AWS Security Specialty - SCS-C02 Practice Exam

1. 1.A security team must normalize findings from GuardDuty, Inspector, Macie, and a third-party scanner into one schema so a single EventBridge rule can route them. Which format provides this?

   • AThe AWS Config configuration item format
   • BThe AWS Security Finding Format (ASFF)Correct answer
   • CThe CloudTrail event record format
   • DThe VPC flow log version 5 format

   Why

   The AWS Security Finding Format is the common JSON schema that Security Hub uses for findings from AWS services and integrated partner products, which lets a single EventBridge pattern match fields such as Severity.Label across all sources.

2. 2.An EC2 instance is suspected of communicating with a command-and-control host. The forensics team needs the instance kept running and its memory intact while all further traffic is stopped. What should the responder do?

   • ADetach the instance profile role and reboot the instance
   • BAttach an isolation security group with no rules and move the instance to a quarantine subnetCorrect answer
   • CTerminate the instance and launch a replacement from the same AMI
   • DStop the instance immediately and take an EBS snapshot

   Why

   Replacing the instance's security group with one that has no rules blocks all new traffic while leaving the instance running, so volatile memory and running processes are preserved for analysis. Stopping the instance would destroy memory contents.

3. 3.An IAM access key belonging to a developer was published in a public code repository. Which action immediately stops that key from being used while the investigation continues?

   • ARotate the AWS account root user password
   • BEnable MFA on the developer's IAM user
   • CDeactivate the exposed access key on the IAM userCorrect answer
   • DApply a service control policy denying iam:CreateAccessKey

   Why

   Deactivating or deleting the specific access key revokes it right away. Attaching an explicit deny policy to the user is a broader containment step, but the key itself must be invalidated to guarantee it cannot be used.

4. 4.Forensic EBS snapshots must be stored so that no one, including an administrator, can delete or overwrite them for the duration of a legal hold. Which combination provides this?

   • AAn S3 bucket in an isolated forensics account with Object Lock in compliance modeCorrect answer
   • BAn S3 bucket with a bucket policy denying s3:DeleteObject to all principals
   • CAn encrypted EBS volume attached to a stopped forensics instance
   • DAn S3 bucket with versioning and a lifecycle rule that transitions to Glacier

   Why

   Exporting the evidence to an S3 bucket in a dedicated forensics account with Object Lock in compliance mode makes the objects immutable for the retention period, and no principal, including the root user, can shorten it.

5. 5.Which service builds a linked behavior graph from CloudTrail, VPC flow logs, and GuardDuty findings so an analyst can pivot across entities during a root cause investigation?

   • AAWS Security Hub
   • BAWS Audit Manager
   • CAmazon Inspector
   • DAmazon DetectiveCorrect answer

   Why

   Amazon Detective ingests those sources automatically and maintains a behavior graph with baselines per entity, which supports interactive investigation of how a finding developed over time.

Practice all 65 questions

Frequently asked questions