Sample AWS Security Specialty SCS-C02 Practice Questions
Q: Which AWS service automatically analyzes VPC Flow Logs, CloudTrail logs, and DNS logs to detect threats such as cryptocurrency mining and unauthorized access?
A: A. Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity by analyzing VPC Flow Logs, CloudTrail management and data event logs, and DNS logs. It uses machine learning and threat intelligence to identify unexpected and potentially unauthorized activity.
Q: Which AWS service records API calls made in your AWS account and delivers log files to an Amazon S3 bucket?
A: B. AWS CloudTrail. AWS CloudTrail records API calls for your AWS account and delivers log files to S3. It captures information about every API call including the identity of the caller, the time of the call, and the request parameters.
Q: Which AWS feature acts as a virtual firewall at the subnet level, supporting both allow and deny rules for inbound and outbound traffic?
A: B. Network Access Control Lists (NACLs). Network ACLs operate at the subnet level and support both allow and deny rules. They are stateless, meaning return traffic must be explicitly allowed. Security groups operate at the instance level and only support allow rules.
Q: Which IAM policy element specifies the actions that are allowed or denied?
A: B. Action. The Action element in an IAM policy specifies the specific AWS service actions that are allowed or denied. Actions follow the format service:ActionName, such as s3:GetObject or ec2:RunInstances.
Q: Which AWS service provides centralized key management for creating and controlling encryption keys used to encrypt data across AWS services?
A: B. AWS Key Management Service (KMS). AWS KMS is a managed service for creating and controlling cryptographic keys used to encrypt data. It integrates with most AWS services, supports automatic key rotation, and provides centralized key management with audit capabilities through CloudTrail.
Q: Which AWS service helps organizations manage and govern multiple AWS accounts centrally?
A: B. AWS Organizations. AWS Organizations enables central management of multiple AWS accounts. It provides consolidated billing, hierarchical account grouping with organizational units, and policy-based controls through Service Control Policies (SCPs) for governance.
Q: A security engineer notices a GuardDuty finding of type UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS. What does this finding indicate?
A: B. EC2 instance credentials are being used from an external IP address outside of AWS. This GuardDuty finding indicates that EC2 instance role credentials created on an instance are being used from an IP address outside of AWS. This typically means the credentials have been exfiltrated and are being used by an external threat actor.
Q: During an incident response, a security engineer needs to isolate a compromised EC2 instance while preserving evidence. What is the BEST approach?
A: B. Change the instance's security group to one that denies all inbound and outbound traffic, and create an EBS snapshot. Replacing the security group with one that blocks all traffic isolates the instance from the network while keeping it running for forensic analysis. Creating an EBS snapshot preserves the disk state as evidence. Terminating or stopping would destroy volatile memory evidence.
Q: A company has enabled GuardDuty across all accounts in AWS Organizations. A finding shows Trojan:EC2/DNSDataExfiltration on an instance in a member account. The incident response team needs to automate the response. Which solution provides the FASTEST automated containment?
A: A. Use a GuardDuty finding published to EventBridge to trigger a Lambda function that modifies the instance security group. GuardDuty findings are published to EventBridge, which can trigger a Lambda function for automated remediation. The Lambda function can immediately replace the instance's security group with a quarantine group. GuardDuty does not have built-in automated remediation capabilities.
Q: Which AWS service uses graph analysis and machine learning to help security teams investigate the root cause and impact of security findings?
A: B. Amazon Detective. Amazon Detective automatically collects log data from AWS resources and uses machine learning, statistical analysis, and graph theory to build interactive visualizations that help security teams investigate and identify the root cause of security findings.