AWS Security Specialty - SCS-C02

1. 1.A security team must normalize findings from GuardDuty, Inspector, Macie, and a third-party scanner into one schema so a single EventBridge rule can route them. Which format provides this?

   • AThe AWS Security Finding Format (ASFF)Correct answer
   • BThe CloudTrail event record format
   • CThe VPC flow log version 5 format
   • DThe AWS Config configuration item format

   Why

   The AWS Security Finding Format is the common JSON schema that Security Hub uses for findings from AWS services and integrated partner products, which lets a single EventBridge pattern match fields such as Severity.Label across all sources.

2. 2.An EC2 instance is suspected of communicating with a command-and-control host. The forensics team needs the instance kept running and its memory intact while all further traffic is stopped. What should the responder do?

   • AAttach an isolation security group with no rules and move the instance to a quarantine subnetCorrect answer
   • BStop the instance immediately and take an EBS snapshot
   • CTerminate the instance and launch a replacement from the same AMI
   • DDetach the instance profile role and reboot the instance

   Why

   Replacing the instance's security group with one that has no rules blocks all new traffic while leaving the instance running, so volatile memory and running processes are preserved for analysis. Stopping the instance would destroy memory contents.

3. 3.An IAM access key belonging to a developer was published in a public code repository. Which action immediately stops that key from being used while the investigation continues?

   • ADeactivate the exposed access key on the IAM userCorrect answer
   • BRotate the AWS account root user password
   • CEnable MFA on the developer's IAM user
   • DApply a service control policy denying iam:CreateAccessKey

   Why

   Deactivating or deleting the specific access key revokes it right away. Attaching an explicit deny policy to the user is a broader containment step, but the key itself must be invalidated to guarantee it cannot be used.

4. 4.Forensic EBS snapshots must be stored so that no one, including an administrator, can delete or overwrite them for the duration of a legal hold. Which combination provides this?

   • AAn S3 bucket in an isolated forensics account with Object Lock in compliance modeCorrect answer
   • BAn S3 bucket with versioning and a lifecycle rule that transitions to Glacier
   • CAn S3 bucket with a bucket policy denying s3:DeleteObject to all principals
   • DAn encrypted EBS volume attached to a stopped forensics instance

   Why

   Exporting the evidence to an S3 bucket in a dedicated forensics account with Object Lock in compliance mode makes the objects immutable for the retention period, and no principal, including the root user, can shorten it.

5. 5.Which service builds a linked behavior graph from CloudTrail, VPC flow logs, and GuardDuty findings so an analyst can pivot across entities during a root cause investigation?

   • AAmazon DetectiveCorrect answer
   • BAWS Security Hub
   • CAmazon Inspector
   • DAWS Audit Manager

   Why

   Amazon Detective ingests those sources automatically and maintains a behavior graph with baselines per entity, which supports interactive investigation of how a finding developed over time.

Practice all 65 questions

Frequently asked questions