Threat Detection and Incident Response — SCS-C02 Practice Quiz

Question 1

A security analyst receives a GuardDuty finding indicating that an IAM user's credentials may have been used from an anomalous location (UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS). The analyst needs to quickly determine the full scope of activity associated with that IAM user over the past several weeks, including which API calls were made, from which IP addresses, and whether related resources were also accessed — all without manually querying and correlating large volumes of CloudTrail, VPC Flow Logs, and GuardDuty data. Which AWS service is purpose-built to accelerate this investigation?

Accepted Answer

Use Amazon Detective to pivot from the GuardDuty finding into behavior graphs that correlate CloudTrail, VPC Flow Logs, and GuardDuty findings over time.

Answer

Enable Amazon Macie to classify sensitive data accessed by the IAM user and visualize the access patterns.

Answer

Configure AWS Config rules to record the IAM user's configuration history and generate a compliance timeline of the activity.

Answer

Run Amazon Athena queries directly against raw CloudTrail S3 logs and build a custom QuickSight dashboard for correlation.

Question 2

A security analyst receives a GuardDuty finding indicating unusual API activity from an IAM role in a production account. Before deciding on containment, the analyst needs to understand whether this role's behavior deviates from its historical baseline over the past 45 days and which resources it has interacted with. The company already has GuardDuty, Security Hub, and Amazon Detective enabled across the organization. Which approach lets the analyst most efficiently establish this behavioral context?

Accepted Answer

Open the finding's linked Amazon Detective entity profile to view the role's activity timeline, baseline of typical API calls, and related resource interactions

Answer

Query CloudTrail Lake with a custom SQL statement to reconstruct 45 days of API calls and manually chart the frequency for the role

Answer

Enable GuardDuty Malware Protection and re-scan the account to generate a behavioral baseline for the IAM role

Answer

Use Security Hub insights to group findings by resource and infer the role's normal behavior from aggregated severity scores

Question 3

A security team wants to fully automate the initial containment of any EC2 instance that GuardDuty flags with a high-severity finding. When a finding arrives, the workflow must: apply a quarantine security group, capture the instance's running memory and process list for later analysis, and record the actions in an audit trail — all without an analyst logging into the instance interactively. Which approach best meets these requirements?

Accepted Answer

Create an EventBridge rule matching GuardDuty high-severity findings that triggers a Lambda function; the function replaces the instance's security groups with an isolation group and invokes an AWS Systems Manager Run Command document that collects memory and process data via the SSM Agent, logging output to S3 and CloudWatch.

Answer

Enable GuardDuty Malware Protection so it automatically isolates the instance and streams a memory image to an S3 bucket, then review the scan results in the GuardDuty console.

Answer

Configure an EventBridge rule that opens an SSH session through EC2 Instance Connect and runs a shell script to gather forensic data, then manually change the security group afterward.

Answer

Use AWS Config remediation actions tied to a GuardDuty-based Config rule to attach an isolation security group, and rely on VPC Flow Logs to reconstruct the process activity.

Question 4

A security engineer must perform forensic analysis on a compromised EC2 instance after a GuardDuty finding. The incident-response plan requires that all evidence be preserved in a legally defensible manner and that analysis occur without altering the original volumes. The compromised instance runs in a production account. Which approach best preserves forensic integrity while enabling investigation?

Accepted Answer

Create EBS snapshots of the instance's volumes, copy the snapshots into a dedicated isolated forensics account, create volumes from the copies, and attach them to a hardened analysis instance for examination.

Answer

Stop the compromised instance, detach its volumes, and reattach them directly to a forensics instance running in the same production account.

Answer

Enable termination protection on the instance and run analysis tools directly on the live compromised instance to capture volatile data before shutting it down.

Answer

Terminate the compromised instance immediately and rely on the most recent AWS Backup recovery point to reconstruct the volumes for later analysis.

Question 5

A security engineer receives a GuardDuty finding of type Stealth:IAMUser/CloudTrailLoggingDisabled indicating an attacker used compromised credentials to stop logging on the organization's primary CloudTrail trail. The engineer must restore audit visibility as quickly as possible and ensure logging cannot be trivially disabled again by the same technique. Which combination of actions BEST addresses both the immediate recovery and future prevention?

Accepted Answer

Re-enable the CloudTrail trail (StartLogging), then apply an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail to all principals except a break-glass role, and enable an organization trail so member accounts cannot disable it locally.

Answer

Delete the affected trail and create a new one in a different Region, relying on GuardDuty to continue monitoring without CloudTrail.

Answer

Enable CloudTrail log file integrity validation and rotate the compromised access keys, which will automatically restart logging on the stopped trail.

Answer

Turn on VPC Flow Logs and Amazon S3 server access logging as replacement data sources, since these cover the same events that CloudTrail records.

Question 6

A security engineer receives a GuardDuty finding of type UnauthorizedAccess:EC2/MaliciousIPCaller.Custom for a production EC2 instance. The organization requires that suspected compromised instances be automatically isolated for forensic investigation while preserving all volatile and non-volatile data, and while allowing forensic tooling in a separate account to access the evidence. Which automated response best meets these requirements?

Accepted Answer

Trigger an EventBridge rule on the GuardDuty finding that invokes a Lambda function to attach a forensic isolation security group with no rules to the instance, create snapshots of all EBS volumes and share them with the forensics account, and capture a memory dump via an SSM Run Command before any termination.

Answer

Configure EventBridge to invoke a Lambda function that immediately terminates the instance and deletes its EBS volumes, then emails the security team so they can rebuild from the latest AMI.

Answer

Enable Security Hub auto-remediation to stop the instance, detach its network interface, and move the finding to archived status so the on-call team can review it during business hours.

Answer

Create an EventBridge rule that triggers an SSM Automation runbook to reboot the instance, rotate its IAM role credentials, and apply the latest OS patches to remove the malware.

Question 7

A security engineer receives a GuardDuty finding of type UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS. The finding indicates that credentials from an EC2 instance's IAM role were used from an IP address outside AWS. The instance itself is still running normally and serving production traffic, and the team cannot immediately terminate or isolate it without causing an outage. What is the MOST effective immediate containment action to stop the attacker from continuing to use the stolen credentials?

Accepted Answer

Attach an IAM policy to the instance role that denies all actions when the request does not originate from the instance's VPC using the aws:SourceVpc or aws:VpcSourceIp condition keys, effectively revoking the exfiltrated session's access

Answer

Rotate the EC2 instance's SSH key pair and reboot the instance to force new temporary credentials to be issued by the metadata service

Answer

Enable IMDSv2 in required mode on the running instance so the exfiltrated credentials are immediately invalidated

Answer

Create a GuardDuty suppression rule for the finding so the SOC can continue monitoring the instance without alert noise while planning a maintenance window

Question 8

A security engineer at a fintech company runs several Amazon EKS clusters that host containerized payment workloads. Leadership wants Amazon GuardDuty to detect threats such as suspicious API calls to the Kubernetes control plane (e.g., anonymous access to sensitive resources) AND malicious process activity occurring inside running containers (e.g., a reverse shell spawned in a pod). The engineer has already enabled GuardDuty in the account. What must the engineer configure to satisfy BOTH detection requirements?

Accepted Answer

Enable EKS Protection (Kubernetes audit log monitoring) and EKS Runtime Monitoring with the automated GuardDuty security agent for the clusters

Answer

Enable only EKS Protection, which analyzes Kubernetes audit logs and VPC Flow Logs to cover both control-plane and in-container threats

Answer

Enable GuardDuty Malware Protection for EBS and forward container stdout to CloudWatch Logs for GuardDuty to parse

Answer

Deploy the CloudWatch agent to each pod and create Security Hub custom insights that correlate EKS audit events with runtime metrics

Question 9

A security team manages a multi-account AWS Organization with workloads deployed across four Regions. They have enabled Amazon GuardDuty in all accounts and Regions via the organization delegated administrator. The compliance team now requires that all GuardDuty findings be automatically collected into a single account and Region for centralized correlation, long-term retention in S3, and cross-referencing during investigations, without writing custom polling code. Which approach best meets these requirements?

Accepted Answer

Configure GuardDuty finding export to a centralized S3 bucket, and in each Region create an EventBridge rule that forwards GuardDuty findings to a custom event bus in the central account and Region.

Answer

Enable a single GuardDuty detector only in the central Region and rely on VPC peering to route findings from other Regions into it.

Answer

Use AWS Config aggregators to pull GuardDuty findings from all accounts and Regions into the central account for retention in S3.

Answer

Write a Lambda function in each Region that periodically calls the GuardDuty ListFindings API and copies results to the central S3 bucket every five minutes.

Question 10

A security team enables GuardDuty Lambda Protection across their organization. GuardDuty raises a finding indicating one of the company's Lambda functions is generating network traffic to a known cryptomining domain. The function is triggered by an SQS queue that processes customer uploads. The team must contain the threat quickly while preserving the ability to investigate how the function was compromised. Which action best achieves immediate containment with minimal disruption to unrelated workloads?

Accepted Answer

Set the function's reserved concurrency to zero and remove its execution role permissions, leaving the code and configuration intact for analysis.

Answer

Delete the Lambda function immediately and redeploy a clean version from the last known-good CI/CD artifact.

Answer

Add a deny-all NACL to the VPC subnet the account uses so the function can no longer reach the internet.

Answer

Disable the SQS queue trigger by deleting the source queue so the function stops receiving events.

Question 11

A security team enables GuardDuty Malware Protection for EC2. GuardDuty generates an 'Execution:EC2/MaliciousFile' finding after scanning an EBS volume attached to a production instance and detecting a trojan. The team wants an automated, least-disruptive first response that preserves the ability to investigate while preventing the malware from spreading laterally, and they must ensure the finding and any related activity remain fully investigable afterward. Which approach best meets these requirements?

Accepted Answer

Trigger an EventBridge rule on the finding that invokes a Lambda function to replace the instance's security groups with an isolation security group that denies all traffic, tag the instance for forensics, and create Detective and investigation entries before analysts examine it.

Answer

Configure an EventBridge rule to invoke a Lambda function that immediately terminates the affected EC2 instance to stop the malware from executing further.

Answer

Create a Security Hub suppression rule for the 'Execution:EC2/MaliciousFile' finding type so the alert stops recurring, then patch the instance during the next maintenance window.

Answer

Use Systems Manager Run Command to run an antivirus removal script on the instance automatically, delete the infected files, and leave the instance in service.

Question 12

A financial services company runs a production Amazon Aurora MySQL cluster that stores customer account data. The security team recently enabled GuardDuty RDS Protection across the organization. GuardDuty generates a finding of type 'CredentialAccess:RDS/AnomalousBehavior.SuccessfulLogin' indicating a successful login to the Aurora cluster from an unusual location using a rarely used database user. The security team needs to confirm the scope of the activity and quickly contain the potentially compromised database credential while minimizing disruption to legitimate applications. Which combination of actions BEST addresses this incident?

Accepted Answer

Rotate or disable the specific database user's credential, tighten the cluster security group and database user privileges, and review the RDS and CloudTrail activity to determine what the login accessed.

Answer

Immediately delete the Aurora cluster and restore from the most recent automated snapshot to eliminate the compromised credential.

Answer

Disable GuardDuty RDS Protection to stop the recurring findings, then open a support case with AWS to investigate the login.

Answer

Enable IAM database authentication for the cluster and rely on it to automatically revoke the anomalous session already in progress.

Question 13

A security engineer manages GuardDuty for a company. GuardDuty repeatedly generates 'Exfiltration:S3/AnomalousBehavior' and related S3 data-event findings for a specific S3 bucket that a nightly analytics job legitimately queries from an on-premises IP range. The engineer has confirmed the activity is benign and wants to stop these specific findings from cluttering the console and triggering downstream alerts, while continuing to receive all other GuardDuty findings normally. What is the MOST appropriate way to achieve this?

Accepted Answer

Create a GuardDuty suppression rule with filter criteria matching the finding type and the bucket/IP attributes, so matching findings are auto-archived but still recorded.

Answer

Disable GuardDuty S3 Protection for the entire account to stop the analytics-related findings.

Answer

Add the on-premises IP range to the GuardDuty trusted IP list to suppress all findings involving that address.

Answer

Create an EventBridge rule that deletes the findings from GuardDuty whenever they are generated.

Question 14

A security engineer manages a GuardDuty administrator account for 40 member accounts. A widely used vulnerability scanning vendor performs authorized port scans and reconnaissance against the company's EC2 fleet each night, generating hundreds of Recon:EC2/Portscan findings. The engineer wants to prevent these known-benign findings from appearing in the GuardDuty console and from being forwarded to Security Hub and downstream EventBridge automation, while still retaining the ability to review them later if needed. What is the most appropriate approach?

Accepted Answer

Create a suppression rule in GuardDuty using a filter that matches the finding type and the scanner's source IP addresses so matching findings are automatically archived.

Answer

Add the scanner's IP addresses to a trusted IP list in GuardDuty so that all activity from those IPs stops generating any findings.

Answer

Disable the Recon:EC2/Portscan finding type globally across the GuardDuty administrator and member accounts.

Answer

Create an EventBridge rule that matches the finding type and invokes a Lambda function to delete the findings from GuardDuty.

Question 15

A security engineer discovers that Amazon GuardDuty was intentionally disabled in the production account three weeks ago by a departing administrator, leaving a detection gap. The incident-response team needs to restore threat detection and, as part of recovery, retroactively understand what malicious activity may have occurred during the blind period without waiting weeks for new findings to accumulate. Which approach best supports both re-enabling detection and analyzing the historical gap?

Accepted Answer

Re-enable GuardDuty for ongoing detection, then use Amazon Detective and query the preserved CloudTrail, VPC Flow Logs, and DNS logs in CloudTrail Lake / Athena to reconstruct and investigate activity during the gap.

Answer

Re-enable GuardDuty and rely on its automatic backfill to reprocess VPC Flow Logs and CloudTrail from the past three weeks to generate retroactive findings.

Answer

Restore GuardDuty from a snapshot taken before it was disabled so that the previously generated findings and detection state are recovered.

Answer

Enable GuardDuty in a new dedicated security account and enable Malware Protection to scan existing EBS volumes for indicators from the past three weeks.

Question 16

A security team at a financial services company is building a formal incident-response capability on AWS. They want to reduce mean time to respond and ensure responders can act during a real event without needing to manually create access or gather tools under pressure. The CISO asks the team to focus first on preparation activities as defined by the AWS incident-response lifecycle. Which combination of actions BEST reflects the 'preparation' phase for AWS incident response?

Accepted Answer

Pre-provision a dedicated forensics/security account with break-glass IAM roles, maintain documented runbooks, and regularly run tabletop exercises and game days

Answer

Wait for a GuardDuty finding, then create a new IAM role with administrative access so responders can begin investigating the affected resources

Answer

Immediately isolate any suspected instance by detaching it from its security group and terminating it to stop the attacker

Answer

Restore affected workloads from the most recent backups and rotate all credentials after confirming the threat has been eradicated

Question 17

A company manages 60 accounts in AWS Organizations across three Regions. The security team wants a single place to enable Security Hub, turn on the AWS Foundational Security Best Practices standard, and automatically apply the same enabled/disabled control settings to all existing and future member accounts in all target Regions — without writing custom scripts to update each account individually. Which approach meets these requirements with the least ongoing operational overhead?

Accepted Answer

Designate a delegated administrator account and use Security Hub central configuration to create a configuration policy that enables the standard and control settings, then associate the policy with the organization root.

Answer

Enable Security Hub in each account manually and use a Lambda function triggered by CloudTrail to reapply control settings whenever a new account joins the organization.

Answer

Deploy a CloudFormation StackSet that enables Security Hub and the standard in every account and Region, and re-run the StackSet whenever control settings change.

Answer

Turn on Security Hub auto-enable for new accounts in the delegated administrator, and rely on each member account owner to configure the standard and controls locally.

Question 18

A security engineer at a large enterprise manages a multi-account AWS Organization. The security team wants a single dashboard that aggregates findings from GuardDuty, Amazon Inspector, and Amazon Macie across all member accounts and multiple Regions, with findings expressed in a common data format so they can build consistent EventBridge automation rules regardless of the originating service. What is the MOST appropriate way to meet these requirements with the least custom development?

Accepted Answer

Enable AWS Security Hub with the delegated administrator account and cross-Region aggregation, which normalizes findings from integrated services into the AWS Security Finding Format (ASFF).

Answer

Enable Amazon Detective as the delegated administrator to correlate and normalize findings from all services into a unified graph model.

Answer

Build a Lambda function subscribed to each service's EventBridge events that transforms every finding into a custom JSON schema and writes them to a central S3 bucket.

Answer

Configure GuardDuty as the aggregation service since it already ingests Inspector and Macie findings and forwards them in a standard format.

Question 19

A security team uses AWS Security Hub as the aggregation point for findings from GuardDuty, Amazon Inspector, and third-party partner products across a multi-account AWS Organizations environment. They want any finding with a severity label of CRITICAL to automatically create an incident ticket in their external ITSM system, while all other findings continue to be reviewed manually in the console. The solution must be fully event-driven, require no polling, and add no custom code to normalize the different finding formats from each source. Which approach best meets these requirements?

Accepted Answer

Create an EventBridge rule matching the Security Hub Findings - Imported event pattern filtered on Severity.Label equal to CRITICAL, and target a Lambda function that calls the ITSM API.

Answer

Enable a scheduled Lambda function that calls the Security Hub GetFindings API every five minutes, filters for CRITICAL findings, and posts matching results to the ITSM system.

Answer

Configure each source service (GuardDuty, Inspector, and the partner product) to send its native findings directly to EventBridge and build separate rules per source to route CRITICAL items.

Answer

Create an SNS topic subscribed by the ITSM system and configure Security Hub custom actions so analysts can manually forward CRITICAL findings to the topic.

Question 20

A financial services company aggregates findings in AWS Security Hub across a multi-account organization. Their security team wants a fully automated response when GuardDuty raises an 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS' finding: the exposed IAM user's access keys must be deactivated within seconds, and an incident record must be created, all without requiring an engineer to log in. Which approach best meets these requirements while keeping the automation centralized in the security account?

Accepted Answer

Create an EventBridge rule in the security account that matches the Security Hub finding event, targeting a Lambda function that assumes a cross-account IAM role in the affected member account to call UpdateAccessKey (setting Status to Inactive) and creates a ticket via API.

Answer

Enable AWS Config in each member account with a managed rule that detects exposed IAM keys and configure automatic remediation using an SSM Automation document scoped to each account individually.

Answer

Configure GuardDuty to automatically suspend the compromised IAM user and rely on Security Hub's built-in auto-remediation feature to disable the access keys.

Answer

Create an SNS topic subscribed by the security team that receives the Security Hub finding and instructs an on-call engineer to manually run an SSM Automation runbook to deactivate the keys.

More SCS-C02 practice