Task 2.2: Respond to Security Events SCS-C03 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst receives a GuardDuty finding that an EC2 instance in a VPC is communicating with a known command-and-control IP. The instance is part of a production application and cannot be immediately terminated. The analyst needs to confirm the finding and limit the threat's ability to propagate. Which combination of actions should the analyst take first?

   • AImmediately terminate the instance to stop the communication, then restore from the latest snapshot.
   • BReview VPC Flow Logs for traffic to the IP, then update the instance's security group to deny outbound traffic to that IP and restrict inbound traffic to only necessary ports.
   • CCreate a new NACL rule to deny all traffic to the command-and-control IP, and also deny all inbound traffic to the instance's subnet.
   • DUse Amazon Detective to analyze the finding, then remove the instance from the Auto Scaling group to prevent further scaling.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company's security team is responding to a suspected insider threat. The team needs to preserve forensic evidence from a Windows EC2 instance without alerting the user. The instance is in a production environment and cannot be stopped. Which action should the team take to capture the most relevant forensic artifacts?

   • AUse AWS Systems Manager to run a script that collects Windows event logs, PowerShell history, and network connections, then store the output in an S3 bucket with versioning.
   • BCreate a snapshot of the instance's EBS volumes and store it in a separate AWS account.
   • CStop the instance and copy the entire disk to a forensic workstation.
   • DEnable CloudTrail for the instance and wait for logs to accumulate.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   After a security incident, a company's security team identified that a compromised EC2 instance was used to launch an attack. The instance is part of an Auto Scaling group and uses an AMI that may contain a backdoor. The team needs to eradicate the threat and recover the application to a known-good state. Which sequence of actions should the team take?

   • ACreate a new AMI from the compromised instance, then use it to launch a replacement instance.
   • BDetach the instance from the Auto Scaling group, terminate it, update the AMI to a known-good version, and then update the launch template.
   • CStop the instance, remove the backdoor manually, and then start it again.
   • DTerminate the instance and rely on the Auto Scaling group to launch a new instance from the same AMI.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   After a security incident, a company's security team needs to recover a database that was encrypted by ransomware. The team has an RDS snapshot from before the attack. The database is critical and must be restored with minimal downtime. Which action should the team take?

   • ARestore the RDS snapshot to a new DB instance, then update the application's connection string to point to the new instance.
   • BRestore the snapshot to the existing DB instance by overwriting its data.
   • CTerminate the existing DB instance and launch a new one from the same AMI, then import the data manually.
   • DUse AWS Backup to restore the database from the snapshot directly.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A security team needs to restore a compromised EC2 instance to a known good state using a backup. Which AWS resource should be used to create a new instance from a previous backup?

   • AAWS Backup
   • BAMI (Amazon Machine Image)
   • CCloudFormation template
   • DEBS snapshot
   Reveal Solution Discussion Select an answer first