A security engineer receives a GuardDuty finding that an EC2 instance is performing port scanning. The instance is part of a legacy application that cannot be stopped, and the security team is unsure if the finding is a false positive. The engineer needs to validate the finding and contain the threat if real, without disrupting the application. Which approach should the engineer take?

Immediately terminate the instance to stop the port scanning, then restore from the latest snapshot.

Use Amazon Detective to analyze the finding, then change the route table to block all traffic from the instance.

Analyze VPC Flow Logs to confirm the port scanning activity, then update the instance's security group to block outbound traffic to the scanned ports.

Review CloudTrail logs for the instance's API calls, then create a new NACL rule to deny all outbound traffic.

A company's security team has identified a compromised EC2 instance that is communicating with a malicious server. The instance is in a private subnet and is accessed via a bastion host. The team needs to contain the threat while preserving the instance for forensic analysis. Which action should the team take?

Change the route table of the subnet to route all traffic to a blackhole.

Update the instance's security group to remove the rule that allows outbound traffic to the internet.

Terminate the instance immediately to stop the communication.

Detach the instance's network interface to isolate it.

A security analyst is investigating a potential brute-force attack on an application. The analyst has CloudTrail logs, VPC Flow Logs, and application logs stored in S3. The analyst needs to correlate failed login attempts with network traffic to identify the source IPs. Which approach should the analyst use?

Use Amazon Athena to query the application logs for failed logins and join with VPC Flow Logs to find source IPs.

Use CloudWatch Logs Insights to query the application logs, but only if the logs are in CloudWatch Logs.

Manually download the logs and use a spreadsheet to correlate the data.

Enable GuardDuty and wait for it to identify the source IPs.

A security analyst is conducting a root cause analysis and needs to understand the sequence of events that led to a security incident. Which method is commonly used to trace the timeline of events?

Changing the root account password

Deleting all logs to prevent data corruption

Restarting the affected instances

Reviewing CloudTrail logs in chronological order

AWSCertified Security - Specialty

Domain 2Objective 2

Task 2.2: Respond to Security Events SCS-C03 Practice Questions (Page 3)

Part of the Content Domain 2: Incident Response domain, which accounts for 14% of the SCS-C03 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~10–16 in this domain), expect 5–8 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

7concepts

14%of the exam

Questions 11–15

11expert · hard
A security engineer receives a GuardDuty finding that an EC2 instance is performing port scanning. The instance is part of a legacy application that cannot be stopped, and the security team is unsure if the finding is a false positive. The engineer needs to validate the finding and contain the threat if real, without disrupting the application. Which approach should the engineer take?
Select an answer first
12application · medium
A company's security team has identified a compromised EC2 instance that is communicating with a malicious server. The instance is in a private subnet and is accessed via a bastion host. The team needs to contain the threat while preserving the instance for forensic analysis. Which action should the team take?
Select an answer first
13application · medium
A security analyst is investigating a potential brute-force attack on an application. The analyst has CloudTrail logs, VPC Flow Logs, and application logs stored in S3. The analyst needs to correlate failed login attempts with network traffic to identify the source IPs. Which approach should the analyst use?
Select an answer first
14foundation · easy
A security analyst is conducting a root cause analysis and needs to understand the sequence of events that led to a security incident. Which method is commonly used to trace the timeline of events?
Select an answer first
15foundation · easy
A security team wants to search and analyze application logs stored in CloudWatch Logs to find error patterns related to a security incident. Which CloudWatch feature should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCS-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SCS-C03” is a trademark of its owner, used for identification only.

Task 2.2: Respond to Security Events SCS-C03 Practice Questions (Page 3)

Questions 11–15

A security analyst is conducting a root cause analysis and needs to understand the sequence of events that led to a security incident. Which method is commonly used to trace the timeline of events?

A security team wants to search and analyze application logs stored in CloudWatch Logs to find error patterns related to a security incident. Which CloudWatch feature should they use?

Keep studying — Content Domain 2: Incident Response