec2.amazonaws.com",
"eventName": "AuthorizeSecurityGroupIngress",
"awsRegion": "us-east-1",
"sourceIPAddress": "203.0.113.5",
"userAgent": "console.amazonaws.com",
"requestParameters": {
"groupId": "sg-0123456789abcdef0",
"ipPermissions": {
"items": [
{
"ipProtocol": "tcp",
"fromPort": 22,
"toPort": 22,
"ipRanges": [
{
"cidrIp": "0.0.0.0/0"
}
]
}
]
}
}
}
]
}
```A security engineer is reviewing a CloudTrail log entry (exhibit). What is the most immediate security concern indicated by this event?
⚠ Common exam trap
The trap here is that candidates focus on the user identity or authentication details (like MFA or CLI usage) instead of recognizing that the actual API action—opening SSH to 0.0.0.0/0—is the most immediate and dangerous security concern.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A security group rule was added allowing SSH access from any IP address.
The CloudTrail log shows an AuthorizeSecurityGroupIngress API call that added a security group rule with the CIDR 0.0.0.0/0 for port 22 (SSH). This effectively opens SSH access to the entire internet, creating a severe exposure that could allow any attacker to attempt brute-force or credential-stuffing attacks against any EC2 instance associated with that security group. This is the most immediate security concern because it directly introduces a wide-open attack surface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The source IP address 203.0.113.5 is from a known malicious IP range.
Why it's wrong here
The IP address 203.0.113.5 belongs to TEST-NET-3 (203.0.113.0/24), a range reserved by RFC 5737 specifically for documentation and examples, so it is not a real internet-routable address. CloudTrail records sourceIPAddress as a descriptive field, but a documentation/test range cannot be treated as a known malicious range from threat intelligence. The presence of this IP is therefore not the security-relevant finding in this log entry.
- ✓
A security group rule was added allowing SSH access from any IP address.
Why this is correct
The CloudTrail event shows eventName AuthorizeSecurityGroupIngress with request parameters that add a security group ingress rule. Specifically, it opens port 22 (SSH) to 0.0.0.0/0, meaning all IPv4 addresses on the internet can attempt SSH connections to the associated EC2 instance. This is a well-known misconfiguration that exposes administrative access externally and is the correct security finding to investigate.
- ✗
The API call was made from the AWS CLI, which may indicate a compromised access key.
Why it's wrong here
The log entry's userAgent is console.amazonaws.com, which indicates the request was made through the AWS Management Console, not the AWS CLI. CLI calls would have a userAgent such as aws-cli/2.x or botocore/1.x and require configured access keys. Because the entry clearly points to the console, the premise that the API call came from the CLI is false, and no conclusion about a compromised access key can be drawn from this field.
- ✗
The user JohnDoe did not use multi-factor authentication (MFA) for this API call.
Why it's wrong here
CloudTrail log entries for API calls do not include a standard MFA-status field; while some console sign-in events may contain additionalEventData with mfaUsed, that information is not present in this particular event. Whether JohnDoe authenticated with MFA cannot be determined from the fields shown in this entry, such as eventName, userIdentity, sourceIPAddress, and userAgent. Therefore this statement is unsupported and is not the security-relevant observation for this log entry.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.