How should I use these Threat Detection and Incident Response practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

SCS-C02 · topic practice

Threat Detection and Incident Response practice questions

Q: Can I practise just Threat Detection and Incident Response questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Threat Detection and Incident Response domain.

Practise AWS Certified Security Specialty SCS-C02 Threat Detection and Incident Response practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Threat Detection and Incident Response

Practice 10 questions Browse domain →

What the exam tests

What to know about Threat Detection and Incident Response

Threat Detection and Incident Response questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Threat Detection and Incident Response exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Threat Detection and Incident Response questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Threat Detection and Incident Response explanation →

A security engineer is configuring an AWS environment to detect and respond to potential security threats. Which AWS service can be used to automate the remediation of unwanted access to Amazon S3 buckets by invoking AWS Lambda functions?

Trap 1: AWS Config

AWS Config evaluates resource configurations against desired policies but does not detect threats or automate remediation based on threat findings.

Trap 2: Amazon Inspector

Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not for detecting access anomalies.

Trap 3: AWS WAF

AWS WAF protects web applications from common web exploits, not S3 bucket access.

Study all Threat Detection and Incident Response common traps →

A
AWS Config
Why wrong: AWS Config evaluates resource configurations against desired policies but does not detect threats or automate remediation based on threat findings.
B
Amazon GuardDuty
GuardDuty uses threat intelligence and machine learning to detect threats, and findings can trigger automated remediation via EventBridge and Lambda.
C
Amazon Inspector
Why wrong: Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not for detecting access anomalies.
D
AWS WAF
Why wrong: AWS WAF protects web applications from common web exploits, not S3 bucket access.

Full breakdown with real-world context →

Question 2mediummulti select

Read the full NAT/PAT explanation →

A security team suspects that an attacker has compromised an EC2 instance and is using it to launch outbound DDoS attacks. The team needs to quickly isolate the instance while preserving forensic data. Which combination of actions should the team take? (Choose TWO.)

Trap 1: Modify the network ACL for the subnet to deny all outbound traffic.

NACL changes affect all instances in the subnet, not just the compromised one.

Trap 2: Detach the instance from the Auto Scaling group.

Detaching does not block network traffic; the instance remains accessible.

Trap 3: Terminate the EC2 instance immediately.

Termination destroys evidence and prevents further investigation.

Study all Threat Detection and Incident Response common traps →

A
Apply a restrictive security group that blocks all outbound traffic.
This isolates the instance by preventing outbound connections while allowing forensic access via inbound rules if needed.
B
Modify the network ACL for the subnet to deny all outbound traffic.
Why wrong: NACL changes affect all instances in the subnet, not just the compromised one.
C
Create a snapshot of the EBS volumes attached to the EC2 instance.
Snapshots preserve the current state of the volumes for forensic analysis.
D
Detach the instance from the Auto Scaling group.
Why wrong: Detaching does not block network traffic; the instance remains accessible.
E
Terminate the EC2 instance immediately.
Why wrong: Termination destroys evidence and prevents further investigation.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full Threat Detection and Incident Response explanation →

During an incident response, a security engineer needs to collect memory and disk forensics from a running EC2 Windows instance without causing the instance to crash. The engineer has AWS Systems Manager SSM Agent installed. Which method should the engineer use?

Trap 1: Create an AMI of the instance.

An AMI captures disk state but not memory.

Trap 2: Use AWS Backup to create a backup of the instance.

AWS Backup does not capture memory.

Trap 3: Create an EBS snapshot of the root volume.

Snapshots capture disk state but not memory; also, snapshots may be inconsistent if the instance is running.

Study all Threat Detection and Incident Response common traps →

A
Create an AMI of the instance.
Why wrong: An AMI captures disk state but not memory.
B
Use AWS Systems Manager Inventory to collect memory and disk information.
SSM Inventory can collect system metadata, and by using custom inventory scripts, it can collect memory dumps and disk files without crashing the instance.
C
Use AWS Backup to create a backup of the instance.
Why wrong: AWS Backup does not capture memory.
D
Create an EBS snapshot of the root volume.
Why wrong: Snapshots capture disk state but not memory; also, snapshots may be inconsistent if the instance is running.

Full breakdown with real-world context →

Question 4mediummulti select

Read the full Threat Detection and Incident Response explanation →

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all API calls in the organization are logged and retained for at least one year. Which AWS services or features should be used to meet these requirements? (Choose TWO.)

Trap 1: Amazon GuardDuty with threat detection enabled.

GuardDuty analyzes logs from CloudTrail, VPC Flow Logs, and DNS, but does not log API calls itself.

Trap 2: AWS Config with recording enabled for all resources.

AWS Config records resource configuration changes, not API calls.

Trap 3: VPC Flow Logs for all VPCs.

VPC Flow Logs capture network traffic metadata, not API calls.

Study all Threat Detection and Incident Response common traps →

A
Amazon GuardDuty with threat detection enabled.
Why wrong: GuardDuty analyzes logs from CloudTrail, VPC Flow Logs, and DNS, but does not log API calls itself.
B
AWS Config with recording enabled for all resources.
Why wrong: AWS Config records resource configuration changes, not API calls.
C
Amazon S3 lifecycle policy to transition logs to S3 Glacier after one year.
This ensures logs are retained and cost-effective.
D
VPC Flow Logs for all VPCs.
Why wrong: VPC Flow Logs capture network traffic metadata, not API calls.
E
AWS CloudTrail with organization trail.
An organization trail logs API calls for all accounts in the organization.

Full breakdown with real-world context →

Question 5hardmulti select

Read the full Threat Detection and Incident Response explanation →

A security engineer is investigating a potential data exfiltration incident. The engineer notices large volumes of data being transferred from an Amazon S3 bucket to an external IP address. Which AWS services can be used to detect and alert on such behavior? (Choose THREE.)

Trap 1: AWS Config with compliance rules.

AWS Config checks resource configurations, not data transfer.

Trap 2: VPC Flow Logs.

VPC Flow Logs capture traffic to/from S3 via VPC endpoints, but the data transfer itself is encrypted and not visible in flow logs; they show connection metadata but not object-level details.

Study all Threat Detection and Incident Response common traps →

A
Amazon CloudWatch Logs with S3 access log analysis.
S3 server access logs can be sent to CloudWatch Logs for monitoring and alerting.
B
AWS CloudTrail with S3 data event logging.
CloudTrail data events record S3 object-level operations, including GetObject for data downloads.
C
Amazon GuardDuty with anomaly detection.
GuardDuty uses machine learning to detect unusual data access patterns, such as large volumes from an unfamiliar IP.
D
AWS Config with compliance rules.
Why wrong: AWS Config checks resource configurations, not data transfer.
E
VPC Flow Logs.
Why wrong: VPC Flow Logs capture traffic to/from S3 via VPC endpoints, but the data transfer itself is encrypted and not visible in flow logs; they show connection metadata but not object-level details.

Full breakdown with real-world context →

Question 6mediummultiple choice

Read the full Threat Detection and Incident Response explanation →

A security engineer reviews the CloudTrail log entry in the exhibit. The engineer notices that an EC2 instance was launched using an AdminRole. Which additional information would help determine if this is a legitimate action or a potential compromise?

Exhibit

Refer to the exhibit.

CloudTrail log entry (simplified):
{
  "eventSource": "ec2.amazonaws.com",
  "eventName": "RunInstances",
  "userIdentity": {
    "arn": "arn:aws:iam::123456789012:role/AdminRole",
    "accountId": "123456789012"
  },
  "requestParameters": {
    "instanceType": "m5.xlarge",
    "imageId": "ami-0abcdef1234567890",
    "securityGroupSet": [{"groupId": "sg-0123456789abcdef0"}]
  },
  "responseElements": {
    "instancesSet": {
      "items": [{"instanceId": "i-0a1b2c3d4e5f6g7h8"}]
    }
  },
  "sourceIPAddress": "203.0.113.50",
  "userAgent": "console.amazonaws.com",
  "eventTime": "2025-03-15T14:30:00Z"
}

Trap 1: The AMI ID ami-0abcdef1234567890 is not a standard Amazon-provided…

Custom AMIs are common and not inherently suspicious.

Trap 2: The instance type m5.xlarge is unusually large compared to previous…

Instance size is not a strong indicator of compromise without context.

Trap 3: The security group sg-0123456789abcdef0 allows inbound SSH from…

While that would be a security issue, the log does not show the security group rules, so we cannot conclude that.

Study all Threat Detection and Incident Response common traps →

A
The AMI ID ami-0abcdef1234567890 is not a standard Amazon-provided AMI.
Why wrong: Custom AMIs are common and not inherently suspicious.
B
The source IP address 203.0.113.50 is from an unexpected geographic location not associated with the company.
Anomalous source IP is a common indicator of compromise.
C
The instance type m5.xlarge is unusually large compared to previous launches.
Why wrong: Instance size is not a strong indicator of compromise without context.
D
The security group sg-0123456789abcdef0 allows inbound SSH from 0.0.0.0/0.
Why wrong: While that would be a security issue, the log does not show the security group rules, so we cannot conclude that.

Full breakdown with real-world context →

Question 7easymultiple choice

Read the full Threat Detection and Incident Response explanation →

A security engineer is analyzing the VPC Flow Logs entry in the exhibit. The log shows traffic from an internal IP to an external IP. Which potential security concern should the engineer investigate?

Exhibit

Refer to the exhibit.

VPC Flow Logs entry:
2 123456789010 eni-1234567890abcdef 10.0.1.5 203.0.113.50 3389 443 6 10 840 1625097600 1625097660 ACCEPT OK

Trap 1: The instance is participating in a DDoS attack against the external…

The log shows a single accepted connection, not a flood of traffic.

Trap 2: An external host is scanning the internal network on port 443.

The log shows source 10.0.1.5 and destination 203.0.113.50, indicating outbound traffic.

Trap 3: The security group allows inbound RDP from 0.0.0.0/0.

The flow log does not show security group rules.

Study all Threat Detection and Incident Response common traps →

A
The instance is participating in a DDoS attack against the external IP.
Why wrong: The log shows a single accepted connection, not a flood of traffic.
B
An EC2 instance is attempting to connect to an external host on port 3389 (RDP).
Outbound RDP traffic from an internal instance is suspicious and may indicate data exfiltration or a compromised machine.
C
An external host is scanning the internal network on port 443.
Why wrong: The log shows source 10.0.1.5 and destination 203.0.113.50, indicating outbound traffic.
D
The security group allows inbound RDP from 0.0.0.0/0.
Why wrong: The flow log does not show security group rules.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full Threat Detection and Incident Response explanation →

A company has a security rule that all S3 buckets must have server access logging enabled. A security engineer uses AWS Config to evaluate compliance. The engineer configures a managed rule but notices that the rule does not evaluate all buckets. What is the most likely reason?

Trap 1: The rule only evaluates buckets in the us-east-1 region.

AWS Config rules can be applied globally or per region; the rule is not region-specific.

Trap 2: The rule excludes buckets that have a bucket policy denying access…

AWS Config requires permissions, but if a bucket policy denies, it would generate an error, not skip evaluation.

Trap 3: The rule requires the logging target bucket to be in the same…

The rule does not require the target bucket to be in the same account.

Study all Threat Detection and Incident Response common traps →

A
The rule only evaluates buckets in the us-east-1 region.
Why wrong: AWS Config rules can be applied globally or per region; the rule is not region-specific.
B
The rule only evaluates buckets that have a specific tag.
The managed rule 's3-bucket-logging-enabled' has an optional parameter 'TargetBucket' but does not require a specific tag. However, the most common reason for not evaluating all buckets is that the rule may be configured with a scope that includes only tagged resources, or the rule's trigger is set to configuration changes only, missing existing buckets. But among given, D is most plausible because many AWS Config rules can be scoped by tags.
C
The rule excludes buckets that have a bucket policy denying access to AWS Config.
Why wrong: AWS Config requires permissions, but if a bucket policy denies, it would generate an error, not skip evaluation.
D
The rule requires the logging target bucket to be in the same account.
Why wrong: The rule does not require the target bucket to be in the same account.

Full breakdown with real-world context →

Question 9mediummultiple choice

Read the full Threat Detection and Incident Response explanation →

During a security incident, a security engineer needs to verify whether an EC2 instance's security group allowed inbound SSH from a specific IP address at the time of the incident. Which AWS service or feature should the engineer use to obtain this historical information?

Trap 1: Amazon CloudTrail event history.

CloudTrail logs API calls like AuthorizeSecurityGroupIngress, but does not show the state of rules at a point in time.

Trap 2: AWS Systems Manager Inventory.

Inventory collects software and OS information, not security group rules.

Trap 3: VPC Flow Logs.

Flow logs show traffic flows, not security group rule definitions.

Study all Threat Detection and Incident Response common traps →

A
Amazon CloudTrail event history.
Why wrong: CloudTrail logs API calls like AuthorizeSecurityGroupIngress, but does not show the state of rules at a point in time.
B
AWS Systems Manager Inventory.
Why wrong: Inventory collects software and OS information, not security group rules.
C
VPC Flow Logs.
Why wrong: Flow logs show traffic flows, not security group rule definitions.
D
AWS Config configuration history.
AWS Config records the configuration of security groups over time, allowing you to see the rules at the time of the incident.

Full breakdown with real-world context →

Question 10mediummultiple choice

Read the full NAT/PAT explanation →

A security engineer is implementing automated incident response. The engineer wants to use AWS Lambda to automatically remediate GuardDuty findings. What is the recommended pattern to trigger the Lambda function?

Trap 1: Subscribe the Lambda function to an SNS topic that GuardDuty…

While possible, EventBridge is the native integration; SNS adds unnecessary complexity.

Trap 2: Use CloudWatch Logs subscription filter to trigger Lambda on…

GuardDuty does not write findings to CloudWatch Logs directly; it uses EventBridge.

Trap 3: Have the Lambda function poll the EC2 instance metadata for threat…

EC2 instance metadata does not contain GuardDuty findings.

Study all Threat Detection and Incident Response common traps →

A
Configure an Amazon EventBridge rule to match GuardDuty findings and invoke the Lambda function.
EventBridge is the recommended way to route GuardDuty findings to Lambda for automated remediation.
B
Subscribe the Lambda function to an SNS topic that GuardDuty publishes findings to.
Why wrong: While possible, EventBridge is the native integration; SNS adds unnecessary complexity.
C
Use CloudWatch Logs subscription filter to trigger Lambda on GuardDuty log entries.
Why wrong: GuardDuty does not write findings to CloudWatch Logs directly; it uses EventBridge.
D
Have the Lambda function poll the EC2 instance metadata for threat indicators.
Why wrong: EC2 instance metadata does not contain GuardDuty findings.

Full breakdown with real-world context →

Question 11easymulti select

Read the full NAT/PAT explanation →

A company uses AWS Systems Manager Patch Manager to patch EC2 instances. During a security incident, the security team needs to quickly patch a critical vulnerability across all Windows instances in a specific AWS region. Which steps should the team take? (Choose TWO.)

Trap 1: Tag all instances with 'PatchGroup=Critical' to include them in the…

Tagging is not required; patch groups are defined via instance tags, but the action is assigning the baseline to the group.

Trap 2: Use the AWS-provided default patch baseline for Windows.

The default baseline may not include the critical patch if it is not yet approved.

Trap 3: Use SSM Run Command to execute a script that downloads and installs…

While possible, Patch Manager is the intended tool for patching, not Run Command.

Study all Threat Detection and Incident Response common traps →

A
Assign the patch baseline to the instances by specifying a patch group.
Patch groups control which baseline is applied to which instances.
B
Tag all instances with 'PatchGroup=Critical' to include them in the patching.
Why wrong: Tagging is not required; patch groups are defined via instance tags, but the action is assigning the baseline to the group.
C
Create a custom patch baseline that includes the required patch.
A custom baseline ensures the specific patch is approved.
D
Use the AWS-provided default patch baseline for Windows.
Why wrong: The default baseline may not include the critical patch if it is not yet approved.
E
Use SSM Run Command to execute a script that downloads and installs the patch.
Why wrong: While possible, Patch Manager is the intended tool for patching, not Run Command.

Full breakdown with real-world context →

Question 12hardmultiple choice

Read the full Threat Detection and Incident Response explanation →

A company runs a critical web application on a fleet of EC2 instances behind an Application Load Balancer (ALB). The application uses an Aurora MySQL database. The security team receives an alert from Amazon GuardDuty that a specific EC2 instance is exhibiting behavior consistent with a cryptocurrency mining attack, including outbound connections to known mining pools. The instance is part of an Auto Scaling group that uses a launch template with a security group that allows outbound HTTPS traffic to 0.0.0.0/0. The security engineer needs to contain the incident while minimizing downtime for the application. The engineer has already taken a forensic snapshot of the instance's EBS volume. Which course of action should the engineer take next?

Trap 1: SSH into the instance and run a script to kill the mining process.

Assuming the instance is compromised, SSH access may be risky; the attacker could have rootkit. Also, this does not prevent the process from restarting.

Trap 2: Detach the instance from the Auto Scaling group and isolate it by…

Detaching does not block traffic; removing security group rules takes effect but may take time to propagate. Also, the instance remains running and could still cause harm.

Trap 3: Immediately terminate the compromised EC2 instance and allow Auto…

Termination removes the instance but does not immediately block outbound traffic; the instance may still have network connectivity briefly. Also, if the attacker has persistence, they might re-launch via other means.

Study all Threat Detection and Incident Response common traps →

A
Modify the security group attached to the instance to deny all outbound traffic, and let Auto Scaling launch a replacement instance.
This immediately blocks outbound communication from the compromised instance while Auto Scaling replaces it, minimizing downtime.
B
SSH into the instance and run a script to kill the mining process.
Why wrong: Assuming the instance is compromised, SSH access may be risky; the attacker could have rootkit. Also, this does not prevent the process from restarting.
C
Detach the instance from the Auto Scaling group and isolate it by removing all security group rules.
Why wrong: Detaching does not block traffic; removing security group rules takes effect but may take time to propagate. Also, the instance remains running and could still cause harm.
D
Immediately terminate the compromised EC2 instance and allow Auto Scaling to launch a new instance.
Why wrong: Termination removes the instance but does not immediately block outbound traffic; the instance may still have network connectivity briefly. Also, if the attacker has persistence, they might re-launch via other means.

Full breakdown with real-world context →

Question 13mediummultiple choice

Read the full Threat Detection and Incident Response explanation →

A security engineer is investigating a potential credential compromise. An IAM user's access key was used to launch EC2 instances in a region where the user has never operated before. The engineer wants to quickly identify all API calls made by this user in the last 24 hours, including the source IP addresses. Which AWS service or feature should be used?

Trap 1: VPC Flow Logs

VPC Flow Logs capture IP traffic metadata, not API calls.

Trap 2: AWS Trusted Advisor

Trusted Advisor provides optimization recommendations, not audit logs.

Trap 3: Amazon CloudWatch Logs

CloudWatch Logs can store logs but does not natively capture API calls; requires additional configuration.

Study all Threat Detection and Incident Response common traps →

A
AWS CloudTrail
CloudTrail records all management and data events, including API calls with user identity and source IP.
B
VPC Flow Logs
Why wrong: VPC Flow Logs capture IP traffic metadata, not API calls.
C
AWS Trusted Advisor
Why wrong: Trusted Advisor provides optimization recommendations, not audit logs.
D
Amazon CloudWatch Logs
Why wrong: CloudWatch Logs can store logs but does not natively capture API calls; requires additional configuration.

Full breakdown with real-world context →

Question 14hardmultiple choice

Read the full NAT/PAT explanation →

A company uses AWS Organizations with multiple accounts and has enabled AWS Security Hub in the management account. The security team wants to automatically remediate a specific finding type that appears in Security Hub. Which combination of services should be used to achieve this?

Trap 1: AWS Config conformance packs and AWS Systems Manager Automation

Config can detect noncompliant resources but is not directly triggered by Security Hub findings.

Trap 2: Amazon Inspector and AWS Step Functions

Inspector is for vulnerability scanning, not for general remediation of Security Hub findings.

Trap 3: Amazon GuardDuty and AWS Lambda

GuardDuty findings can be sent to EventBridge, but the question asks about Security Hub findings.

Study all Threat Detection and Incident Response common traps →

A
Amazon EventBridge and AWS Lambda
Security Hub sends findings to EventBridge, which can trigger a Lambda function for remediation.
B
AWS Config conformance packs and AWS Systems Manager Automation
Why wrong: Config can detect noncompliant resources but is not directly triggered by Security Hub findings.
C
Amazon Inspector and AWS Step Functions
Why wrong: Inspector is for vulnerability scanning, not for general remediation of Security Hub findings.
D
Amazon GuardDuty and AWS Lambda
Why wrong: GuardDuty findings can be sent to EventBridge, but the question asks about Security Hub findings.

Full breakdown with real-world context →

Question 15mediummulti select

Read the full Threat Detection and Incident Response explanation →

A security engineer is configuring an automated incident response workflow for Amazon GuardDuty findings. Which TWO actions should the engineer take to ensure that the response is triggered for all current and future GuardDuty findings?

Trap 1: Enable GuardDuty to export findings to CloudWatch Logs and then…

GuardDuty already sends findings to EventBridge; no need to export to CloudWatch Logs.

Trap 2: Create an Amazon SNS topic and subscribe the Lambda function to it,…

EventBridge is the recommended service for event-driven workflows; SNS adds unnecessary complexity.

Trap 3: Set up a CloudWatch Logs subscription filter to forward GuardDuty…

GuardDuty findings are not stored in CloudWatch Logs by default; they go to EventBridge.

Study all Threat Detection and Incident Response common traps →

A
Enable GuardDuty to export findings to CloudWatch Logs and then create a metric filter.
Why wrong: GuardDuty already sends findings to EventBridge; no need to export to CloudWatch Logs.
B
Create an Amazon EventBridge rule with an event pattern that matches GuardDuty finding events.
EventBridge allows matching GuardDuty finding events to trigger a response.
C
Create an Amazon SNS topic and subscribe the Lambda function to it, then configure GuardDuty to publish to SNS.
Why wrong: EventBridge is the recommended service for event-driven workflows; SNS adds unnecessary complexity.
D
Configure the rule to invoke an AWS Lambda function that executes the incident response playbook.
Lambda is a common target for automating responses to events.
E
Set up a CloudWatch Logs subscription filter to forward GuardDuty logs to the Lambda function.
Why wrong: GuardDuty findings are not stored in CloudWatch Logs by default; they go to EventBridge.

Full breakdown with real-world context →

Question 16easymultiple choice

Read the full Threat Detection and Incident Response explanation →

A security engineer is reviewing a CloudTrail log entry (exhibit). What is the most immediate security concern indicated by this event?

Exhibit

Refer to the exhibit.

```
{
  "Records": [
    {
      "eventVersion": "1.08",
      "userIdentity": {
        "type": "IAMUser",
        "arn": "arn:aws:iam::123456789012:user/JohnDoe",
        "accountId": "123456789012",
        "accessKeyId": "AKIAIOSFODNN7EXAMPLE"
      },
      "eventTime": "2024-08-01T12:34:56Z",
      "eventSource": "ec2.amazonaws.com",
      "eventName": "AuthorizeSecurityGroupIngress",
      "awsRegion": "us-east-1",
      "sourceIPAddress": "203.0.113.5",
      "userAgent": "console.amazonaws.com",
      "requestParameters": {
        "groupId": "sg-0123456789abcdef0",
        "ipPermissions": {
          "items": [
            {
              "ipProtocol": "tcp",
              "fromPort": 22,
              "toPort": 22,
              "ipRanges": [
                {
                  "cidrIp": "0.0.0.0/0"
                }
              ]
            }
          ]
        }
      }
    }
  ]
}
```

Trap 1: The source IP address 203.0.113.5 is from a known malicious IP…

The IP address is an example (RFC 5735) and not necessarily malicious.

Trap 2: The API call was made from the AWS CLI, which may indicate a…

The userAgent shows 'console.amazonaws.com', indicating the call came from the Management Console, not the CLI.

Trap 3: The user JohnDoe did not use multi-factor authentication (MFA) for…

The CloudTrail log does not include MFA status; it cannot be determined from this entry alone.

Study all Threat Detection and Incident Response common traps →

A
The source IP address 203.0.113.5 is from a known malicious IP range.
Why wrong: The IP address is an example (RFC 5735) and not necessarily malicious.
B
A security group rule was added allowing SSH access from any IP address.
AuthorizeSecurityGroupIngress with 0.0.0.0/0 on port 22 is a common misconfiguration that exposes the instance to the internet.
C
The API call was made from the AWS CLI, which may indicate a compromised access key.
Why wrong: The userAgent shows 'console.amazonaws.com', indicating the call came from the Management Console, not the CLI.
D
The user JohnDoe did not use multi-factor authentication (MFA) for this API call.
Why wrong: The CloudTrail log does not include MFA status; it cannot be determined from this entry alone.

Full breakdown with real-world context →

Question 17hardmultiple choice

Read the full NAT/PAT explanation →

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB) in a VPC. The security team uses Amazon GuardDuty and has enabled Amazon Detective. Recently, GuardDuty raised a 'Recon:EC2/PortProbeUnprotectedPort' finding for one of the instances. The security engineer verified that the ALB security group only allows inbound HTTP/HTTPS from the internet. However, the finding indicates that the instance is receiving probes on port 22 (SSH). Further investigation with Detective shows that the probes originate from multiple IP addresses and are reaching the instance's private IP address. The engineer suspects that the SSH port is exposed despite the security group configuration. What is the MOST likely cause of this exposure?

Trap 1: VPC Flow Logs are misconfigured and are inadvertently forwarding…

VPC Flow Logs capture metadata but do not affect network traffic.

Trap 2: AWS Shield Advanced is causing false positives by marking…

Shield Advanced does not cause false positives in GuardDuty findings; it provides DDoS protection.

Trap 3: The ALB security group has an inbound rule that allows SSH from the…

The engineer verified that the ALB security group only allows HTTP/HTTPS, so this is not the cause.

Study all Threat Detection and Incident Response common traps →

A
The EC2 instance's security group allows inbound SSH from 0.0.0.0/0.
If the instance's security group allows SSH from anywhere, the instance is exposed even if behind an ALB.
B
VPC Flow Logs are misconfigured and are inadvertently forwarding traffic to the instance.
Why wrong: VPC Flow Logs capture metadata but do not affect network traffic.
C
AWS Shield Advanced is causing false positives by marking legitimate traffic as probes.
Why wrong: Shield Advanced does not cause false positives in GuardDuty findings; it provides DDoS protection.
D
The ALB security group has an inbound rule that allows SSH from the internet.
Why wrong: The engineer verified that the ALB security group only allows HTTP/HTTPS, so this is not the cause.

Full breakdown with real-world context →

Question 18mediummultiple choice

Read the full Threat Detection and Incident Response explanation →

A security engineer is investigating a potential compromise. An EC2 instance running Amazon Linux 2 is sending outbound traffic to a known malicious IP address. The engineer needs to capture the network traffic for analysis without alerting the attacker. Which solution meets these requirements?

Trap 1: Enable VPC Flow Logs on the ENI and stream to Amazon S3 for…

VPC Flow Logs capture metadata (source, destination, port, protocol) but not the full packet payload, which is needed for deep analysis.

Trap 2: Attach a security group to the instance that logs all traffic to…

Security Groups are stateful firewalls that allow/deny traffic; they do not capture or log traffic payloads.

Trap 3: Enable AWS Network Firewall on the VPC and configure a rule to log…

AWS Network Firewall is an inline service that would actively inspect and potentially block traffic, alerting the attacker. It also does not provide full packet capture for analysis.

Study all Threat Detection and Incident Response common traps →

A
Enable VPC Flow Logs on the ENI and stream to Amazon S3 for analysis.
Why wrong: VPC Flow Logs capture metadata (source, destination, port, protocol) but not the full packet payload, which is needed for deep analysis.
B
Attach a security group to the instance that logs all traffic to CloudWatch Logs.
Why wrong: Security Groups are stateful firewalls that allow/deny traffic; they do not capture or log traffic payloads.
C
Use VPC Traffic Mirroring to mirror the EC2 instance's ENI traffic to a monitoring appliance in a separate VPC.
VPC Traffic Mirroring copies traffic at the ENI level without inline inspection, enabling passive capture for analysis without alerting the attacker.
D
Enable AWS Network Firewall on the VPC and configure a rule to log all traffic to the malicious IP.
Why wrong: AWS Network Firewall is an inline service that would actively inspect and potentially block traffic, alerting the attacker. It also does not provide full packet capture for analysis.

Full breakdown with real-world context →

Question 19mediumdrag order

Read the full Threat Detection and Incident Response explanation →

Drag and drop the steps to configure AWS WAF with rate-based rules in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 20mediumdrag order

Read the full Threat Detection and Incident Response explanation →

Drag and drop the steps to implement a secure CI/CD pipeline with AWS CodePipeline and IAM in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Threat Detection and Incident Response sessions

Start a Threat Detection and Incident Response only practice session

Every question in these sessions is drawn from the Threat Detection and Incident Response domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Threat Detection and Incident Response questions →Mixed SCS-C02 session

Frequently asked questions

What does the SCS-C02 exam test about Threat Detection and Incident Response?: Threat Detection and Incident Response questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Threat Detection and Incident Response questions in a focused session?: Yes — the session launcher on this page draws every question from the Threat Detection and Incident Response domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other SCS-C02 topics?: Use the topic links above to move to related areas, or go back to the SCS-C02 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the SCS-C02 exam covers. They are not copied from any real exam or dump site.

Threat Detection and Incident Response only

10 questions 20 questions 30 questions 50 questions

Mixed SCS-C02 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All SCS-C02 questions Threat Detection and Incident Response domain overview SCS-C02 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Threat Detection and Incident Response practice questions

What to know about Threat Detection and Incident Response

Common Threat Detection and Incident Response exam traps

Threat Detection and Incident Response questions

A security engineer is configuring an AWS environment to detect and respond to potential security threats. Which AWS service can be used to automate the remediation of unwanted access to Amazon S3 buckets by invoking AWS Lambda functions?

A security team suspects that an attacker has compromised an EC2 instance and is using it to launch outbound DDoS attacks. The team needs to quickly isolate the instance while preserving forensic data. Which combination of actions should the team take? (Choose TWO.)

During an incident response, a security engineer needs to collect memory and disk forensics from a running EC2 Windows instance without causing the instance to crash. The engineer has AWS Systems Manager SSM Agent installed. Which method should the engineer use?

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all API calls in the organization are logged and retained for at least one year. Which AWS services or features should be used to meet these requirements? (Choose TWO.)

A security engineer is investigating a potential data exfiltration incident. The engineer notices large volumes of data being transferred from an Amazon S3 bucket to an external IP address. Which AWS services can be used to detect and alert on such behavior? (Choose THREE.)

A security engineer reviews the CloudTrail log entry in the exhibit. The engineer notices that an EC2 instance was launched using an AdminRole. Which additional information would help determine if this is a legitimate action or a potential compromise?

Exhibit

A security engineer is analyzing the VPC Flow Logs entry in the exhibit. The log shows traffic from an internal IP to an external IP. Which potential security concern should the engineer investigate?

Exhibit

A company has a security rule that all S3 buckets must have server access logging enabled. A security engineer uses AWS Config to evaluate compliance. The engineer configures a managed rule but notices that the rule does not evaluate all buckets. What is the most likely reason?

During a security incident, a security engineer needs to verify whether an EC2 instance's security group allowed inbound SSH from a specific IP address at the time of the incident. Which AWS service or feature should the engineer use to obtain this historical information?

A security engineer is implementing automated incident response. The engineer wants to use AWS Lambda to automatically remediate GuardDuty findings. What is the recommended pattern to trigger the Lambda function?

A company uses AWS Systems Manager Patch Manager to patch EC2 instances. During a security incident, the security team needs to quickly patch a critical vulnerability across all Windows instances in a specific AWS region. Which steps should the team take? (Choose TWO.)

A company uses AWS Organizations with multiple accounts and has enabled AWS Security Hub in the management account. The security team wants to automatically remediate a specific finding type that appears in Security Hub. Which combination of services should be used to achieve this?

A security engineer is configuring an automated incident response workflow for Amazon GuardDuty findings. Which TWO actions should the engineer take to ensure that the response is triggered for all current and future GuardDuty findings?

A security engineer is reviewing a CloudTrail log entry (exhibit). What is the most immediate security concern indicated by this event?

Exhibit

A security engineer is investigating a potential compromise. An EC2 instance running Amazon Linux 2 is sending outbound traffic to a known malicious IP address. The engineer needs to capture the network traffic for analysis without alerting the attacker. Which solution meets these requirements?

Drag and drop the steps to configure AWS WAF with rate-based rules in the correct order.

Drag and drop the steps to implement a secure CI/CD pipeline with AWS CodePipeline and IAM in the correct order.

Track your progress over time

Start a Threat Detection and Incident Response only practice session

Related SCS-C02 topic practice pages