A security engineer sees a Security Hub finding that an S3 bucket is publicly accessible. What is the best way to validate this finding?

Check the bucket's permissions and policy to confirm public access is actually enabled

Ignore the finding because Security Hub findings are automatically remediated

Assume the finding is correct and immediately delete the bucket

Enable MFA delete on the bucket

A company's security team is responding to a potential compromise of a Linux EC2 instance. The team needs to capture the instance's system logs and network connections for forensic analysis. Which action should the team take?

Enable VPC Flow Logs and wait for them to accumulate before taking any action.

Terminate the instance and rely on CloudTrail logs for the investigation.

Use the AWS Systems Manager Run Command to execute a script that collects system logs and network connection data, then store the output in S3.

Stop the instance and attach its root volume to another instance to copy the logs.

AWSCertified Security - Specialty

Domain 2Objective 2

Task 2.2: Respond to Security Events SCS-C03 Practice Questions (Page 4)

Part of the Content Domain 2: Incident Response domain, which accounts for 14% of the SCS-C03 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~10–16 in this domain), expect 5–8 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

7concepts

14%of the exam

Questions 16–20

16foundation · easy
A security team wants to automatically move forensic logs from S3 Standard to S3 Glacier after 90 days to reduce storage costs while retaining them for potential investigations. Which S3 feature should be configured to achieve this?
Select an answer first
17foundation · easy
A security engineer needs to quickly isolate a compromised EC2 instance by blocking all inbound and outbound traffic at the instance level. Which AWS resource should be modified to achieve this?
Select an answer first
18foundation · easy
A security engineer sees a Security Hub finding that an S3 bucket is publicly accessible. What is the best way to validate this finding?
Select an answer first
19foundation · easy
During an incident investigation, a security engineer needs to preserve evidence of network traffic to and from a compromised EC2 instance. Which AWS service should be enabled to capture this information as a forensic artifact?
Select an answer first
20application · medium
A company's security team is responding to a potential compromise of a Linux EC2 instance. The team needs to capture the instance's system logs and network connections for forensic analysis. Which action should the team take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCS-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SCS-C03” is a trademark of its owner, used for identification only.

Task 2.2: Respond to Security Events SCS-C03 Practice Questions (Page 4)

Questions 16–20

A security team wants to automatically move forensic logs from S3 Standard to S3 Glacier after 90 days to reduce storage costs while retaining them for potential investigations. Which S3 feature should be configured to achieve this?

A security engineer needs to quickly isolate a compromised EC2 instance by blocking all inbound and outbound traffic at the instance level. Which AWS resource should be modified to achieve this?

A security engineer sees a Security Hub finding that an S3 bucket is publicly accessible. What is the best way to validate this finding?

During an incident investigation, a security engineer needs to preserve evidence of network traffic to and from a compromised EC2 instance. Which AWS service should be enabled to capture this information as a forensic artifact?

A company's security team is responding to a potential compromise of a Linux EC2 instance. The team needs to capture the instance's system logs and network connections for forensic analysis. Which action should the team take?

Keep studying — Content Domain 2: Incident Response