The most immediate security concern is the addition of a security group rule allowing SSH access from any IP address (0.0.0.0/0) on port 22. This is critical because the AuthorizeSecurityGroupIngress API call in the CloudTrail log directly opens a wide attack surface, enabling any internet-based attacker to attempt brute-force or credential-stuffing attacks against any EC2 instance associated with that security group. On the AWS Certified Security Specialty SCS-C02 exam, analyzing CloudTrail logs for security threats often tests your ability to spot overly permissive ingress rules, especially for sensitive ports like SSH (22) or RDP (3389). A common trap is focusing on failed API calls or IAM actions, but the real danger here is the immediate exposure created by a successful, unrestricted rule. Memory tip: “Zero-zero-zero-zero means open the door for all”—any time you see 0.0.0.0/0 with a management port, flag it as the top security concern.
SCS-C02 Threat Detection and Incident Response Practice Question
This SCS-C02 practice question tests your understanding of threat detection and incident response. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A security group rule was added allowing SSH access from any IP address.
The CloudTrail log shows an AuthorizeSecurityGroupIngress API call that added a security group rule with the CIDR 0.0.0.0/0 for port 22 (SSH). This effectively opens SSH access to the entire internet, creating a severe exposure that could allow any attacker to attempt brute-force or credential-stuffing attacks against any EC2 instance associated with that security group. This is the most immediate security concern because it directly introduces a wide-open attack surface.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The source IP address 203.0.113.5 is from a known malicious IP range.
Why it's wrong here
The IP address is an example (RFC 5735) and not necessarily malicious.
✓
A security group rule was added allowing SSH access from any IP address.
Why this is correct
AuthorizeSecurityGroupIngress with 0.0.0.0/0 on port 22 is a common misconfiguration that exposes the instance to the internet.
Related concept
Read the scenario before looking for a memorised answer.
✗
The API call was made from the AWS CLI, which may indicate a compromised access key.
Why it's wrong here
The userAgent shows 'console.amazonaws.com', indicating the call came from the Management Console, not the CLI.
✗
The user JohnDoe did not use multi-factor authentication (MFA) for this API call.
Why it's wrong here
The CloudTrail log does not include MFA status; it cannot be determined from this entry alone.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates focus on the user identity or authentication details (like MFA or CLI usage) instead of recognizing that the actual API action—opening SSH to 0.0.0.0/0—is the most immediate and dangerous security concern.
Trap categories for this question
Command / output trap
The userAgent shows 'console.amazonaws.com', indicating the call came from the Management Console, not the CLI.
Detailed technical explanation
How to think about this question
Under the hood, the AuthorizeSecurityGroupIngress API modifies the security group's inbound rules in the VPC's distributed firewall; the rule with 0.0.0.0/0 for TCP port 22 is immediately effective across all instances using that group. In a real-world scenario, an attacker scanning AWS IP ranges could discover this open port within minutes and launch a targeted SSH brute-force attack, potentially leading to a full compromise if weak credentials are used. CloudTrail logs capture the exact CIDR and port, making this event a clear red flag for incident response teams.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Threat Detection and Incident Response — This question tests Threat Detection and Incident Response — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: A security group rule was added allowing SSH access from any IP address. — The CloudTrail log shows an AuthorizeSecurityGroupIngress API call that added a security group rule with the CIDR 0.0.0.0/0 for port 22 (SSH). This effectively opens SSH access to the entire internet, creating a severe exposure that could allow any attacker to attempt brute-force or credential-stuffing attacks against any EC2 instance associated with that security group. This is the most immediate security concern because it directly introduces a wide-open attack surface.
What should I do if I get this SCS-C02 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer reviews the CloudTrail log entry in the exhibit. The engineer notices that an EC2 instance was launched using an AdminRole. Which additional information would help determine if this is a legitimate action or a potential compromise?
medium
A.The AMI ID ami-0abcdef1234567890 is not a standard Amazon-provided AMI.
✓ B.The source IP address 203.0.113.50 is from an unexpected geographic location not associated with the company.
C.The instance type m5.xlarge is unusually large compared to previous launches.
D.The security group sg-0123456789abcdef0 allows inbound SSH from 0.0.0.0/0.
Why B: The source IP address 203.0.113.50 is from an unexpected geographic location not associated with the company. In CloudTrail, the `sourceIPAddress` field records the originating IP of the API call. If an AdminRole is used from an IP outside the company's known CIDR ranges or geographic regions, it strongly indicates a potential compromise—such as stolen credentials or an attacker using the role from an unauthorized network. This is a key indicator of anomalous behavior in threat detection.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.