75 of 215 questions · Page 1/3 · Threat Detection topic · Answers revealed
Match each AWS service to its primary security function.
Drag a concept onto its matching description — or click a concept then click the description.
Web application firewall
DDoS protection
Key management and encryption
Identity and access management
Data discovery and classification
Why these pairings
These are core AWS security services with distinct purposes.
A security engineer is investigating a potential compromise of an S3 bucket. The engineer needs to determine if any objects were accessed by an unauthorized user. Which AWS service can provide detailed access logs for S3 objects?
S3 server access logs provide a comprehensive, per-request record of every call made to a bucket, including requester identity, bucket name, object key, request type, HTTP status, error codes, source IP address, User-Agent, and timestamps. This granular data is exactly what is needed to trace unauthorized access or data exfiltration during a compromise. Unlike CloudTrail, server access logs are enabled directly on the S3 bucket and capture all requests, even those that are denied or made anonymously, making them the most direct evidence source.
Why this answer
S3 server access logs provide detailed records of requests made to an S3 bucket, including the requester, bucket name, request time, action, and response status. This granularity is essential for identifying unauthorized access to specific objects, as it logs every GET, PUT, DELETE, and HEAD request at the object level. AWS CloudTrail, while useful for management events, does not log data-level operations like object reads by default unless data events are explicitly enabled, and even then, it may not capture all object-level access details as comprehensively as server access logs.
Exam trap
The trap here is that candidates often assume AWS CloudTrail is sufficient for all logging needs, but the exam specifically tests the distinction between management events (CloudTrail default) and data-level object access logs (S3 server access logs), and that CloudTrail data events require explicit enablement and still lack the granularity of server access logs.
How to eliminate wrong answers
Option A is wrong because AWS CloudTrail primarily logs management events (e.g., bucket creation, policy changes) and, even when data events are enabled for S3, it logs object-level operations at a higher level (e.g., GetObject, PutObject) but does not provide the per-request detail (e.g., HTTP method, object key, response status) that S3 server access logs offer; relying solely on CloudTrail could miss unauthorized access patterns. Option C is wrong because AWS Config is a configuration auditing and compliance service that tracks resource configuration changes (e.g., bucket policies, lifecycle rules) and does not log individual object access requests; it cannot reveal who accessed an object or when. Option D is wrong because Amazon Inspector is a vulnerability assessment service that scans EC2 instances and container workloads for software vulnerabilities and network exposure; it has no capability to log or analyze S3 object access requests.
Which THREE AWS services can be used to detect potentially compromised EC2 instances? (Choose 3.)
VPC Flow Logs record source/destination IPs, ports, and protocol for all traffic in a VPC. Anomalies such as outbound calls to known threat-intel IPs, repeated failed connection attempts, or large data transfers can signal a compromised EC2 instance. However, Flow Logs are raw metadata requiring additional analytics (e.g., Athena queries) to surface threats.
Why this answer
VPC Flow Logs (B) capture IP traffic metadata for ENIs, so you can analyze accepted/rejected flows for signs of compromise such as beaconing to known-bad IPs or unusual outbound traffic. Amazon GuardDuty (D) is a managed threat-detection service that continuously analyzes VPC Flow Logs, CloudTrail events, and DNS logs to identify compromised instances via findings like cryptocurrency mining or communication with malicious hosts. Amazon Inspector (E) scans EC2 instances for software vulnerabilities and unintended network exposure, which helps detect an instance that could be or has been compromised through an exploitable weakness.
AWS WAF (A) is a Layer 7 web application firewall that filters HTTP(S) requests to CloudFront, ALB, or API Gateway, not an EC2 compromise-detection service. AWS Shield (C) provides DDoS protection at the network/transport layer and does not detect compromised EC2 instances.
Exam trap
The trap here is that candidates often confuse AWS WAF (a web-layer filter) or AWS Shield (a DDoS mitigator) with detective services, when the question specifically asks for services that *detect* compromised instances—not prevent attacks or filter traffic.
A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application processes sensitive customer data. The Security team has enabled VPC Flow Logs, CloudTrail, and GuardDuty. Recently, the team received a GuardDuty finding indicating a potential SSH brute force attack originating from an external IP address 203.0.113.50 targeting one of the EC2 instances. The Security Engineer needs to automatically isolate the affected instance and capture forensic evidence for analysis. The company has strict requirements: the instance must be isolated immediately, and a snapshot of the EBS volume must be taken before any remediation actions are taken. The instance is part of an Auto Scaling group, and the Security Engineer wants to minimize manual intervention. The Security Engineer has access to AWS Systems Manager and AWS Lambda. Which combination of steps should the Security Engineer implement to meet the requirements?
This is the correct automated response because Amazon EventBridge natively receives GuardDuty findings and can invoke a Lambda function as a target. The Lambda function first calls the EC2 CreateSnapshot API, ensuring a forensic copy of the EBS volume is preserved before any state changes. Then, instead of terminating the instance, it uses AWS Systems Manager Automation with a predefined document to modify the security group to allow only the trusted management IP, and finally stops the instance—which preserves the instance for further analysis and minimizes the risk of losing evidence.
Why this answer
It uses EventBridge to directly detect the GuardDuty finding, which triggers a Lambda function that first takes an EBS snapshot (forensic capture) via the CreateSnapshot API before any remediation. Then it uses Systems Manager Automation to isolate the instance by modifying the security group to allow only a trusted management IP and stops the instance, ensuring isolation without destroying the instance. This sequence satisfies the strict requirement that a snapshot must be taken before any remediation actions, and it minimizes manual intervention by automating the entire response.
Exam trap
The trap here is that candidates may choose Option D because they think termination is the fastest way to stop the attack, but they overlook the requirement to capture forensic evidence before remediation—termination destroys the instance and prevents a proper snapshot of the running state.
How to eliminate wrong answers
Option A is wrong because it relies on EC2 Instance Connect to manually connect and run commands, which is not automated and does not ensure a snapshot is taken before isolation; modifying the security group after connecting does not guarantee the snapshot requirement is met. Option B is wrong because it uses a CloudWatch Logs metric filter on VPC Flow Logs for the attacker IP, which is an indirect detection method that may have latency and does not directly respond to the GuardDuty finding; it also does not specify taking an EBS snapshot before isolation. Option D is wrong because it terminates the EC2 instance first, which destroys the running instance and may prevent capturing volatile forensic data; the snapshot is taken after termination, violating the requirement to capture forensic evidence before remediation actions.
A company uses Amazon GuardDuty and AWS Security Hub. The security team has configured a custom insight in Security Hub to track findings related to S3 bucket exposures. They want to automatically remediate these findings by applying an S3 bucket policy that blocks public access. The team has created a Lambda function that applies the bucket policy and configured Security Hub to send findings to the Lambda function via a custom action. However, when a new finding is generated, the Lambda function is invoked but fails to apply the policy because it does not have permission to modify the S3 bucket. The Lambda function's execution role has permissions to modify S3 bucket policies, but the function is in the same account as the bucket. What should the team check?
An explicit `Deny` in the bucket policy overrides the execution role's `Allow`, so the Lambda invocation fails despite having `s3:PutBucketPolicy`. Because the function and bucket share an account, cross-account trust is irrelevant; the blocking constraint is the bucket policy's explicit deny, which must be reviewed and removed.
Why this answer
The Lambda function's execution role already has IAM permissions to modify S3 bucket policies, and it operates in the same account as the bucket, so cross-account trust is not the issue. An explicit Deny statement in the S3 bucket policy overrides any Allow granted by IAM policies, including the Lambda role's permissions. Therefore, the team must inspect the bucket policy for explicit denies that block the role from calling PutBucketPolicy.
This is the only remaining cause consistent with the symptoms.
Exam trap
SCS-C02 often tests the misconception that IAM permissions alone determine access, causing candidates to overlook explicit Deny statements in resource-based policies like S3 bucket policies, which override any Allow.
How to eliminate wrong answers
Option A is wrong because S3 ACLs control access to objects and buckets for certain legacy or cross-account scenarios, not IAM role permissions for API actions like PutBucketPolicy; adding a role to an ACL is not a supported or effective way to grant policy-modification rights. Option B is wrong because Security Hub does not assume the Lambda execution role; it invokes the function via a custom action, and the function then uses its own execution role to call S3, so a trust policy for Security Hub is irrelevant. Option D is wrong because S3 Block Public Access settings prevent making buckets or objects public, but they do not prevent an authorized principal from updating a bucket policy; the Lambda role's PutBucketPolicy call would still be allowed unless an explicit deny exists.
A company uses AWS Organizations and wants to implement a centralized incident response process. Which THREE steps should be taken to ensure that security teams can respond to incidents across all accounts effectively?
Creating IAM roles in each member account that allow incident responders in the security account to assume those roles is a standard centralized access pattern. This grants the responders the exact permissions needed to investigate and remediate incidents in any affected account, while maintaining least privilege and full auditability. It avoids the need for shared credentials or per-account logins, and ensures that every cross-account assumption is recorded in CloudTrail for accountability.
Why this answer
Creating IAM roles in each member account with trust policies that allow the security account's incident responders to assume those roles enables centralized, cross-account access for incident response. This follows the principle of least privilege and allows the security team to perform actions (e.g., stopping instances, collecting forensic data) in any affected account without needing separate credentials or direct logins.
Exam trap
The trap here is that candidates often think a single CloudTrail trail in the management account automatically aggregates logs from all accounts, but without configuring it as an organization trail (which requires enabling trusted access and specifying the organization ID), it only logs events from the management account itself.
A security engineer is reviewing a CloudTrail log entry (exhibit). What is the most immediate security concern indicated by this event?
The CloudTrail event shows eventName AuthorizeSecurityGroupIngress with request parameters that add a security group ingress rule. Specifically, it opens port 22 (SSH) to 0.0.0.0/0, meaning all IPv4 addresses on the internet can attempt SSH connections to the associated EC2 instance. This is a well-known misconfiguration that exposes administrative access externally and is the correct security finding to investigate.
Why this answer
The CloudTrail log shows an AuthorizeSecurityGroupIngress API call that added a security group rule with the CIDR 0.0.0.0/0 for port 22 (SSH). This effectively opens SSH access to the entire internet, creating a severe exposure that could allow any attacker to attempt brute-force or credential-stuffing attacks against any EC2 instance associated with that security group. This is the most immediate security concern because it directly introduces a wide-open attack surface.
How to eliminate wrong answers
Option A is wrong because the source IP 203.0.113.5 is a TEST-NET-1 address (RFC 5735) reserved for documentation and examples, not a known malicious IP range; real CloudTrail logs would show a routable IP. Option C is wrong because the event source is 'ec2.amazonaws.com' and the user agent indicates the AWS Management Console, not the AWS CLI; a CLI call would show 'aws-cli' or 'botocore' in the user agent field. Option D is wrong because while MFA is a best practice, the absence of MFA alone is not the most immediate concern—the critical issue is the actual security group rule change that opens SSH to the world, not the authentication method used for the API call.
A security team wants to detect unauthorized API calls in real time and automatically block the source IP address using network ACLs. Which AWS service should be used for detection?
Amazon GuardDuty continuously analyses CloudTrail management events, VPC Flow Logs and DNS logs using threat intelligence to surface findings such as unauthorised API calls. It satisfies the real-time detection constraint, and its findings can trigger EventBridge rules that invoke Lambda to update network ACLs, delivering the automated IP blocking the team requires.
Why this answer
Amazon GuardDuty is the correct choice because it is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, including API calls from unusual or known-bad IP addresses. It uses machine learning, anomaly detection, and integrated threat intelligence to generate findings that can trigger automated remediation, such as updating network ACLs via AWS Lambda and Amazon EventBridge. This aligns with the requirement for real-time detection and automated blocking of source IPs.
Exam trap
The trap here is that candidates often confuse AWS CloudTrail's logging capability with real-time threat detection, overlooking that GuardDuty is specifically designed for proactive security monitoring and automated response, while CloudTrail is purely a logging and auditing service.
How to eliminate wrong answers
Option B (AWS CloudTrail) is wrong because it is an auditing service that records API call history for compliance and governance, but it does not perform real-time threat detection or generate alerts for unauthorized activity; it lacks built-in anomaly detection or threat intelligence. Option C (AWS WAF) is wrong because it is a web application firewall that protects against common web exploits like SQL injection and cross-site scripting at the application layer, not for detecting unauthorized API calls or blocking IPs via network ACLs; it operates on HTTP/HTTPS traffic, not all API calls. Option D (AWS Config) is wrong because it is a configuration management and compliance service that evaluates resource configurations against rules, not a threat detection service; it cannot detect unauthorized API calls or trigger network ACL updates in real time.
Which TWO AWS services can be used to detect anomalous API activity in an AWS account? (Choose two.)
Amazon GuardDuty continuously analyses CloudTrail management and data events, VPC Flow Logs and DNS logs using machine learning and threat intelligence to surface anomalous API activity. It satisfies the stem's detection requirement without agents or manual rule authoring, unlike CloudWatch alarms, which need explicit metric thresholds you define yourself.
Why this answer
Amazon GuardDuty (A) is correct because it is a managed threat-detection service that continuously analyzes CloudTrail management and data events, VPC Flow Logs, and DNS logs using machine learning and threat intelligence to identify anomalous or malicious API activity in the account. AWS CloudTrail (B) is correct because it records API calls as events and, through CloudTrail Insights, automatically detects unusual operational API activity such as spikes in write or error rates by baselining normal behavior. VPC Flow Logs (C) capture IP traffic metadata for network interfaces but do not analyze API calls, so they cannot detect anomalous API activity on their own.
AWS Config (D) evaluates resource configuration compliance and changes, not API call behavior, so it is not a detection service for anomalous API activity. Amazon Inspector (E) scans EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure, not anomalous API usage.
Exam trap
The trap is that candidates may select VPC Flow Logs or AWS Config because they are associated with security monitoring, but they do not directly detect anomalous API activity. Additionally, some candidates might think only GuardDuty is a threat detection service and overlook that CloudTrail Insights also provides anomaly detection.
A company uses AWS Systems Manager Patch Manager to patch EC2 instances. During a security incident, the security team needs to quickly patch a critical vulnerability across all Windows instances in a specific AWS region. Which steps should the team take? (Choose TWO.)
Patch groups in Systems Manager Patch Manager are defined by tagging managed nodes with the key `Patch Group` (case-sensitive) and then associating that group to a patch baseline using `Register-PatchBaselineForPatchGroup`. This association is what directs Patch Manager to evaluate and apply the baseline, including approval rules and custom patches, to every instance in that group. Without the explicit patch-group-to-baseline registration, simply having a tag on instances does not change which baseline is applied; the baseline must be knowingly assigned to the group.
Why this answer
Assigning a custom patch baseline to instances via a patch group allows the security team to target specific Windows instances for patching. Patch Manager uses patch groups to associate instances with a specific patch baseline, ensuring only the desired instances receive the critical patch. This approach provides granular control over which instances are patched during an incident.
Exam trap
The trap here is that candidates often confuse tagging instances with a patch group (which is necessary for association) with the actual patching action, or they assume the default patch baseline will automatically include all critical patches, when in fact custom baselines are required for targeted incident response.
During an incident response, a security engineer needs to collect memory forensics from a running EC2 instance without shutting it down. The instance is running Amazon Linux 2. Which tool is MOST appropriate?
LiME is a loadable kernel module designed specifically for Linux memory acquisition. Loading it on the target system grants direct access to the kernel's physical address space, allowing a full RAM image to be written to a file or over the network; unloading it restores the system to a usable state.
Why this answer
LiME (Linux Memory Extractor) is the most appropriate tool for capturing volatile memory from a running Amazon Linux 2 EC2 instance without shutting it down. It is specifically designed to dump RAM contents to a file or over a network, minimizing the footprint on the target system and ensuring the integrity of the forensic acquisition.
Exam trap
The trap here is that candidates confuse memory acquisition tools (LiME) with memory analysis frameworks (Volatility), or mistakenly believe that dd /dev/mem still works on modern Linux kernels for full memory capture.
How to eliminate wrong answers
Option A is wrong because tcpdump is a network packet capture tool, not a memory forensics tool; it captures network traffic, not RAM contents. Option B is wrong because Volatility is a memory analysis framework used to examine memory dumps, not a tool to acquire memory from a live system. Option D is wrong because the dd command to capture /dev/mem is deprecated and restricted in modern Linux kernels (including Amazon Linux 2) due to security hardening; /dev/mem provides access to physical memory but is typically limited to the first 1 MB, making it unsuitable for full RAM acquisition.
A company has a security rule that all S3 buckets must have server access logging enabled. A security engineer uses AWS Config to evaluate compliance. The engineer configures a managed rule but notices that the rule does not evaluate all buckets. What is the most likely reason?
The AWS Config managed rule `s3-bucket-server-access-logging-enabled` can be configured with a `tag` parameter. When a tag is specified, the rule only evaluates S3 buckets that have that exact tag. If the engineer did not apply the required tag to all buckets, or if the rule was configured with a tag that does not match all buckets, some buckets will be excluded.
Why this answer
The AWS Config managed rule `s3-bucket-server-access-logging-enabled` can be configured with a `tag` parameter. When a tag is specified, the rule only evaluates S3 buckets that have that exact tag key-value pair. If the security engineer did not apply the required tag to all buckets, or if the rule was configured with a tag that does not match all buckets, some buckets will be excluded from evaluation, causing the observed behavior.
Exam trap
The trap here is that candidates often assume AWS Config managed rules evaluate all resources of a given type by default, overlooking the fact that many rules support optional tag-based filtering that can silently limit the scope of evaluation.
How to eliminate wrong answers
Option A is wrong because the managed rule `s3-bucket-server-access-logging-enabled` evaluates buckets across all regions where AWS Config is enabled, not just us-east-1; the rule is regional in scope but can be deployed in each region. Option C is wrong because bucket policies that deny access to AWS Config would cause the rule to report a non-compliant result (e.g., 'INSUFFICIENT_DATA' or 'NON_COMPLIANT') rather than silently skip evaluation; the rule still attempts to evaluate the bucket. Option D is wrong because the rule does not require the logging target bucket to be in the same account; cross-account logging is supported as long as the necessary permissions are in place, and the rule checks the bucket's logging configuration, not the target bucket's account.
A company uses Amazon RDS for MySQL with automated backups enabled. The security team suspects that a database administrator (DBA) with full RDS access has exfiltrated data by creating a snapshot of the database and sharing it with an external AWS account. The team wants to detect such exfiltration in the future. Which step should the team take to detect and alert on snapshot sharing?
Amazon EventBridge can receive AWS API events from CloudTrail and match a custom event pattern for the ModifyDBSnapshotAttribute API call from the rds source, then route that event to an SNS topic for immediate alerting. This gives you a near-real-time, automated response based on the exact administrative action, with no need to poll or manually review logs. Because the rule uses an event pattern keyed on the API name, it fires precisely when the snapshot attribute is modified and can be extended to trigger Lambda remediations.
Why this answer
The `ModifyDBSnapshotAttribute` API call is the specific action used to share an RDS snapshot with an external AWS account. By creating an Amazon EventBridge rule that triggers on this API call, the team can immediately send an alert via Amazon SNS, enabling real-time detection and response to unauthorized snapshot sharing. This approach is automated, event-driven, and directly targets the exfiltration vector.
Exam trap
The trap here is that candidates often confuse AWS Config (which is configuration-aware but not real-time) with EventBridge (which is event-driven and real-time), or they mistakenly think GuardDuty RDS Protection covers all RDS-related threats, including data exfiltration via snapshot sharing, when it actually focuses on database-level threats like brute-force attacks or anomalous queries.
How to eliminate wrong answers
Option A is wrong because AWS Config can detect changes to RDS snapshot attributes, but it is a compliance-oriented service that evaluates resource configurations periodically (e.g., every 10 minutes) and does not provide real-time alerting on API calls; it would also require custom rules and lacks the immediate notification capability needed for security incidents. Option B is wrong because Amazon GuardDuty with RDS Protection focuses on detecting suspicious login attempts, anomalous access patterns, and potential compromise of the RDS instance itself, not on monitoring API-level actions like snapshot sharing. Option D is wrong because enabling AWS CloudTrail and manually reviewing logs is reactive, not proactive; it does not provide automated alerting and would be impractical for timely detection of exfiltration events.
A company's AWS Lambda function that processes sensitive data is triggering unexpectedly. The security team wants to investigate using AWS CloudTrail. What should they look for?
Invoke events are the Lambda data-plane records logged to CloudTrail every time the function is actually called; each event captures the function name, qualifier, timestamp, request parameters, and invoking principal. Enabling data events on Lambda in a CloudTrail trail is what makes these entries appear, and they are precisely what an auditor needs to see who invoked the function and when. This is why Invoke is the correct way to audit that sensitive-data processing occurred.
Why this answer
`Invoke` events in CloudTrail record every invocation of a Lambda function, including the source (e.g., AWS service, SDK, or console) and the identity that triggered it. By analyzing these events, the security team can identify unexpected triggers, such as unauthorized IAM users or roles invoking the function, or anomalous invocation patterns that indicate a potential security issue.
Exam trap
The trap here is that candidates may confuse configuration or creation events with invocation events, mistakenly thinking that `UpdateFunctionConfiguration` or `CreateFunction` would show who triggered the function, when in fact only `Invoke` events capture the actual execution requests.
How to eliminate wrong answers
Option A is wrong because `UpdateFunctionConfiguration` events record changes to the function's configuration (e.g., memory, timeout, environment variables), not the actual invocations that would reveal unexpected triggers. Option B is wrong because `CreateFunction` events record the creation of new Lambda functions, not the triggering of an existing function. Option D is wrong because `PutSubscriptionFilter` events from CloudWatch Logs are used to configure log subscription filters for streaming log data, not to capture Lambda invocation events.
A company wants to automatically isolate an EC2 instance that is suspected to be compromised. What is the MOST effective AWS-native approach?
Amazon GuardDuty consumes VPC DNS logs, flow logs, and other telemetry to identify suspicious behavior such as outbound traffic to known command-and-control IPs. A high-severity finding can be sent to Amazon EventBridge, which invokes an AWS Lambda function that replaces the instance's security group with a quarantine security group containing a deny-all inbound and outbound rule, instantly severing network connectivity. This agentless containment preserves the running instance and its memory for investigation and is the recommended automated isolation pattern.
Why this answer
Amazon GuardDuty can detect suspicious activity on an EC2 instance (e.g., cryptocurrency mining, unusual outbound traffic) and, when integrated with Amazon EventBridge and AWS Lambda, automatically modify the instance's security group to deny all traffic. This approach isolates the instance without terminating it, preserving forensic evidence and allowing further investigation. It is the most effective AWS-native approach because it combines threat detection with automated, least-privilege response actions.
Exam trap
The trap here is that candidates often choose termination (Option A) thinking it is the fastest way to stop the threat, but the exam emphasizes preserving forensic evidence and using automated, reversible isolation mechanisms like security group modification.
How to eliminate wrong answers
Option A is wrong because terminating the instance destroys volatile forensic data (memory, disk) and prevents post-incident analysis, which is contrary to incident response best practices. Option C is wrong because changing the instance's IAM role does not affect network traffic; the instance remains accessible over the network, so it does not isolate the compromised instance. Option D is wrong because using AWS Systems Manager to run a script that stops the instance still leaves the instance accessible until the stop completes, and stopping does not block network access immediately; additionally, Systems Manager requires the instance to have network connectivity to receive the command, which may not be reliable if the instance is already compromised.
A company wants to detect and alert on suspicious IAM role usage, such as a role being assumed from an unusual geographic location. Which AWS service should be used to generate the alerts?
Amazon GuardDuty continuously monitors CloudTrail management events, including IAM role assumptions and API activity, using machine learning and threat intelligence to detect suspicious behavior such as credential exfiltration or anomalous role usage. It generates findings that can trigger alerts via EventBridge, making it the correct choice for detecting and alerting on suspicious IAM role activity.
Why this answer
Amazon GuardDuty is the correct choice because it is a threat detection service that continuously monitors for suspicious activity, including unusual IAM role usage such as a role being assumed from an anomalous geographic location. It uses machine learning, anomaly detection, and integrated threat intelligence to analyze CloudTrail management events and VPC flow logs, generating alerts (findings) for deviations from baseline behavior. This directly meets the requirement to detect and alert on suspicious role assumptions without needing to write custom rules.
Exam trap
The trap here is that candidates often confuse AWS CloudTrail's logging capability with detection, assuming that because CloudTrail records the AssumeRole event, it can also alert on it, but CloudTrail requires an additional service like GuardDuty or CloudWatch with custom rules to generate alerts, whereas GuardDuty provides built-in, automated anomaly detection for this exact scenario.
How to eliminate wrong answers
Option A is wrong because AWS IAM Access Analyzer is designed to identify resources shared with external entities by analyzing resource-based policies, not to detect anomalous IAM role usage or generate real-time alerts based on geographic location. Option C is wrong because AWS CloudTrail is a logging service that records API activity but does not natively analyze logs for suspicious patterns or generate alerts; it requires additional services like CloudWatch Logs or GuardDuty to process and alert on the data. Option D is wrong because Amazon CloudWatch is a monitoring and observability service that can trigger alarms based on metrics or log patterns, but it lacks built-in anomaly detection for IAM role usage from unusual locations and would require custom metric filters and manual threshold configuration, making it less effective and more complex than GuardDuty's purpose-built capabilities.
A security engineer reviews the CloudTrail log entry in the exhibit. The engineer notices that an EC2 instance was launched using an AdminRole. Which additional information would help determine if this is a legitimate action or a potential compromise?
The source IP address 203.0.113.50 is recorded in the CloudTrail event as sourceIPAddress, and it originates from a geographic region outside the company's known operating footprint. Anomalous source IPs are a well-known indicator of compromised credentials or unauthorized access, especially when combined with API calls that create resources. This is the only option that represents an actual observable anomaly in the log entry itself, making it the strongest sign of suspicious activity.
Why this answer
The source IP address 203.0.113.50 is from an unexpected geographic location not associated with the company. In CloudTrail, the `sourceIPAddress` field records the originating IP of the API call. If an AdminRole is used from an IP outside the company's known CIDR ranges or geographic regions, it strongly indicates a potential compromise—such as stolen credentials or an attacker using the role from an unauthorized network.
This is a key indicator of anomalous behavior in threat detection.
Exam trap
The trap here is that candidates focus on technical misconfigurations (like open security groups or unusual AMIs) rather than the behavioral anomaly of an administrative action originating from an unexpected IP, which is the most direct indicator of a potential compromise in CloudTrail logs.
How to eliminate wrong answers
Option A is wrong because an AMI ID that is not a standard Amazon-provided AMI could be a custom or marketplace AMI, which is common in legitimate environments; it does not alone indicate compromise. Option B is correct as explained. Option C is wrong because an instance type like m5.xlarge may be larger than usual but could be legitimate for a specific workload; size alone is not a reliable indicator of compromise without context like cost anomalies or unusual launch patterns.
Option D is wrong because a security group allowing inbound SSH from 0.0.0.0/0 is a misconfiguration that increases risk, but it does not directly indicate that the launch action itself was unauthorized or compromised—it is a separate security issue.
A security engineer is investigating a potential data exfiltration from an S3 bucket that is configured to allow public access. The engineer wants to determine who accessed the bucket and from which IP addresses. Which AWS capability should be used?
CloudTrail data events for S3 capture object-level API calls such as GetObject, PutObject, and ListBucket, recording the IAM principal, source IP address, timestamp, and specific request parameters. Unlike management events, data events require explicit enablement on the trail or bucket, but once enabled they provide queryable, near real-time records of exactly the operations an attacker would perform to extract data. This gives investigators the necessary combination of user identity, network origin, and object-level action to confirm or refute exfiltration, making it the correct choice.
Why this answer
AWS CloudTrail data events for S3 capture detailed API activity at the object level, including GetObject, PutObject, and DeleteObject calls. This allows the security engineer to identify exactly who accessed the bucket (via the user identity) and from which IP address (via the sourceIPAddress field in the CloudTrail event). Unlike management events, data events must be explicitly enabled and provide the granularity needed for this investigation.
Exam trap
The trap here is that candidates often confuse S3 server access logs (which also log IPs and request details) with CloudTrail data events, but server access logs lack IAM user identity information and are not integrated with AWS CloudTrail's centralized audit trail, making CloudTrail the correct choice for identity-aware investigation.
How to eliminate wrong answers
Option A is wrong because Amazon S3 server access logs provide detailed records of requests made to a bucket, including IP addresses and requester information, but they are delivered as log files to a target bucket and are not real-time; they also do not capture IAM user identity details as comprehensively as CloudTrail. Option B is wrong because AWS IAM Access Analyzer is used to identify resources shared with external entities by analyzing resource-based policies, not to track who accessed a bucket or from which IP addresses. Option D is wrong because Amazon VPC Flow Logs capture IP traffic metadata at the network interface level, but they do not log S3 API operations or the identity of the requester; S3 access via the internet or AWS PrivateLink may not even traverse a VPC flow log.
A company uses AWS CloudTrail to log API calls in all accounts. The security team wants to be notified immediately when an IAM user creates a new access key for another user. Which combination of services should the team use?
AWS CloudTrail captures management events, including the CreateAccessKey API call, and can be configured to deliver those events to Amazon CloudWatch Logs. In CloudWatch Logs, a metric filter with a pattern like 'eventName: CreateAccessKey' creates a custom metric; a CloudWatch alarm on that metric then publishes a message to an SNS topic, which sends email or SMS notifications. This combination provides real-time alerting for the exact IAM event, making it the correct architecture.
Why this answer
It uses CloudTrail to capture the CreateAccessKey API call, sends those logs to CloudWatch Logs, and then triggers a CloudWatch alarm that publishes to an SNS topic for immediate notification. This combination provides real-time alerting on the specific IAM event without requiring additional services.
Exam trap
The trap here is that candidates often confuse AWS Config (which is reactive and compliance-focused) with CloudTrail (which is event-driven and real-time), leading them to choose Option A instead of the correct CloudTrail + CloudWatch Logs + SNS combination.
How to eliminate wrong answers
Option A is wrong because AWS Config is designed for resource compliance and configuration history, not real-time event-driven notification; SES is an email service that lacks the push notification capabilities needed for immediate alerts. Option B is wrong because GuardDuty focuses on threat detection using anomaly detection and threat intelligence feeds, not on monitoring specific IAM API calls like CreateAccessKey. Option C is wrong because Macie is a data security service that discovers and protects sensitive data in S3, not a service for monitoring IAM user activity or API calls.
During an incident response, a security engineer needs to capture a memory image of a compromised Amazon EC2 instance running Linux. The instance is in a production Auto Scaling group. Which approach is BEST?
Detaching from the Auto Scaling group prevents termination or replacement during acquisition, while security group changes isolate the instance from further compromise. Systems Manager Run Command then executes the memory capture tool without needing SSH access, preserving volatile data that would be lost on stop or reboot.
Why this answer
It preserves the volatile memory evidence by detaching the instance from the Auto Scaling group (preventing replacement) and isolating it via security group changes, then using AWS Systems Manager Run Command to execute a memory acquisition tool like LiME or AVML. This approach captures the memory image without shutting down the instance, which would destroy the evidence, and avoids the risk of the Auto Scaling group automatically terminating or replacing the instance during the investigation.
Exam trap
The trap here is that candidates confuse disk forensics (EBS snapshots) with memory forensics, assuming a snapshot captures RAM, or they prioritize immediate containment (termination) over evidence preservation, which violates the core incident response principle of 'preserve before remediate'.
How to eliminate wrong answers
Option A is wrong because AWS CloudFormation is an infrastructure-as-code service for provisioning resources, not a forensic tool; copying data from a compromised instance does not capture volatile memory, which is lost when the instance is stopped or terminated. Option B is wrong because terminating the instance immediately destroys the memory image and other volatile evidence, making forensic analysis impossible; incident response requires preserving evidence before remediation. Option D is wrong because an EBS snapshot captures only the persistent disk state (file system and storage), not the contents of RAM; memory analysis requires a dedicated memory acquisition tool executed on the running instance.
A security team is designing an automated incident response system. The system must meet the following requirements: (1) automatically respond to GuardDuty findings, (2) ensure that response actions are logged and immutable, and (3) allow for human approval before destructive actions. Which services should the team use? (Select THREE.)
Amazon EventBridge is the correct entry point because GuardDuty publishes every finding to the default event bus as an event with a detail-type such as 'GuardDuty Finding'. A rule can filter on finding severity, account, or region and immediately invoke a Step Functions state machine or Lambda function, enabling real-time, event-driven response. Without EventBridge, you would have to poll the GuardDuty API, which introduces latency and bypasses the native event pattern that AWS services emit.
Why this answer
Amazon EventBridge (A) is correct because it can receive GuardDuty findings in near real-time and route them to downstream targets for automated response. This enables the first requirement by triggering workflows directly from GuardDuty events without custom polling.
Exam trap
The trap here is that candidates often select Lambda as the sole compute service, overlooking that Step Functions is required to orchestrate the human approval step and that CloudTrail is needed for immutable logging, not just EventBridge and Lambda alone.
A company has a requirement to detect and respond to threats in near real-time by analyzing VPC Flow Logs. The logs are generated in a VPC and sent to CloudWatch Logs. What is the MOST efficient way to analyze these logs for suspicious patterns and trigger automated responses?
Amazon Kinesis Data Analytics continuously processes streaming logs using SQL or Apache Flink, allowing pattern matching, anomaly detection, and aggregation over sliding windows in near-real-time—latency can be under a few seconds. It can output its results to a Lambda function (via a Kinesis Data Analytics destination or an intermediate Kinesis Data Stream) which then executes an automated response (e.g., updating security groups, invoking AWS WAF, or sending alerts). This stream-processing architecture directly meets the 'detect and respond' requirement with minimal delay, unlike batch-based alternatives.
Why this answer
Amazon Kinesis Data Analytics can process streaming VPC Flow Logs from CloudWatch Logs in near real-time using SQL or Apache Flink, enabling immediate detection of suspicious patterns. AWS Lambda can then be triggered to automate incident response actions, such as updating security groups or isolating instances, making this the most efficient solution for near real-time threat detection and response.
Exam trap
The trap here is that candidates often choose batch-oriented solutions like Athena or S3 event notifications, overlooking the explicit 'near real-time' requirement in the question, which demands a streaming analytics approach.
How to eliminate wrong answers
Option A is wrong because streaming logs to Amazon Elasticsearch Service (now OpenSearch Service) and using Kibana alerts introduces significant latency due to indexing and query overhead, and it is not designed for near real-time automated response. Option B is wrong because S3 event notifications trigger Lambda functions on new objects, but VPC Flow Logs are sent to CloudWatch Logs, not directly to S3, and this approach would require an additional export step, breaking near real-time analysis. Option C is wrong because exporting logs to S3 and using Athena with scheduled rules is a batch-oriented process that incurs minutes of delay, failing the near real-time requirement.
Which TWO actions are best practices for securing an AWS account's root user? (Choose 2.)
A strong, uniquely complex root password stored securely reduces the risk of credential compromise, since the root user cannot be restricted by IAM policies and has unrestricted account access. This satisfies the best-practise requirement for protecting that identity.
Why this answer
Option B is correct because the root user has unrestricted access to all AWS resources and billing, so it must be protected with a strong, complex password stored in a secure location such as a password manager or secrets vault. Option C is correct because enabling MFA on the root user adds a critical second authentication factor, ensuring that a compromised password alone cannot grant full account control. Options A, D, and E are not best practices: sharing the root password violates least privilege and accountability, using root for daily administrative tasks should be avoided in favor of IAM users or roles, and creating root access keys is discouraged because long-lived root credentials cannot be scoped down and pose a severe security risk.
Exam trap
The trap here is that candidates often think sharing the root password with the team (Option A) is a valid emergency access strategy, but AWS explicitly recommends using IAM roles with a break-glass process (e.g., AWS Systems Manager Incident Manager) instead, as shared passwords create auditability and credential rotation issues.
Drag and drop the steps to implement a secure CI/CD pipeline with AWS CodePipeline and IAM in the correct order.
Drag or tap steps into the slots.
Why this order
Secure pipeline requires encrypted artifact bucket, IAM roles, source repo, build project with security scanning, and pipeline.
A security engineer discovers an Amazon GuardDuty finding of type 'UnauthorizedAccess:EC2/SSHBruteForce' for an EC2 instance. The instance is part of an Auto Scaling group and has a public IP address. What is the MOST effective immediate step to mitigate the threat?
Detaching the instance from the Auto Scaling group before termination marks it as a manual removal from the group's lifecycle, so the scaling policy does not immediately spin up a replacement. After detaching, you can terminate it to stop the attack or preserve it for forensic analysis, while maintaining the group's desired capacity if you intentionally adjust it. This is the correct immediate response because it eliminates the compromised resource and prevents the same vulnerable workload from being automatically reintroduced.
Why this answer
The instance is compromised and part of an Auto Scaling group. Detaching it first prevents the Auto Scaling group from immediately replacing it with a new instance that might inherit the same vulnerability, allowing for forensic analysis. Terminating it after detachment stops the SSH brute force attack at its source without risking automatic re-provisioning of a similarly exposed instance.
Exam trap
The trap here is that candidates assume terminating the instance directly (Option B) is sufficient, failing to recognize that Auto Scaling groups automatically replace terminated instances, which can immediately re-expose the environment to the same threat.
How to eliminate wrong answers
Option A is wrong because network ACLs are stateless and modifying them to block only the attacker's IP is ineffective against distributed brute force attacks; also, this does not address the compromised instance itself. Option B is wrong because terminating an instance that is part of an Auto Scaling group triggers the group to launch a replacement instance immediately, potentially recreating the same vulnerability if the underlying AMI or configuration is unchanged. Option C is wrong because updating the security group to restrict SSH access to known IPs is a preventive measure, not an immediate incident response step; it does not stop the ongoing attack on the already compromised instance.
During a security incident, a security engineer needs to capture network traffic between an EC2 instance and an attacker's IP address for forensic analysis. The engineer has already identified the attacker's IP from CloudTrail logs. Which action captures the traffic without affecting the instance?
VPC Traffic Mirroring copies traffic from the instance's ENI to a specified target—such as a Network Load Balancer configured with a capture appliance—without installing agents or SSHing into the instance. Because the mirroring runs in the VPC data path (at the hypervisor), it is transparent to the instance and does not alert the attacker or affect system performance. This makes it the recommended approach for real-time, full-packet capture during incident response while preserving the integrity of the evidence.
Why this answer
VPC Traffic Mirroring captures all network traffic at the Elastic Network Interface (ENI) level without any performance impact or configuration change on the EC2 instance itself. It copies the traffic to a Network Load Balancer (NLB) or another target for capture and analysis, making it ideal for forensic investigation without disrupting the running instance.
Exam trap
The trap here is that candidates confuse VPC Flow Logs (which only provide metadata) with full packet capture capabilities, or they assume that SSHing into the instance is acceptable despite the risk of altering the instance state during an active incident.
How to eliminate wrong answers
Option A is wrong because network ACLs do not log traffic; they only allow or deny traffic based on rules, and they operate at the subnet level, not per-instance. Option B is wrong because VPC Flow Logs capture metadata (source/destination IP, ports, protocol, packets) but not the actual packet payload, so they cannot provide the full network traffic needed for deep forensic analysis. Option C is wrong because SSHing into the instance and running tcpdump would alter the instance's state (e.g., by installing or running a process) and could interfere with the incident or be blocked if the instance is compromised.
A company wants to detect and respond to potential security threats in near real-time. Which TWO services should the company use together to achieve this? (Choose TWO.)
AWS Security Hub is the correct choice because it aggregates and correlates security findings from multiple sources, including GuardDuty, Inspector, and Config, into a single, prioritized view. It applies continuous security best-practice and compliance checks, and its integration with Amazon EventBridge allows you to automate responses by triggering AWS Lambda, Systems Manager, or Step Functions workflows. This centralized detect-and-respond architecture is exactly what the company needs for operational security monitoring.
Why this answer
AWS Security Hub (D) aggregates security findings from multiple AWS services, including Amazon GuardDuty, and provides a comprehensive view of security alerts and compliance status. Amazon GuardDuty (E) is a threat detection service that continuously monitors for malicious activity and unauthorized behavior using machine learning and integrated threat intelligence. Together, they enable near real-time detection and response by centralizing findings from GuardDuty in Security Hub, which can trigger automated remediation workflows via Amazon EventBridge.
Exam trap
The trap here is that candidates often confuse AWS Config or CloudTrail as threat detection services, but they are primarily configuration auditing and API logging tools, respectively, and lack the real-time threat analysis capabilities of GuardDuty and Security Hub.
Refer to the exhibit. A security engineer is analyzing a CloudTrail log entry for an EC2 RunInstances call. The engineer needs to determine if the instance launch was authorized by an IAM policy. Which field should the engineer check to identify the IAM policy that was used to authorize the action?
The userIdentity block in a CloudTrail record is the authoritative field for identifying the principal, containing the ARN, type (IAMUser, AssumedRole, Root, etc.), and session context for the call. By inspecting this block, the security engineer can determine the exact IAM user or role and then review the identity-based and attached policies that governed the request. Without userIdentity, there is no reliable way to map an API call to the IAM entity whose permissions should be audited.
Why this answer
The 'userIdentity' field in a CloudTrail log entry contains details about the IAM user or role that made the API call, including the ARN and the access key ID. To identify the specific IAM policy that authorized the action, the security engineer must first know the identity (user/role) from the 'userIdentity' field, then cross-reference that identity with the IAM policies attached to it. The policy itself is not directly listed in the log entry, but the identity is the key to tracing authorization.
Exam trap
The trap here is that candidates may think the 'eventType' or 'sourceIP' fields directly reveal authorization details, but CloudTrail does not log the specific policy that was evaluated; instead, the 'userIdentity' field is the critical link to identify the IAM entity whose policies were applied.
How to eliminate wrong answers
Option A is wrong because the 'vpcEndpointId' field indicates whether the call originated from a VPC endpoint, which is relevant for network-level logging and VPC endpoint policies, not for identifying the IAM policy that authorized the RunInstances action. Option B is wrong because the 'sourceIP' field shows the IP address from which the call was made, which is used for network-level analysis or source IP conditions in policies, but does not directly identify the IAM policy that authorized the action. Option C is wrong because the 'eventType' field indicates whether the event is an API call (AwsApiCall), a console login, or a service event, but it provides no information about the specific IAM policy used for authorization.
A security engineer is reviewing AWS CloudTrail logs and notices repeated `CreateTrail` API calls from an IAM user that is not authorized to create trails. What is the MOST likely cause of these log entries?
CloudTrail is designed to record every API request made on an account, including actions that fail authorization. When the IAM user attempts CreateTrail, CloudTrail writes a management event with the userIdentity of that user, even if the call is denied with AccessDenied and an errorCode and errorMessage. The presence of this attempt in the logs is therefore normal, and it does not indicate that a trail was successfully created.
Why this answer
The repeated `CreateTrail` API calls in CloudTrail logs indicate that an IAM user is attempting to create a trail. Since the user lacks the required `cloudtrail:CreateTrail` permission, the API call is recorded as an attempted action that was denied by AWS Identity and Access Management (IAM) policy evaluation. CloudTrail logs all API calls, including those that fail due to insufficient permissions, which is why these entries appear in the logs.
Exam trap
The trap here is that candidates may think CloudTrail only logs successful API calls, but in reality, it logs all API calls, including those that are denied, which is why the repeated `CreateTrail` entries appear even though the user is not authorized.
How to eliminate wrong answers
Option B is wrong because AWS GuardDuty generates security findings and simulated events related to threats, not CloudTrail `CreateTrail` API calls; GuardDuty does not produce CloudTrail log entries. Option C is wrong because S3 server access logs record requests made to an S3 bucket, such as GET or PUT operations, not CloudTrail API calls like `CreateTrail`. Option D is wrong because CloudTrail's data events configuration controls which data plane operations are logged (e.g., S3 object-level events), but it does not affect the logging of management events like `CreateTrail`; the API call would still be logged regardless of data event settings.
A security engineer is building an incident response playbook for compromised IAM credentials. The engineer wants to automatically revoke access and preserve evidence when an access key is suspected of being compromised. Which TWO actions should be included in the playbook? (Choose two.)
Deactivating the access key immediately stops its use, and attaching an explicit deny policy blocks the user from making further calls with any credentials or sessions. This revokes access quickly while preserving the key's metadata and the user's configuration for later analysis, which supports evidence preservation.
Why this answer
A credential compromise playbook must both revoke access and preserve evidence. Deactivating the key and attaching an explicit deny policy stops further API calls immediately while keeping the identity intact for analysis. Capturing the user's policies, key metadata, and recent CloudTrail events before changes preserves the activity history needed to determine impact and support notifications.
Deleting the user, rotating the key, or disabling logging would destroy evidence or fail to revoke access effectively.
Exam trap
The trap here is choosing to delete the compromised IAM user, which feels decisive but destroys the metadata and audit trail needed for the investigation.
A security engineer is investigating a potential data exfiltration from an AWS account. Which TWO CloudTrail events would be MOST indicative of data exfiltration via S3?
A `CopyObject` call that copies objects from a production bucket to a bucket in another AWS account is a direct, API-driven transfer of data to an external destination. This operation effectively bypasses traditional network egress controls because the data moves over AWS's internal infrastructure to an account outside the organization's management. It is a common exfiltration technique used by attackers with compromised credentials to quietly duplicate sensitive objects to a location they control.
Why this answer
`CopyObject` API calls from a production bucket to a bucket in another AWS account indicate data being replicated or moved across account boundaries, which is a strong signal of potential data exfiltration. This action bypasses typical network controls and can transfer large volumes of data without requiring a download, making it a common exfiltration technique.
Exam trap
The trap here is that candidates often focus on `GetObject` as the primary exfiltration vector, but `CopyObject` is equally dangerous because it can move data directly to another account without leaving a network egress trail.
During a security incident, a security engineer needs to preserve forensic evidence from an EC2 instance that may be compromised. The instance is running a critical application. Which approach minimizes data loss while ensuring the integrity of the evidence?
Taking an EBS snapshot first preserves the root and data volumes as a point-in-time forensic copy of the disk, while leaving the instance running so volatile state is not yet lost. Then you isolate the instance by swapping its security group to a deny-all rule set and deregistering it from the load balancer, which cuts all network paths without modifying the guest OS or killing processes. This containment step prevents lateral movement and further data exfiltration while preserving the ability to later analyze memory, network connections, and disk state.
Why this answer
Creating an EBS snapshot preserves the disk state at the point of the incident, capturing forensic evidence without altering the running instance. Isolating the instance by modifying the security group (e.g., removing all inbound/outbound rules) and removing it from the load balancer stops network traffic and prevents further compromise, minimizing data loss while maintaining the integrity of the evidence for later analysis.
Exam trap
The trap here is that candidates may think terminating the instance is the safest way to stop malicious activity, but they overlook the irreversible loss of forensic evidence and the need to preserve the disk state for investigation.
How to eliminate wrong answers
Option B is wrong because immediately terminating the instance destroys volatile data (e.g., memory, running processes) and the disk state, losing critical forensic evidence and preventing root cause analysis. Option C is wrong because SSH-ing into a potentially compromised instance risks alerting the attacker, altering evidence, or allowing the attacker to cover tracks; forensic memory capture should be done via hypervisor-level tools (e.g., AWS Nitro System's memory capture) or by attaching a forensic instance to the EBS volume. Option D is wrong because leaving the instance running without changes allows ongoing malicious activity to continue, potentially corrupting evidence or causing further damage; isolation (via security group and load balancer removal) is necessary to preserve the state.
A company uses Amazon GuardDuty and AWS Security Hub in a single AWS account. The security team has created a custom action in Security Hub to send findings to a custom Lambda function for automated response. The Lambda function is designed to take remediation actions based on the finding type. During testing, the team notices that the Lambda function is not being invoked when new findings are generated. The Lambda function's resource-based policy allows invocations from Security Hub, and the function's execution role has necessary permissions. What is the most likely reason for the failure?
Security Hub custom actions do not invoke Lambda functions directly. When an analyst triggers a custom action in the Security Hub console, Security Hub publishes an event to Amazon EventBridge with a detail-type like 'Security Hub Findings - Custom Action'. You must configure an EventBridge rule that matches this event and has the Lambda function as a target. Without that rule, the Lambda function receives no invocation, regardless of IAM roles or resource policies.
Why this answer
Security Hub custom actions do not automatically invoke a Lambda function. When a custom action is triggered, Security Hub publishes an event to the default EventBridge bus, and you must create an EventBridge rule that matches the custom action ARN and targets the Lambda function. Without that rule, the Lambda is never invoked, even though the resource-based policy and execution role are correctly configured.
Exam trap
SCS-C02 often tests the event-driven architecture behind Security Hub automation — candidates assume Security Hub invokes Lambda directly and overlook the mandatory EventBridge rule that sits between them.
How to eliminate wrong answers
Option B is wrong because GuardDuty resource type coverage affects which findings are generated, not whether Security Hub can invoke Lambda — the question states findings are being generated, so GuardDuty is working. Option C is wrong because the Lambda execution role does not need GuardDuty permissions to be invoked by Security Hub; it only needs permissions for the remediation actions it performs (e.g., EC2, S3). Option D is wrong because the question explicitly states the resource-based policy already allows invocations from Security Hub, so adding Security Hub as a principal is redundant and not the cause of the failure.
A company has a serverless application using AWS Lambda functions that process sensitive data. The security team wants to detect potential data exfiltration via DNS queries from the Lambda functions. Which service should be enabled to monitor DNS requests?
Amazon Route 53 Resolver DNS Firewall is the correct answer because it operates at the DNS layer, inspecting outbound DNS queries from a VPC. It can both log full DNS query details (through Resolver query logging) and filter/block malicious or unwanted domains before resolution. This is directly applicable to a serverless Lambda application that needs DNS visibility and control, whereas other services operate at different layers or lack native DNS logging.
Why this answer
Amazon Route 53 Resolver DNS Firewall is the correct choice because it provides DNS-layer filtering for outbound DNS queries from VPCs, including those made by Lambda functions. It can log and block DNS requests to known malicious domains, enabling detection of data exfiltration attempts that use DNS tunneling or command-and-control (C2) communication. This service integrates with VPC flow logs and CloudWatch to monitor DNS query patterns specifically.
How to eliminate wrong answers
Option B (AWS WAF) is wrong because it operates at the application layer (HTTP/HTTPS) to protect web applications from common exploits, not at the DNS layer, and cannot inspect or log DNS queries. Option C (Amazon CloudWatch Logs) is wrong because it is a log storage and monitoring service, not a DNS-specific monitoring tool; it can store logs from other services but does not natively capture or analyze DNS queries from Lambda. Option D (AWS GuardDuty) is wrong because while it uses threat intelligence to detect malicious activity, it relies on DNS logs from Route 53 Resolver DNS Firewall or VPC DNS logs as a data source; it does not directly monitor or log DNS queries itself.
A company has a serverless application using AWS Lambda, API Gateway, and DynamoDB. The security team wants to detect and respond to potential SQL injection attempts in API requests. They have enabled AWS WAF on the API Gateway and created a rule to block SQL injection. However, they also want to capture the blocked requests for analysis and store them in an S3 bucket. The team has configured WAF to send logs to Amazon Kinesis Data Firehose, which delivers to an S3 bucket. After testing, the team notices that the logs are not being delivered. The Firehose delivery stream is in the same AWS account, and the S3 bucket policy allows the Firehose service to write. What is the most likely cause?
The Kinesis Data Firehose delivery stream is configured with an IAM role that it assumes to write to the destination S3 bucket. If that role does not have a permissions policy allowing s3:PutObject (and s3:GetBucketLocation) on the target bucket, Firehose attempts to deliver records but receives an AccessDenied error from S3. The delivery stream may still accept records from WAF, but the data is never written to the bucket, leaving the bucket empty. This is the most direct explanation for logs being absent, because the Firehose-to-S3 step is where the chain fails.
Why this answer
The most likely cause is that the Kinesis Data Firehose delivery stream lacks an IAM role with permissions to write to the S3 bucket. Even if the S3 bucket policy allows the Firehose service to write, Firehose assumes an IAM role to access the bucket. If that role does not have the necessary permissions (e.g., s3:PutObject), delivery fails.
The other options are less likely because WAF logging is configured (since logs are attempted), the S3 bucket policy is stated to allow write, and Firehose buffering is normal.
Exam trap
The trap is assuming that an S3 bucket policy alone is sufficient for Firehose to write. Candidates often overlook the need for an IAM role that Firehose assumes to access the bucket, leading them to choose option C instead of B.
How to eliminate wrong answers
Option A is wrong because if the web ACL were not configured to log blocked requests, no logs would be generated at all, but the team is seeing logs not delivered, implying logging is enabled. Option C is wrong because the scenario states the S3 bucket policy allows the Firehose service to write, so that is not the issue. Option D is wrong because Firehose buffering is expected, but if logs are not delivered after sufficient time, it indicates a permissions issue rather than a delay.
A security engineer is investigating a potential security incident involving an Amazon RDS database. The engineer needs to identify which of the following actions should be taken during the forensic analysis phase? (Select TWO.)
A manual snapshot immediately captures a consistent, point-in-time copy of the RDS instance, including its data, storage configuration, and parameters, independent of the automated backup window. This snapshot can be stored even if automatic backups are disabled, and it can later be restored to an isolated instance for forensic analysis without affecting the original. It is the correct first step to preserve volatile database evidence that could otherwise be modified or deleted during the investigation.
Why this answer
Taking a manual snapshot preserves a point-in-time, immutable copy of the RDS instance for offline forensic analysis without altering the live database. This ensures that evidence is captured before any changes occur during the investigation, and the snapshot can be restored to a separate instance for safe examination.
Exam trap
The trap here is confusing containment actions (like modifying security groups) with forensic preservation actions, leading candidates to select Option C instead of recognizing that the first step in forensic analysis is to capture immutable evidence via a snapshot and review CloudTrail logs.
An organization uses AWS CloudTrail with a multi-region trail. The security team suspects that an attacker has deleted logs. Which THREE findings would indicate that log deletion occurred? (Choose THREE.)
A StopLogging API call is the direct way to disable CloudTrail log delivery; if it originates from an unknown or unrecognized IP address, it strongly suggests an attacker is attempting to hide their activity by pausing audit logging. This action would create a window where no logs are recorded, allowing subsequent actions to go undetected. Because CloudTrail itself logs the StopLogging event in a separate admin trail (if one is configured) or via the CloudTrail management event log, its presence with an unusual source IP is a clear indicator of compromise.
Why this answer
A `StopLogging` API call from an unknown IP address indicates that logging was deliberately disabled, which an attacker could do to cover their tracks. CloudTrail records all `StopLogging` events, and an unexpected source IP is a strong indicator of unauthorized activity. This directly suggests log deletion or suppression, as stopping the trail prevents further log delivery.
Exam trap
The trap here is that candidates may confuse a security control (MFA Delete) with an indicator of compromise, or think that `StartLogging` calls imply deletion, when in fact they are normal operational events that do not directly signal log tampering.
A security engineer is investigating a potential data exfiltration from an S3 bucket. The engineer needs to identify which IAM role or user accessed the bucket and from which IP address. Which AWS service should the engineer use to obtain this information?
AWS CloudTrail is the correct choice because, for S3 data-plane operations, it logs every API request — including GetObject, PutObject, and ListObjects — with the authenticated IAM principal, source IP, user agent, and the bucket/key requested. Management events like bucket policy changes are also captured. This enables a security engineer to trace exactly who accessed and extracted objects, and when, providing the access-level history needed to investigate exfiltration.
Why this answer
AWS CloudTrail is the correct service because it records all API calls made to S3, including the IAM role or user identity (via the `userIdentity` field) and the source IP address (via the `sourceIPAddress` field). For data exfiltration investigation, you need these specific details from management events or data events (e.g., `GetObject`, `PutObject`), which CloudTrail captures. Other services either lack identity-level detail or focus on network-level traffic without user attribution.
Exam trap
The trap here is that candidates often confuse VPC Flow Logs (which show network traffic but not user identity) with CloudTrail (which shows API calls with identity), leading them to select VPC Flow Logs for IP-based investigation without realizing they need the IAM role or user context.
How to eliminate wrong answers
Option B (AWS Config) is wrong because it evaluates resource configuration compliance and records configuration changes, not API-level access logs with user identity and source IP. Option C (VPC Flow Logs) is wrong because it captures network traffic metadata (IPs, ports, protocols) at the VPC level but does not include IAM user or role identity, nor does it log S3 API operations. Option D (Amazon GuardDuty) is wrong because it is a threat detection service that analyzes CloudTrail logs, VPC Flow Logs, and DNS logs to identify anomalies; it does not directly provide raw access logs with user identity and source IP for forensic investigation.
A company has a security requirement to automatically isolate an Amazon EC2 instance that is generating high network traffic to a known malicious IP address. The company uses Amazon GuardDuty and AWS Lambda. Which combination of services and configurations should be used to achieve the isolation?
Amazon GuardDuty is purpose-built to generate security findings based on threat intelligence and anomaly detection, including malicious IP addresses attempting to communicate with EC2 instances. These findings can be delivered as events to Amazon CloudWatch Events (or Amazon EventBridge) using a rule that matches specific finding types, and that rule triggers an AWS Lambda function. The Lambda function can then programmatically modify the instance's security group—removing its association or revoking ingress/egress rules—to automatically isolate the compromised resource. This is a well-established, near-real-time automated response pattern that requires no manual intervention and directly ties a confirmed threat to an infrastructure-level containment action.
Why this answer
Amazon GuardDuty generates findings for threats like communication with known malicious IPs, and these findings can be sent to Amazon CloudWatch Events (now Amazon EventBridge). CloudWatch Events can then trigger an AWS Lambda function that modifies the security group associated with the EC2 instance to remove its inbound/outbound rules, effectively isolating the instance. This automated workflow meets the security requirement without manual intervention.
Exam trap
The trap here is that candidates may think GuardDuty can directly trigger Systems Manager Automation (Option B) without the intermediate CloudWatch Events step, or they may confuse AWS Config's compliance evaluation with real-time network threat detection (Option D).
How to eliminate wrong answers
Option A is wrong because VPC Flow Logs are used for network traffic analysis and logging, not for real-time threat detection; creating a metric filter to trigger a Lambda function would require custom logic to identify malicious IPs and would not leverage GuardDuty's built-in threat intelligence. Option B is wrong because while AWS Systems Manager Automation can run documents to isolate instances, GuardDuty does not natively send findings directly to Systems Manager Automation; it sends findings to CloudWatch Events, which can then trigger Systems Manager Automation, but the option omits the necessary CloudWatch Events integration. Option D is wrong because AWS Config rules are designed for compliance and resource configuration changes, not for detecting network traffic patterns or malicious IP communication; they cannot evaluate VPC Flow Logs or network traffic in real time.
Which TWO AWS services can be used to detect anomalous API calls in an AWS account?
CloudTrail records all AWS API activity, and when its logs are streamed to CloudWatch Logs, you can create metric filters that match patterns such as repeated AccessDenied errors or a high volume of failed AssumeRole calls. These metric filters feed CloudWatch alarms, enabling near-real-time detection of anomalous API call patterns without requiring external threat feeds or ML models.
Why this answer
AWS CloudTrail with Amazon CloudWatch Logs metric filters is correct because CloudTrail records all API calls, and you can create metric filters on CloudWatch Logs to match patterns indicative of anomalous activity (e.g., unauthorized API calls, root user activity). When the filter triggers a threshold, it can send an alarm via Amazon SNS, enabling detection of anomalous API calls in near real-time.
Exam trap
The trap here is that candidates often confuse AWS Config's compliance evaluation (which checks resource configurations) with API call monitoring, leading them to select AWS Config instead of recognizing that only CloudTrail and GuardDuty (which uses CloudTrail logs and VPC Flow Logs for anomaly detection) can detect anomalous API calls.
A security engineer is setting up automated incident response for a compromised IAM user. The engineer wants to automatically revoke the user's access keys and attach a deny-all policy when a GuardDuty finding of type 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration' is generated. Which services should be used to achieve this automation?
Amazon CloudWatch Events (now Amazon EventBridge) detects the GuardDuty finding via a rule filtering on the specific finding type, then invokes an AWS Lambda function. The Lambda function executes the IAM API calls to revoke access keys and attach a deny-all policy, satisfying the requirement for automated, event-driven remediation without manual intervention.
Why this answer
Amazon CloudWatch Events (now part of Amazon EventBridge) can capture GuardDuty findings in real-time and trigger a Lambda function to revoke IAM user access keys and attach a deny-all policy. This is the native, event-driven pattern for automated incident response to GuardDuty findings, as CloudWatch Events directly supports GuardDuty as an event source.
Exam trap
The trap here is that candidates often confuse CloudWatch Events with SNS or Config, not realizing that CloudWatch Events is the only service that natively integrates with GuardDuty as an event source for real-time, automated remediation workflows.
How to eliminate wrong answers
Option A is wrong because Amazon SNS alone cannot trigger a Lambda function in response to GuardDuty findings; SNS requires a subscription and does not natively filter GuardDuty events. Option B is wrong because AWS Config is designed for resource compliance and configuration history, not for real-time event-driven response to security findings like GuardDuty. Option D is wrong because AWS Systems Manager Automation is intended for managing EC2 instances and on-premises servers, not for revoking IAM user credentials or attaching IAM policies.
A security engineer is designing an automated incident response workflow for an Amazon EC2 instance that is compromised. The workflow must isolate the instance by removing it from the security group that allows SSH access. The engineer wants to use AWS Systems Manager Automation to run a document. What is the most secure way to grant the automation the necessary permissions to modify the security group?
The correct approach is to create a dedicated Systems Manager Automation service role with a least-privilege IAM policy that grants only ec2:ModifySecurityGroupRules (ideally scoped to specific security group resource ARNs). During execution, the Automation document assumes this service role to call EC2 APIs directly via aws:executeAwsApi, so the user who triggers the run only needs ssm:StartAutomationExecution and iam:PassRole. This keeps the blast radius minimal and follows the principle of least privilege, as the service role exists solely for the automation's intended actions.
Why this answer
Systems Manager Automation can assume a dedicated service role with a least-privilege IAM policy that includes the specific action `ec2:ModifySecurityGroupRules`. This follows the security best practice of granting only the permissions required for the automation to modify the security group, without exposing broader privileges or relying on user or instance credentials.
Exam trap
The trap here is that candidates often confuse the instance profile role (used for the EC2 instance's own actions) with the automation service role (used for the Systems Manager service to perform actions on behalf of the engineer), leading them to incorrectly choose Option D.
How to eliminate wrong answers
Option B is wrong because introducing an AWS Lambda function adds unnecessary complexity and an additional attack surface; the automation can directly modify the security group via an assumed role without needing a middleman. Option C is wrong because using the IAM user's permissions violates the principle of least privilege and creates a security risk if the user has more permissions than needed; the automation should use a dedicated role, not inherit user credentials. Option D is wrong because attaching a policy to the EC2 instance profile grants permissions to the instance itself, not to the Systems Manager Automation service; the automation runs independently of the compromised instance and should not rely on the instance's role for incident response actions.
Refer to the exhibit. A security engineer is reviewing an S3 bucket policy. The policy is intended to allow access only from the corporate network (10.0.0.0/8). What is a potential security issue with this policy?
The policy's Principal element is set to "*", which means every principal—whether an authenticated IAM identity or an anonymous internet client—is a match. The only limiting factor is the IpAddress condition, so any request originating from the specified CIDR range is allowed without requiring AWS credentials. This effectively exposes the objects to anonymous read access from that IP range, which is exactly the vulnerability described.
Why this answer
The policy's `Principal: "*"` element allows anonymous access from any IP address, and the `Condition` block only restricts the source IP to 10.0.0.0/8. This means any unauthenticated request originating from within the corporate network (10.0.0.0/8) is permitted, effectively granting anonymous access to the S3 bucket. The intended goal of restricting access to authenticated corporate users is not achieved, as no `aws:userid` or `aws:username` condition is enforced.
Exam trap
The trap here is that candidates assume an IP address condition in a bucket policy automatically implies authenticated access, but AWS explicitly allows anonymous access when `Principal: "*"` is used, even with IP restrictions.
How to eliminate wrong answers
Option B is wrong because the policy uses `Action: "s3:GetObject"` which is a specific read action, not all actions; the issue is about authentication, not action scope. Option C is wrong because the resource ARN `arn:aws:s3:::example-bucket/*` is correct for object-level operations like GetObject; the bucket ARN without `/*` would be needed for bucket-level operations (e.g., ListBucket). Option D is wrong because MFA is not required by the scenario; the policy's flaw is allowing anonymous access, not the absence of MFA, and MFA is typically enforced via a separate condition key (`aws:MultiFactorAuthPresent`).
A company uses AWS CloudTrail to log all API activity. The security team wants to detect when an IAM user creates an access key for another user, which is a potential privilege escalation. Which TWO actions should the team take to set up this detection?
A CloudWatch alarm triggered by a metric filter converts matching CloudTrail events into an actionable notification. The filter patterns on CreateAccessKey events, and the alarm fires when the threshold is breached, satisfying the requirement to detect access key creation for another user.
Why this answer
Option C is correct because CloudTrail delivers API activity to a CloudWatch Logs log group, and a metric filter with a filter pattern matching the eventName "CreateAccessKey" converts those log events into a numeric CloudWatch metric that can be alarmed on. Option B is correct because a CloudWatch alarm on that metric filter's metric fires when the metric crosses the threshold, which is the standard way to detect and notify on the specific CreateAccessKey activity. Option A is not appropriate because AWS Config managed rules evaluate resource configuration compliance, not individual API calls.
Option D is not correct for this two-action pair because an EventBridge rule that triggers a Lambda function is a separate single-step alternative, not one of the two actions needed in the CloudWatch Logs metric filter and alarm setup. Option E is wrong because GuardDuty custom threat lists are for IP addresses and domains, not for detecting specific IAM API calls.
Exam trap
The trap here is that candidates often confuse AWS Config managed rules (which evaluate resource state) with CloudTrail event detection (which requires log-based monitoring), leading them to select Option A instead of the correct CloudWatch Logs metric filter and alarm pair.
During a security review, a security engineer notices that an S3 bucket contains sensitive data but has a bucket policy that allows access from any principal in the account. The engineer needs to identify any unintended cross-account access to this bucket. Which AWS service should be used?
AWS IAM Access Analyzer is specifically designed to identify unintended access to your resources from external entities. It applies automated reasoning to resource-based policies and generates findings that list the external principal, the resource, and the specific action granted, helping security engineers quickly identify and remediate cross-account access. This makes it the correct service for a security review focused on discovering whether any external accounts have been granted access to your resources.
Why this answer
AWS IAM Access Analyzer helps identify resources that are shared with external principals by analyzing resource-based policies (like S3 bucket policies). In this scenario, the bucket policy allows access from any principal in the account, but IAM Access Analyzer can detect if the policy also grants access to principals outside the AWS account (cross-account access). It generates findings for any policy that allows access from an external entity, making it the correct service to identify unintended cross-account access.
Exam trap
The trap here is that candidates often confuse AWS Config (which can detect public S3 buckets) with IAM Access Analyzer (which specifically detects cross-account access), leading them to choose Config when the question explicitly asks for unintended cross-account access, not just public access.
How to eliminate wrong answers
Option A is wrong because AWS Config evaluates resource compliance against rules but does not specifically analyze bucket policies for cross-account access; it can detect public access but not granular cross-account sharing. Option C is wrong because AWS Trusted Advisor provides best-practice checks (including S3 bucket permissions) but only flags buckets that are publicly accessible or open to all authenticated AWS users, not specifically cross-account access from a specific external account. Option D is wrong because Amazon Macie discovers and classifies sensitive data using machine learning, but it does not analyze bucket policies for cross-account permissions; it focuses on data content, not access controls.
A security engineer is setting up Amazon GuardDuty in a new AWS account. The engineer wants to ensure that GuardDuty can detect compromised EC2 instances that are exhibiting unusual network behavior, such as cryptocurrency mining. Which GuardDuty feature should the engineer enable to monitor network traffic for such threats?
GuardDuty analyzes VPC Flow Logs and DNS logs to detect unusual network behavior, such as communication with known malicious IPs or domains associated with cryptocurrency mining. This is a core capability of GuardDuty and is enabled by default. It does not require additional agents and provides network-level threat detection for EC2 instances.
Why this answer
GuardDuty continuously monitors VPC Flow Logs and DNS logs to identify unusual network activity, including connections to known malicious IPs or domains used for cryptocurrency mining. This network-based detection is a fundamental feature of GuardDuty and is enabled by default. Other features like S3 Protection, EKS Protection, and Runtime Monitoring address different threat vectors and are not the primary mechanism for detecting network-based threats on EC2 instances.
Exam trap
The trap here is confusing GuardDuty's network monitoring capabilities with its other protections, such as S3 or EKS, which are specific to those services and not for EC2 network traffic.
A security engineer is investigating a potential data exfiltration incident. The engineer suspects that an attacker is using an Amazon S3 bucket to exfiltrate data. Which AWS service can be used to analyze S3 access logs and detect anomalous patterns?
Amazon Athena is a serverless, interactive query service that allows you to analyze data directly in Amazon S3 using standard SQL without managing any infrastructure. A security engineer investigating potential data exfiltration can use Athena to run ad-hoc queries over S3 server access logs to identify unusual patterns such as repeated GET operations, large data transfers, or requests from unexpected IP addresses. Because Athena charges per query and requires no cluster setup, it is the appropriate tool for on-demand log analysis in an S3-centric investigation.
Why this answer
Amazon Athena is the correct choice because it allows you to run SQL queries directly against Amazon S3 access logs stored in S3, enabling you to analyze large volumes of log data for anomalous patterns such as unusual data transfer volumes, repeated access from unfamiliar IP ranges, or unexpected object reads. This serverless query service is purpose-built for ad-hoc analysis of structured and semi-structured data in S3 without needing to load data into a separate database, making it ideal for incident response investigations.
Exam trap
The trap here is that candidates often confuse AWS WAF or CloudFront as log analysis tools because they are associated with web traffic inspection, but neither provides the ability to query S3 access logs for data exfiltration patterns.
How to eliminate wrong answers
Option A is wrong because Amazon CloudFront is a content delivery network (CDN) that accelerates static and dynamic content delivery; it does not provide query capabilities for S3 access logs and cannot analyze log data for anomalies. Option C is wrong because AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards against network and transport layer attacks; it does not inspect or analyze S3 access logs for data exfiltration patterns. Option D is wrong because AWS WAF is a web application firewall that filters HTTP/HTTPS traffic based on rules to protect against common web exploits; it operates at the application layer and cannot query or analyze S3 access logs.
A security engineer notices that an EC2 instance is sending outbound traffic to a known malicious IP address. The engineer needs to immediately block the traffic and capture a packet capture for forensic analysis. Which combination of actions should the engineer take?
Network ACLs act as a stateless firewall at the subnet level, and they explicitly support deny rules that are evaluated in numeric order before traffic reaches the EC2 instance. Adding a deny rule for the malicious IP immediately blocks both inbound and outbound traffic from that source at the subnet boundary. VPC Traffic Mirroring complements this by capturing full packet payloads, giving the security engineer the packet-level forensic data needed to investigate the incident without disrupting the traffic flow.
Why this answer
A network ACL (NACL) is a stateless firewall that operates at the subnet level, allowing immediate blocking of traffic to/from a specific IP address without affecting the instance's security group rules. Enabling VPC Traffic Mirroring captures a full packet-level copy of the traffic for forensic analysis, which is superior to VPC Flow Logs (which only capture metadata). This combination provides both rapid containment and deep forensic data.
Exam trap
The trap here is that candidates confuse security groups (stateful, allow-only) with network ACLs (stateless, allow/deny) and mistakenly think a security group can block a specific IP, or they assume VPC Flow Logs provide packet-level capture when they only provide metadata.
How to eliminate wrong answers
Option A is wrong because Amazon GuardDuty is a threat detection service, not a blocking mechanism; it cannot directly block traffic, and VPC Traffic Mirroring is not enabled via GuardDuty. Option C is wrong because stopping the EC2 instance halts all traffic but prevents capturing live malicious traffic for analysis, and VPC Flow Logs only provide metadata (source/destination IP, ports, protocol) not full packet payloads. Option D is wrong because security groups are stateful and cannot deny outbound traffic to a specific IP address; they only support allow rules, and VPC Flow Logs do not capture packet contents.
A security engineer is configuring automated response to a specific GuardDuty finding type. The engineer wants to automatically block the offending IP address in the security group when a finding is generated. Which TWO AWS services should the engineer use together to achieve this? (Choose TWO.)
Lambda executes custom remediation logic when GuardDuty publishes a finding to EventBridge, calling EC2 APIs to revoke the offending IP from the security group. It supplies the compute that performs the block, which the detection service alone cannot do.
Why this answer
Amazon EventBridge [CORRECT] is the right service to detect the GuardDuty finding event, because GuardDuty publishes its findings as events to the default EventBridge event bus, and an EventBridge rule can match the specific finding type (e.g., source aws.guardduty with the desired detail-type) and route it to a target for automated response. AWS Lambda [CORRECT] is the correct target to perform the remediation, since a Lambda function can call the EC2 APIs (such as AuthorizeSecurityGroupIngress/RevokeSecurityGroupIngress or ModifyNetworkInterfaceAttribute) to block the offending IP address in the security group. AWS Config is for recording resource configuration changes and evaluating compliance rules, not for event-driven remediation of GuardDuty findings.
Amazon SNS can deliver notifications but cannot itself modify security groups, so it does not perform the blocking action. Amazon CloudWatch Logs stores log data but does not react to GuardDuty findings or execute remediation logic.
Exam trap
The trap here is that candidates often choose SNS because it is commonly associated with GuardDuty alerts, but they overlook that SNS cannot perform API actions like modifying security groups—only Lambda or Step Functions can execute the remediation logic.
A company uses AWS Organizations with multiple accounts. The security team wants to centrally collect and analyze VPC Flow Logs from all accounts. What is the MOST efficient way to achieve this?
VPC Flow Logs natively support delivering to an S3 bucket that is owned by a different account, such as a security account. The central bucket policy must grant the delivery.logs.amazonaws.com service principal permission to PutObject, with an aws:SourceAccount condition restricting writes to the authorized source accounts. This configures direct, server-side log delivery without any interim services or replication.
Why this answer
It uses a central S3 bucket in the security account with a bucket policy that grants the PutObject permission to the VPC Flow Logs delivery service from each source account. This is the most efficient approach as it avoids per-account configuration overhead, eliminates the need for cross-account replication, and provides a single location for centralized analysis using services like Amazon Athena or Amazon QuickSight.
Exam trap
The trap here is that candidates assume Firewall Manager (Option A) handles log aggregation, but it only manages the configuration policy, not the actual log delivery destination; similarly, many mistakenly think CloudWatch Logs (Option B) supports cross-account delivery natively, which it does not.
How to eliminate wrong answers
Option A is wrong because AWS Firewall Manager can centrally deploy VPC Flow Logs configurations but does not aggregate the logs themselves; it only manages the policy, and logs still need to be delivered to a central destination. Option B is wrong because CloudWatch Logs log groups cannot be written to cross-account by default; VPC Flow Logs can only deliver to a CloudWatch Logs log group in the same account, and centralizing requires additional infrastructure like a subscription filter or Lambda to forward logs. Option D is wrong because it introduces unnecessary complexity and cost by requiring S3 replication, which adds latency and storage overhead, and is less efficient than direct cross-account delivery to a central bucket.
A security engineer is investigating a potential data exfiltration incident where an EC2 instance is sending large volumes of data to an unknown IP address. Which AWS service should the engineer use to capture and analyze the network traffic for evidence?
VPC Traffic Mirroring captures IP traffic flowing to and from an EC2 instance's elastic network interface and copies it to a chosen destination—such as a security appliance or a workload running another ENI—for inspection and storage. It supports both inbound and outbound traffic, can mirror multiple ENIs, and allows filtering by protocol, source, destination, port, or TCP flags, enabling the security engineer to focus on suspicious or unauthorized transfers. Unlike the other services, it provides full packet contents, not just metadata or aggregated flow logs, so it is the appropriate method to investigate and potentially prove data exfiltration from a compromised instance. Note, it is not a native log store; the mirrored traffic must be sent to a tool like a network analyzer or a custom capture environment, but that is exactly why it is suitable for an in-depth forensic investigation.
Why this answer
VPC Traffic Mirroring is the correct choice because it allows you to capture and inspect network traffic from an EC2 instance by mirroring the traffic to a monitoring appliance or a security tool. This enables deep packet inspection to analyze the contents of the data being sent to the unknown IP address, providing evidence for data exfiltration. Unlike other services, Traffic Mirroring operates at the network level, copying all packets (including payloads) without affecting the source instance.
Exam trap
The trap here is that candidates often confuse VPC Traffic Mirroring with VPC Flow Logs, but Flow Logs only capture metadata (source/destination IP, ports, protocol, packet count) and not the actual packet payloads, making them insufficient for evidence of data exfiltration content.
How to eliminate wrong answers
Option A is wrong because AWS WAF is a web application firewall that inspects HTTP/HTTPS traffic at the application layer (Layer 7) and cannot capture or analyze raw network packets or non-HTTP traffic. Option B is wrong because AWS Shield is a DDoS protection service that mitigates volumetric attacks but does not provide packet capture or forensic analysis of outbound traffic. Option C is wrong because Amazon Inspector is a vulnerability assessment service that scans for software vulnerabilities and network exposure, not a tool for capturing or analyzing live network traffic.
During an incident response, a security engineer needs to collect volatile memory from a compromised EC2 instance without affecting the running system. The instance is critical and cannot be stopped. Which approach is most appropriate?
AWS Systems Manager Run Command offers a way to execute an approved memory capture utility (e.g., LiME, DumpIt, or a custom script) directly on the live instance without stopping it, preserving the volatile memory contents. Because the command runs in the guest OS via the SSM Agent, it can invoke kernel-level memory dumping tools with the appropriate privileges, and the captured image can be streamed to S3 for forensic analysis. This approach minimizes disruption and avoids alerting the attacker, making it the correct choice among the options.
Why this answer
AWS Systems Manager Run Command allows you to execute a memory capture utility (such as WinPmem or LiME) on the EC2 instance without stopping it, preserving volatile memory for forensic analysis. This approach uses the SSM Agent to run commands remotely, minimizing impact on the running system while collecting critical evidence like running processes, network connections, and kernel data.
Exam trap
The trap here is that candidates may think stopping the instance (Option A) is safe for forensics, but they forget that volatile memory is lost on shutdown, making it useless for memory analysis.
How to eliminate wrong answers
Option A is wrong because stopping the instance destroys volatile memory (RAM contents are lost on power-off), defeating the purpose of collecting a memory dump. Option B is wrong because AWS License Manager is a service for managing software licenses, not for capturing instance memory; it has no capability to snapshot RAM. Option C is wrong because Amazon EC2 Rescue is a tool for diagnosing and troubleshooting EC2 issues (e.g., collecting logs and configuration data), but it does not perform a full memory dump; it focuses on system health, not forensic memory acquisition.
A security team discovers that an IAM user's credentials are being used from an unusual geographic location. Which AWS service can provide automated response to revoke the user's access immediately?
AWS Systems Manager Automation is a fully managed service that runs predefined runbooks to execute operational and security response workflows. For IAM credential compromise, runbooks such as AWSDisableIAMAccessKey can be invoked via an EventBridge rule that listens for GuardDuty findings, automatically disabling the affected access key. This provides policy-driven, serverless remediation without requiring custom code, and the runbook can be scoped to least-privilege permissions for the automation role, making it the correct choice for event-driven incident response.
Why this answer
AWS Systems Manager Automation is correct because it can be triggered by Amazon GuardDuty findings (e.g., UnauthorizedAccess:IAMUser/AnomalousBehavior) via Amazon EventBridge to run an automation document that immediately revokes the IAM user's access keys and applies a deny-all policy. This provides a fully automated, low-latency response without requiring manual intervention or custom code.
Exam trap
The trap here is that candidates often pick Amazon GuardDuty because they associate it with threat detection, but they overlook that GuardDuty only detects and alerts—it requires a separate automation service like Systems Manager Automation to actually perform the revocation.
How to eliminate wrong answers
Option A is wrong because Amazon GuardDuty is a threat detection service that identifies anomalous activity but does not have built-in capabilities to automatically revoke IAM user credentials; it relies on downstream services like Systems Manager Automation or Lambda for response. Option C is wrong because AWS Lambda is a compute service that can execute custom code to revoke credentials, but it is not a managed automated response service itself—it requires you to write and maintain the function, whereas Systems Manager Automation provides a pre-built, auditable runbook. Option D is wrong because AWS Config is a resource compliance and configuration tracking service; it cannot directly revoke IAM credentials or respond to real-time security events.
A security engineer is investigating a potential credential compromise. An IAM user's access key was used to launch EC2 instances in a region where the user has never operated before. The engineer wants to quickly identify all API calls made by this user in the last 24 hours, including the source IP addresses. Which AWS service or feature should be used?
AWS CloudTrail is the authoritative audit trail for AWS API activity, recording every management and data event with the invoking IAM identity, source IP address, user agent, and timestamp. For a credential investigation, CloudTrail lets you reconstruct exactly which programmatic or console actions were performed with the suspected credentials, including failed authentication attempts and sign-in events from the us-east-1 region. It can also be configured to deliver those immutable logs to S3 for long-term forensics and to CloudWatch Logs for real-time alerting, making it the primary service to answer 'who did what, when, and from where'.
Why this answer
AWS CloudTrail is the correct service because it records all API calls made by IAM users, including the source IP address, user identity, and request details. By querying CloudTrail logs for the specific IAM user's access key over the last 24 hours, the engineer can identify every EC2-related and other API call, along with the originating IP addresses, enabling rapid investigation of the potential credential compromise.
Exam trap
The trap here is that candidates may confuse VPC Flow Logs (network-level traffic) with CloudTrail (API-level activity), mistakenly thinking flow logs can identify which IAM user performed an action, when in fact flow logs only show IP addresses and ports without user identity.
How to eliminate wrong answers
Option B (VPC Flow Logs) is wrong because it captures network traffic metadata (IP addresses, ports, protocols) at the VPC level, not API calls made by IAM users; it cannot show which user or access key initiated an EC2 instance launch. Option C (AWS Trusted Advisor) is wrong because it provides best-practice checks and recommendations (e.g., security groups, cost optimization), not a record of API activity or source IPs for user actions. Option D (Amazon CloudWatch Logs) is wrong because it is a service for monitoring, storing, and accessing log files from various AWS resources (e.g., application logs, Lambda logs), but it does not natively capture IAM user API call history; CloudTrail logs can be sent to CloudWatch Logs, but CloudWatch Logs itself is not the source of API call records.
A company has a security requirement to capture all DNS queries made by EC2 instances for threat analysis. Which AWS service can provide this capability with minimal configuration?
Amazon Route 53 Resolver DNS Firewall enables you to filter and log DNS queries that are made through Amazon Provided DNS within a VPC. By associating DNS Firewall rule groups with a VPC and enabling Route 53 Resolver query logging, you capture detailed DNS query metadata, including the queried domain name, query type, response code, and the source IP of the requester. This makes it a direct fit for the security requirement to capture all DNS queries, because it both monitors and optionally blocks DNS traffic at the resolver level.
Why this answer
Amazon Route 53 Resolver DNS Firewall can capture and log all DNS queries made by EC2 instances by enabling DNS query logging to Amazon S3 or CloudWatch Logs. This requires minimal configuration because it integrates directly with the VPC's DNS resolver, automatically capturing outbound DNS traffic without needing agents or changes to instance configurations.
How to eliminate wrong answers
Option A is wrong because VPC Flow Logs capture IP traffic metadata (source/destination IPs, ports, protocols) but do not capture DNS query names or content; they operate at Layer 3/4, not Layer 7. Option B is wrong because Amazon Inspector is a vulnerability assessment service that scans for software vulnerabilities and network exposure, not a DNS query logging or threat analysis tool. Option D is wrong because AWS CloudTrail records API calls made to AWS services (e.g., EC2 RunInstances), not network-level DNS queries from instances.
A security engineer needs to centrally aggregate AWS CloudTrail management events from all accounts in an AWS Organizations organization and retain them for 7 years in immutable storage. The engineer has already created an organization trail that delivers to a central S3 bucket in the security account. Which additional configuration is required to make the logs tamper-evident and to detect if any account attempts to disable CloudTrail?
S3 Object Lock in compliance mode prevents deletion or overwrite of log objects for the retention period, satisfying the immutability requirement. CloudTrail log file validation adds a digest file so tampering with delivered logs is detectable. An EventBridge rule matching the StopLogging event (and other trail-modification APIs) provides the alerting on attempts to disable logging.
Why this answer
Immutability and tamper detection are two distinct controls. S3 Object Lock in compliance mode enforces WORM retention so logs cannot be altered or deleted for the retention period, and CloudTrail log file validation produces digest files that let you verify delivered logs were not modified. Because disabling a trail stops future delivery, an EventBridge rule matching the StopLogging event (and related trail APIs) is needed to alert the security team immediately.
Exam trap
The trap here is assuming that S3 Versioning or MFA Delete alone provides immutability, when those only protect against deletion and do not prevent overwrites or prove log integrity.
During an incident response, a security engineer needs to preserve the state of an EC2 instance for forensic analysis. The instance is running a production workload that cannot be interrupted. Which of the following actions should the engineer take FIRST to ensure data integrity?
AWS Systems Manager Run Command can invoke a memory acquisition utility on the live instance, such as one using the Linux kernel module LiME, to copy the contents of RAM to an EBS volume or S3 without requiring a reboot or instance stop. This preserves volatile evidence like loaded kernel modules, open network sockets, and running processes, which are essential for determining the scope of compromise. Storing the memory dump in S3 protects chain of custody if versioning and object lock are enabled, and it does not alter the underlying disk volumes.
Why this answer
During an incident response, preserving volatile data (such as memory contents) is critical before any other action that might alter the system state. AWS Systems Manager Run Command can execute a command (e.g., using `dd` or `LiME`) to capture a memory dump and store it in Amazon S3 without interrupting the production workload. This ensures that forensic artifacts like running processes, network connections, and encryption keys are preserved before any disk-level operations that could overwrite or modify evidence.
Exam trap
The trap here is that candidates often prioritize disk-level preservation (snapshots or AMIs) as the first step, forgetting that volatile memory contains critical evidence that is lost the moment the instance is stopped or snapshotted, and that AWS Systems Manager can capture this data without interrupting the workload.
How to eliminate wrong answers
Option A is wrong because running the `dd` command to clone the root volume to another EBS volume requires the volume to be unmounted or in a consistent state; doing so on a running production instance can cause data corruption or I/O errors, and it does not capture volatile memory. Option B is wrong because creating an AMI from a running instance without first freezing the filesystem (e.g., using `fsfreeze`) can result in an inconsistent image due to ongoing writes, and it does not capture memory contents. Option C is wrong because taking a snapshot of attached EBS volumes while the instance is running does not guarantee crash consistency unless all volumes are snapshotted simultaneously (multi-volume snapshot), and it still fails to preserve volatile memory data that is essential for forensic analysis.
A security engineer is investigating a potential data exfiltration incident where an attacker used a compromised EC2 instance to transfer data to an external IP. Which TWO AWS services can provide evidence of the network traffic and the API calls made from the instance?
VPC Flow Logs capture metadata about IP traffic to and from network interfaces, including source and destination IPs, ports, protocol, and packet/byte counts. This enables you to see large outbound transfers to an unusual external IP, which is a classic sign of data exfiltration. Note that flow logs do not contain payload contents, but they are the foundational raw network log for investigating suspected exfiltration.
Why this answer
VPC Flow Logs capture metadata about IP traffic going to and from network interfaces, including the source/destination IP, ports, protocol, and packet/byte counts. This provides direct evidence of data being transferred to an external IP address from the compromised EC2 instance. AWS CloudTrail records API calls made within the AWS environment, such as those executed by the EC2 instance's IAM role or the instance itself (e.g., via the AWS CLI or SDK), which can reveal actions like starting data transfers or modifying security groups to allow exfiltration.
Exam trap
The trap here is that candidates often confuse Amazon GuardDuty as a source of raw evidence (like logs) when it is actually a detection service that consumes logs from other services (VPC Flow Logs, CloudTrail, DNS logs) to generate alerts, not a storage or retrieval service for the underlying traffic or API data.
Which THREE actions should be taken when preserving forensic evidence from an EC2 instance during an incident? (Select THREE.)
An EBS snapshot captures a point-in-time, block-level copy of every attached volume, preserving disk artefacts such as logs, malware and deleted files without altering the running instance. It satisfies evidence preservation while keeping the original instance available for further collection.
Why this answer
Option B is correct because creating an EBS snapshot of all attached volumes captures a point-in-time, block-level copy of the instance's disk data (including the root volume) that can later be restored and analyzed without altering the original evidence. Option D is correct because volatile memory contains artifacts such as running processes, network connections, and encryption keys that are lost on shutdown, so capturing a memory dump with a tool like LiME preserves this critical evidence. Option E is correct because modifying the security group to remove inbound/outbound rules isolates the instance from the network, preventing further compromise or data exfiltration while keeping the instance running so volatile evidence remains intact.
Option A is not appropriate because rebooting destroys volatile memory and can trigger anti-forensic behavior, and Option C is not appropriate because terminating the instance destroys the ephemeral storage and volatile state and may delete the very evidence needed for investigation.
Exam trap
The SCS-C02 exam often tests the misconception that rebooting or terminating an instance is a safe containment step, but in forensic contexts these actions destroy volatile evidence and should be avoided until after memory and disk acquisition.
The above IAM policy is attached to an AWS Lambda function. The function is failing to write logs to CloudWatch Logs. What is the likely cause?
PutLogEvents requires access to the log group resource as well.
Why this answer
The IAM policy grants `logs:CreateLogStream` and `logs:PutLogEvents` with a resource ARN that correctly targets log streams under the specified log group. However, the policy lacks any statement that grants permission on the log group resource itself. If the log group does not already exist, the Lambda function requires `logs:CreateLogGroup` permission on the log group ARN (`arn:aws:logs:us-east-1:123456789012:log-group:MyLogGroup`) to create it.
Without this, the function cannot create the log group, causing the write to fail. The resource ARN in the policy does not include the log group itself, only log streams, which is why the function lacks the necessary permissions to interact with the log group resource.
Exam trap
The trap here is that candidates focus on the actions (e.g., missing `logs:DescribeLogGroups`) rather than the resource ARN, which must include the log group itself (not just log streams) for the initial log group creation or access check.
How to eliminate wrong answers
Option B is wrong because `logs:DescribeLogGroups` is not required for writing logs; the Lambda execution role typically needs `logs:CreateLogGroup` on the log group resource to allow the function to create the log group if it doesn't exist, but the core issue is the resource ARN mismatch, not the missing action. Option C is wrong because an explicit deny is not needed; IAM defaults to an implicit deny for any action not explicitly allowed, so missing an explicit deny does not cause failures. Option D is wrong because the region in the ARN (`us-east-1`) matches the Lambda function's region in the scenario; the question does not indicate a region mismatch, and even if it did, the error would be a different one (e.g., cross-region access denied), not the specific failure to write logs.
A company uses AWS Organizations with multiple accounts and has enabled AWS Security Hub in the management account. The security team wants to automatically remediate a specific finding type that appears in Security Hub. Which combination of services should be used to achieve this?
Security Hub natively publishes findings to an Amazon EventBridge default event bus, so a rule in the administrator account can match the source 'aws.securityhub' and invoke a Lambda function for immediate remediation. The Lambda function can parse the finding ID, AwsAccountId, and compliance status, then execute corrective action such as modifying an IAM policy or enabling encryption. In a multi-account organization, this is the intended native path for turning Security Hub findings into automated responses, especially when cross-Region aggregation is enabled.
Why this answer
Amazon EventBridge can capture Security Hub findings as events using an event rule that matches the specific finding type. When the rule triggers, it invokes an AWS Lambda function that contains the remediation logic, such as modifying security group rules or disabling access keys. This combination provides a serverless, event-driven architecture for automated response to Security Hub findings.
Exam trap
The trap here is that candidates may confuse Security Hub's integration with other AWS security services (GuardDuty, Inspector) as the trigger mechanism, when in fact EventBridge is the standardized event bus that Security Hub uses to emit findings for automated response.
How to eliminate wrong answers
Option B is wrong because AWS Config conformance packs are used to evaluate resource compliance against rules, not to reactively remediate specific Security Hub findings; while Systems Manager Automation can run remediation, the integration with Security Hub is typically done via EventBridge, not directly through conformance packs. Option C is wrong because Amazon Inspector is a vulnerability assessment service that generates its own findings, not a service for remediating Security Hub findings; Step Functions could orchestrate remediation but the trigger from Security Hub still requires EventBridge. Option D is wrong because Amazon GuardDuty is a threat detection service that generates its own findings, not a service for remediating Security Hub findings; while Lambda can be used for remediation, the correct trigger for Security Hub findings is EventBridge, not GuardDuty.
A security engineer needs to detect suspicious API calls across multiple AWS accounts. The engineer has enabled AWS CloudTrail in each account and is sending logs to a central S3 bucket. Which additional step should the engineer take to analyze the logs for potential threats?
Amazon GuardDuty is a continuous, intelligent threat detection service that ingests CloudTrail management events, VPC Flow Logs, and DNS query logs to detect suspicious API calls. It builds a baseline of normal account behavior and uses anomaly detection, machine learning, and threat intelligence to identify actions such as unusual logins, IAM privilege escalation, or resource exposure. Enabling it in each account gives complete coverage of API activity across the organization.
Why this answer
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, including suspicious API calls, by analyzing CloudTrail management and data events, VPC Flow Logs, and DNS logs. By enabling GuardDuty in each account, the security engineer can automatically detect potential threats across all accounts without manual log analysis. This directly addresses the need to analyze CloudTrail logs for suspicious API calls at scale.
Exam trap
The trap here is that candidates may confuse VPC Flow Logs (network traffic) with CloudTrail logs (API activity), or think that Config rules or Trusted Advisor can detect suspicious API calls, when in fact GuardDuty is the dedicated threat detection service for this purpose.
How to eliminate wrong answers
Option A is wrong because AWS Config rules monitor resource configuration compliance (e.g., ensuring CloudTrail is enabled), not the content of API calls for threat detection. Option B is wrong because AWS Trusted Advisor provides best-practice recommendations for cost, performance, and security, but does not analyze CloudTrail logs for suspicious API calls. Option D is wrong because VPC Flow Logs capture network traffic metadata (IP addresses, ports, protocols) and are useful for network-level threat detection, but they do not analyze CloudTrail API call logs for suspicious activity.
A company's security policy requires that all S3 buckets be encrypted at rest. An security engineer needs to detect any S3 bucket that does not have default encryption enabled. Which AWS service should the engineer use to continuously monitor and alert on non-compliant buckets?
AWS Config continuously records S3 bucket configuration and evaluates it against managed or custom rules, flagging buckets lacking default encryption. This satisfies the requirement for ongoing detection and alerting, unlike one-off scans or CloudTrail, which logs API activity rather than resource compliance state.
Why this answer
AWS Config is the correct service because it provides continuous monitoring and evaluation of your AWS resource configurations against desired policies. You can create an AWS Config rule, such as the managed rule 's3-bucket-default-encryption-enabled', which automatically checks each S3 bucket for the presence of default encryption (SSE-S3 or SSE-KMS) and triggers an alert or remediation action for any non-compliant bucket. This aligns directly with the requirement to detect and alert on buckets lacking encryption at rest.
Exam trap
The trap here is that candidates often confuse AWS CloudTrail (which logs API calls) with AWS Config (which evaluates resource configurations), leading them to choose CloudTrail for monitoring encryption settings when it only records the actions that change encryption, not the current state of encryption on each bucket.
How to eliminate wrong answers
Option A is wrong because AWS CloudTrail records API activity (e.g., PutBucketEncryption calls) but does not continuously evaluate the current configuration state of resources; it is an audit trail, not a compliance checker. Option C is wrong because AWS Trusted Advisor provides one-time or periodic checks for best practices (including S3 bucket permissions) but does not offer continuous, customizable monitoring or alerting for specific encryption settings like default encryption. Option D is wrong because Amazon GuardDuty is a threat detection service that analyzes VPC Flow Logs, DNS logs, and CloudTrail events for malicious activity; it does not evaluate resource configurations for compliance with encryption policies.
During incident response, a security engineer needs to preserve the state of a running EC2 instance for forensic analysis without losing volatile data. The instance is in an Auto Scaling group. Which action should the engineer take FIRST?
Suspending HealthCheck and ReplaceUnhealthy stops the Auto Scaling group terminating or replacing the instance while it is isolated for forensics. This preserves volatile memory and disk state, which would otherwise be lost if the group launched a replacement.
Why this answer
Suspending the `HealthCheck` and `ReplaceUnhealthy` processes on the Auto Scaling group prevents the group from detecting the instance as unhealthy and terminating it while the engineer preserves volatile data. This is the first step to ensure the instance remains running and accessible for forensic collection (e.g., memory dump) before any other actions that could alter its state.
Exam trap
The trap here is that candidates often choose to stop the instance or take an AMI first, not realizing that those actions destroy volatile data or require a stable state, whereas the correct first step is to prevent the Auto Scaling group from interfering with the running instance.
How to eliminate wrong answers
Option A is wrong because detaching the instance from the Auto Scaling group does not prevent the group from launching a replacement instance, but more critically, it does not protect the running instance from being terminated by other processes or manual actions; it also does not preserve volatile data. Option B is wrong because stopping the instance immediately loses volatile data (RAM, network connections, process state) which is critical for forensic analysis; the goal is to preserve the running state, not halt it. Option C is wrong because taking an AMI of the instance requires the instance to be in a stable state (often stopped or with consistent filesystem), and it does not capture volatile memory; it also takes time and could alter the instance state during the snapshot process.
A company's security policy requires that all S3 bucket access logs be delivered to a central S3 bucket in the security account. A security engineer notices that some buckets are not delivering logs. The engineer needs to identify which buckets are not logging and ensure compliance. Which service should the engineer use to continuously monitor and report on S3 bucket logging?
AWS Config is the correct answer because its managed rule "s3-bucket-logging-enabled" checks the configuration state of each S3 bucket and determines whether server access logging is pointed at a valid destination bucket. AWS Config records bucket resource configurations as configuration items, evaluates them against desired policies, and provides continuous compliance results, which matches the security requirement precisely. It can optionally trigger automatic remediation via Systems Manager Automation if a bucket is found noncompliant.
Why this answer
AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired policies. By using an AWS Config managed rule like `s3-bucket-logging-enabled`, the security engineer can automatically detect S3 buckets that do not have logging enabled and receive compliance notifications, ensuring ongoing adherence to the security policy.
Exam trap
The trap here is confusing AWS CloudTrail (which logs API calls) with AWS Config (which evaluates resource configurations), leading candidates to mistakenly choose CloudTrail for configuration compliance checks instead of Config.
How to eliminate wrong answers
Option A is wrong because Amazon Macie is a data security service that uses machine learning to discover, classify, and protect sensitive data in S3, not to monitor bucket logging configurations. Option B is wrong because Amazon S3 Inventory provides a list of objects and their metadata for auditing or lifecycle management, but it does not evaluate or report on the logging configuration of the buckets themselves. Option D is wrong because AWS CloudTrail records API activity for governance and auditing, but it does not continuously assess the configuration state of S3 bucket logging settings.
A company uses AWS Organizations with multiple accounts. The security team wants to centrally collect and analyze CloudTrail logs from all accounts in a single S3 bucket. What is the most efficient way to achieve this?
An organization trail created in the management account automatically logs events from every member account into one S3 bucket, removing the need to configure and maintain individual trails per account. This directly satisfies the centralised collection requirement.
Why this answer
AWS Organizations supports creating a single organization trail in the management account that automatically logs CloudTrail events for all accounts in the organization. This centralizes log collection into one S3 bucket without needing to configure trails per account, making it the most efficient and scalable approach for multi-account environments.
Exam trap
The trap here is that candidates often assume each account must have its own trail (Option A) or that a streaming solution like CloudWatch Logs (Option B) is required, overlooking the native organization-level trail feature that simplifies centralization.
How to eliminate wrong answers
Option A is wrong because creating a trail in each account and pointing to the same S3 bucket requires manual setup per account, does not scale efficiently, and can lead to permission conflicts or log overwrites if bucket policies are not correctly configured. Option B is wrong because CloudWatch Logs subscription filters are designed to stream log data to a central account for real-time processing, but they are not the most efficient way to collect CloudTrail logs for long-term storage in S3; they add complexity and cost for a task that organization trails handle natively. Option D is wrong because S3 cross-region replication copies objects between buckets in different regions, but it does not centralize logs from multiple accounts into a single bucket; it requires each account to have its own bucket and replication rules, adding overhead and potential for configuration errors.
A company uses Amazon GuardDuty and has enabled EKS audit logs as a data source. The security team wants to detect potential container escape attempts. Which TWO findings would indicate a container escape attempt? (Choose TWO.)
PrivilegeEscalation:EKS/KubernetesAPICallFromContainer is correct because GuardDuty specifically samples Kubernetes audit logs and correlates the source IP and user agent to identify when a container makes API calls to the Kubernetes control plane. A container that calls sensitive APIs, such as creating privileged pods, binding cluster roles, or listing secrets, may be attempting to escalate privileges and potentially escape the container runtime. Since this finding directly matches the suspicious API activity from a container using EKS audit logs, it is the most appropriate detection for a container escape.
Why this answer
The PrivilegeEscalation:EKS/KubernetesAPICallFromContainer finding specifically detects when a container makes Kubernetes API calls that indicate an attempt to escalate privileges, such as creating pods with elevated permissions or accessing cluster-admin roles. This is a direct indicator of a container escape attempt, as the container is interacting with the Kubernetes control plane to gain unauthorized access to the host or other resources.
Exam trap
The trap here is that candidates may confuse ECS-specific findings (like SuspiciousCommand) with EKS findings, or mistake general EC2 threats (like SSH brute force or crypto mining) as indicators of container escape, when only findings directly tied to Kubernetes API calls or sensitive mounts are relevant.
A company uses Amazon GuardDuty to detect threats. The security team wants to be alerted when GuardDuty generates a finding with a severity level of HIGH or CRITICAL. Which AWS service should the team use to send notifications based on GuardDuty findings?
Amazon EventBridge and Amazon Simple Notification Service (SNS) form the canonical real-time alerting pattern for GuardDuty. GuardDuty automatically publishes every finding to the default EventBridge bus, and a rule can filter on fields like severity, finding type, or affected resource before targeting an SNS topic. SNS then fans out the notification to email, SMS, HTTP/S endpoints, or mobile push, ensuring security analysts are immediately notified without custom code or polling. This native integration is the recommended and fully managed approach.
Why this answer
Amazon EventBridge can capture GuardDuty findings as events using a rule that matches the 'GuardDuty Finding' event type. The rule can then invoke an SNS topic to send email or SMS notifications. This is the recommended pattern because EventBridge provides native integration with GuardDuty and supports filtering by finding severity using event patterns, while SNS handles the actual notification delivery.
Exam trap
The trap here is that candidates often assume GuardDuty findings go directly to CloudWatch Logs or that Lambda is required for filtering, but the native integration with EventBridge eliminates the need for custom processing or intermediate services.
How to eliminate wrong answers
Option A is wrong because Amazon SQS is a message queue service for decoupling application components, not for sending notifications; it would require a separate consumer to poll and send alerts. Option C is wrong because AWS Lambda alone cannot send notifications; it would need to invoke SNS or another service, making it an unnecessary intermediate step when EventBridge can directly route to SNS. Option D is wrong because GuardDuty findings are not automatically sent to CloudWatch Logs; GuardDuty publishes events to EventBridge, not to CloudWatch Logs, so this option introduces an incorrect data flow.
A security engineer is investigating an AWS CloudTrail log entry that shows an unauthorized API call to delete an S3 bucket. Which service should the engineer use to analyze the log data for patterns of similar malicious activity?
Amazon CloudWatch Logs Insights is a log query and analysis engine, not a purpose-built threat detection service. While it can search CloudTrail logs if they are streamed to Amazon CloudWatch Logs, it lacks GuardDuty's machine-learning models, anomaly detection, and integrated threat intelligence to automatically identify suspicious API activity. It requires you to manually craft queries based on prior knowledge of attack patterns, making it a reactive tool rather than a proactive detector of malicious behavior.
Why this answer
Amazon CloudWatch Logs Insights is the service designed for interactively querying and analyzing log data stored in CloudWatch Logs. In this scenario, the security engineer already has a CloudTrail log entry and needs to search through the logs for patterns of similar malicious activity. CloudWatch Logs Insights allows running queries to identify such patterns.
Amazon GuardDuty is a threat detection service that automatically monitors for malicious activity, but it does not provide a means for the engineer to directly analyze log data; it generates findings based on its own analysis.
Exam trap
The trap is that candidates may choose GuardDuty because it is a threat detection service, but the question specifically asks for a service the engineer should use to analyze log data. That is a manual query task, which CloudWatch Logs Insights handles, not GuardDuty.
How to eliminate wrong answers
Option A is wrong because AWS Config is a service for evaluating resource configurations and compliance against rules, not for analyzing CloudTrail log patterns for malicious activity; it lacks threat detection capabilities. Option B is wrong because Amazon CloudWatch Logs Insights is a query tool for searching and analyzing log data, but it does not provide automated threat detection or pattern recognition for malicious activity; it requires manual querying and lacks built-in threat intelligence. Option C is wrong because AWS Artifact is a self-service portal for downloading AWS compliance reports and agreements, with no capability to analyze CloudTrail logs or detect unauthorized activity.
An organization uses AWS Organizations with multiple accounts. The security team needs a centralized location to collect and analyze security findings from GuardDuty, Inspector, and Macie. Which AWS service should they use?
AWS Security Hub is the correct choice because it is purpose-built to aggregate security findings from AWS native services and third-party partner products into one place, while supporting multi-account architectures through a delegated administrator and cross-region finding aggregation. It consolidates alerts into the AWS Foundational Security Best Practices, CIS, and PCI DSS standards, and outputs normalized findings via the Security Finding Format API, making it the central command console for security status across the organization.
Why this answer
AWS Security Hub is the correct service because it provides a centralized view of security alerts and compliance status across multiple AWS accounts. It aggregates findings from GuardDuty, Inspector, and Macie, normalizing them into the AWS Security Finding Format (ASFF), enabling the security team to analyze and prioritize threats in a single dashboard.
Exam trap
The trap here is that candidates confuse Amazon Detective’s investigative capabilities with Security Hub’s aggregation role, assuming Detective can centralize findings, when in fact Detective is a post-finding analysis tool that requires Security Hub or GuardDuty to provide the initial findings.
How to eliminate wrong answers
Option A is wrong because Amazon Detective is designed for in-depth investigation of security findings by analyzing VPC Flow Logs, CloudTrail, and GuardDuty data, but it does not aggregate findings from multiple services like Inspector and Macie into a single location. Option C is wrong because Amazon CloudWatch is a monitoring service for metrics, logs, and alarms, not a security findings aggregator; it lacks the native integration to collect and normalize findings from GuardDuty, Inspector, and Macie into a unified format. Option D is wrong because AWS Config is a resource inventory and compliance auditing service that tracks configuration changes, not a centralized hub for security findings from threat detection services.
A security engineer is investigating a suspected compromise of an Amazon EC2 instance that is a member of an Auto Scaling group. The instance is still running and the engineer must preserve volatile evidence before the Auto Scaling group replaces it. Which sequence of actions best preserves the evidence while maintaining the ability to analyze it later?
Capturing memory first preserves volatile data such as running processes and credentials that are lost on shutdown. EBS snapshots of all volumes preserve persistent disk state, and recording metadata and network connections captures context. Isolating with a quarantine security group stops further communication without destroying the instance, giving the engineer time to analyze copies.
Why this answer
Preserving volatile evidence requires acting before any shutdown or termination. Capturing memory first retains processes and credentials, EBS snapshots preserve disk state for offline analysis, and recording metadata and network connections provides investigative context. Isolating the instance with a quarantine security group stops exfiltration and command-and-control traffic without destroying the evidence, and it keeps the instance alive so additional artifacts can be collected if needed.
Exam trap
The trap here is treating an AMI or EBS snapshot as complete evidence and terminating the instance, which destroys volatile memory and any live network state.
A company wants to implement automated remediation of security findings from Amazon GuardDuty. Which THREE AWS services can be used together to create an automated response workflow? (Select THREE.)
Amazon CloudWatch Events (EventBridge) is the correct primary service because GuardDuty natively publishes findings to the EventBridge default event bus as structured events. An EventBridge rule can filter on finding fields (e.g., severity, type, account ID) and route matched findings to targets such as Lambda functions or Step Functions state machines, enabling near-real-time automated remediation without custom polling. This is the standard, serverless integration point for GuardDuty-driven responses.
Why this answer
Amazon GuardDuty sends findings to Amazon CloudWatch Events (EventBridge) as events. You can configure an EventBridge rule to match specific GuardDuty findings and trigger an AWS Lambda function for automated remediation. AWS Step Functions can orchestrate complex remediation workflows involving multiple Lambda functions or other AWS services, providing retry logic and error handling.
Exam trap
The trap here is that candidates often select Amazon SQS or AWS Config because they are associated with event-driven architectures or compliance, but they are not the core services used in the standard GuardDuty automated remediation pattern, which relies on EventBridge, Lambda, and Step Functions.
Refer to the exhibit. A security engineer runs the AWS CLI command to look up console login events. The output shows two successful login events for user1 within 5 minutes. What should the engineer suspect?
Multiple successful console sign-ins from the same IAM user in a short window, particularly from different source IP addresses or geographies, is a well-recognized indicator of credential theft. An attacker who has obtained the user's password (and possibly bypassed MFA) will often log in repeatedly to establish persistence, exfiltrate data, or escalate privileges. The correct incident-response action is to treat these events as evidence of compromise, invalidate the credentials immediately, and review CloudTrail for unauthorized actions.
Why this answer
Two successful console login events for the same user within 5 minutes, especially from different source IP addresses or user agents, is a strong indicator of credential compromise. An attacker who has obtained the user's password can log in while the legitimate user is also active, creating overlapping sessions. AWS CloudTrail records the `ConsoleLogin` event with details like `sourceIPAddress` and `userAgent`, which the engineer should examine to confirm whether the logins originated from different locations or devices.
Exam trap
The trap here is that candidates may assume multiple logins are due to shared credentials or MFA misconfiguration, but the key indicator of compromise is the temporal proximity of two successful logins, which strongly suggests an attacker is using the same credentials concurrently.
How to eliminate wrong answers
Option A is wrong because creating a new access key does not generate console login events; access key creation is recorded as `CreateAccessKey` in CloudTrail, not as a `ConsoleLogin` event. Option C is wrong because while multiple users could theoretically share an account, AWS Identity and Access Management (IAM) best practices prohibit sharing credentials, and the overlapping logins more likely indicate an attacker using stolen credentials rather than legitimate sharing. Option D is wrong because disabling MFA does not cause multiple login events within a short timeframe; MFA status changes are recorded as `DeactivateMFADevice` events, and the absence of MFA would not explain two rapid successive logins.
A security engineer is investigating a potential data exfiltration incident. The engineer notices that an EC2 instance with an attached IAM role has been making API calls to an S3 bucket in another AWS account. The engineer wants to identify the source of the API calls and determine if the calls are malicious. Which AWS service should the engineer use to view the API calls made by the IAM role?
CloudTrail records every API call, capturing the IAM role's identity, source IP, timestamp and requested S3 action. This lets the engineer trace the cross-account calls back to the specific EC2 instance and assess whether the pattern indicates malicious exfiltration.
Why this answer
AWS CloudTrail is the correct service because it records all API calls made by IAM roles, including the source IP address, user agent, and the specific actions performed. In this scenario, CloudTrail logs will show the exact API calls made by the EC2 instance's IAM role to the S3 bucket in another account, enabling the security engineer to identify the source and determine if the calls are malicious.
Exam trap
The trap here is that candidates confuse VPC Flow Logs (which show network traffic) with CloudTrail (which shows API calls), or they assume GuardDuty provides raw logs instead of just alerts, leading them to pick a service that cannot directly answer the question of viewing the specific API calls made by the IAM role.
How to eliminate wrong answers
Option A is wrong because VPC Flow Logs capture network traffic metadata (IP addresses, ports, protocols) but do not log AWS API calls or IAM role activity. Option B is wrong because Amazon GuardDuty is a threat detection service that analyzes CloudTrail, VPC Flow Logs, and DNS logs for anomalies, but it does not directly provide the raw API call logs needed to view the specific actions taken by the IAM role. Option C is wrong because AWS Config records resource configuration changes and compliance, not the API calls made by IAM roles.
A company has a multi-account strategy and wants to ensure that all API calls from member accounts are logged to a centralized S3 bucket in the security account. Which configuration is required?
Creating an organization trail in the management account of an AWS Organization automatically logs events from every member account, including future accounts as they are added. This trail delivers all cloud trail event history to a single S3 bucket you designate, eliminating the need to configure trails individually per account. It gives central administrators full visibility and control over governance, and it supports a single set of lifecycle policies and permissions applied across the entire organization.
Why this answer
AWS Organizations allows you to create an organization trail in the management account that automatically applies to all member accounts. This ensures that CloudTrail logs from every account in the organization are delivered to a single, centralized S3 bucket in the security account without needing per-account configuration. The organization trail uses the management account’s CloudTrail configuration to enable logging across the entire organization, and the S3 bucket policy must grant the necessary permissions for CloudTrail to write logs from all accounts.
Exam trap
The trap here is that candidates often assume creating separate trails per account (Option C) is simpler or more reliable, but they overlook the AWS Organizations integration that allows a single organization trail to automatically cover all accounts, reducing administrative overhead and ensuring consistent log delivery.
How to eliminate wrong answers
Option A is wrong because Amazon Kinesis Data Streams is a real-time data streaming service, not a logging destination for CloudTrail; CloudTrail can deliver logs to S3 or CloudWatch Logs, but Kinesis Data Streams is not a native CloudTrail destination for centralized logging. Option C is wrong because creating a separate trail in each member account and specifying the same S3 bucket requires manual configuration per account, does not scale, and does not leverage AWS Organizations for automatic management; additionally, each member account would need its own bucket policy to allow writes, which is error-prone. Option D is wrong because AWS Security Hub is a security posture management service that aggregates findings from various AWS services, but it does not collect or store CloudTrail logs; it can ingest CloudTrail events as a data source for findings, but it does not replace the need for a centralized S3 bucket for log storage.
Ready to test yourself?
Try a timed practice session using only Threat Detection questions.