Domain 1: Threat Detection and Incident Response

Design and implement incident response plans and mitigate threats.

5 minutes 5 Questions

Domain 1: Threat Detection and Incident Response is a critical component of the AWS Certified Security – Specialty (SCS-C02) exam, comprising approximately 14% of the total exam content. This domain focuses on a candidate's ability to design and implement robust monitoring, detection, and response …

Concepts covered

AWS Security Hub Incident Response in AWS Compromised IAM Credentials Amazon GuardDuty Amazon Macie Compromised EC2 Instances AWS WAF and Shield

Test mode:

Exam (Timed)

Practice (With explanations)

Start practice test

AWS SCS-C02 - Domain 1: Threat Detection and Incident Response Example Questions

Test your knowledge of Domain 1: Threat Detection and Incident Response

Question 1

During an active investigation, a security team receives a high-severity Amazon GuardDuty finding. The alert indicates that an Amazon EC2 instance running a critical web application is establishing frequent outbound connections to a known malicious IP address. The incident response team must stop this specific outgoing communication channel while ensuring the application remains fully accessible to legitimate users.

Adjust the outbound rules of the existing security group to specifically drop packets destined for the external malicious network. Modify the Network ACL associated with the instance subnet to add an explicit deny rule targeting the destination IP address. Create an Amazon Route 53 routing policy to redirect outbound traffic intended for the malicious IP into an isolated environment. Attach an additional security group to the affected instance that explicitly denies connections to the malicious IP destination.

Correct Answer: Modify the Network ACL associated with the instance subnet to add an explicit deny rule targeting the destination IP address.

Network ACLs are stateless and support explicit deny rules, making them the proper choice to block outbound traffic to a specific malicious IP address without disrupting legitimate application connections.
Attaching an additional security group is incorrect because security groups only support allow rules and cannot explicitly deny traffic. Creating a DNS routing policy fails because domain name resolution does not control or block direct IP level connections. Adjusting existing security group outbound rules to drop packets is impossible since security groups entirely lack explicit deny capabilities.
The key concept tested is recognizing the differences between Network ACLs and security groups for explicitly blocking network traffic.

Question 2

In an AWS security incident response framework, which statement accurately differentiates a playbook from a runbook?

It outlines the overarching methodology for managing a specific threat type, whereas the latter details discrete execution steps. It provides granular command line instructions to mitigate threats, whereas the latter dictates overall cross-account access controls. It consists exclusively of automated Lambda functions for containment, whereas the latter serves as a manual approval tracking system. It defines the hierarchical communication paths for internal stakeholders, whereas the latter aggregates logs for subsequent legal review.

Correct Answer: It outlines the overarching methodology for managing a specific threat type, whereas the latter details discrete execution steps.

The correct statement accurately captures that a playbook provides the overarching strategy and methodology for handling specific types of incidents, while a runbook contains the explicit, step-by-step technical procedures to execute particular tasks.

The option reversing these definitions is incorrect because it falsely assigns granular command-line instructions to playbooks and overall policies to runbooks. The choice focusing on automated containment inaccurately restricts playbooks to purely automated functions rather than operational strategies. The option suggesting playbooks only define communication paths while runbooks aggregate logs misrepresents the fundamental purpose of both tools.

Key concept tested: AWS incident response documentation hierarchy and operational terminology.

Question 3

Which AWS service correlates IAM credential usage with threat intelligence feeds to identify compromised access keys communicating with known malicious IP addresses?

Amazon Macie uses threat intelligence and credential analysis to flag IAM access keys contacting known malicious endpoints AWS Security Hub uses threat intelligence and anomaly detection to flag IAM credentials contacting known malicious endpoints Amazon GuardDuty uses threat intelligence and anomaly detection to flag IAM credentials contacting known malicious endpoints Amazon Detective uses threat intelligence and behavioral analysis to flag IAM credentials contacting known malicious endpoints

Correct Answer: Amazon GuardDuty uses threat intelligence and anomaly detection to flag IAM credentials contacting known malicious endpoints

Amazon GuardDuty continuously monitors AWS account activity by analyzing VPC Flow Logs, DNS logs, and CloudTrail events, correlating them with integrated threat intelligence feeds from sources like CrowdStrike and Proofpoint to detect compromised IAM credentials communicating with known malicious IP addresses.

Amazon Detective is an investigation tool that helps analyze root causes of security findings but does not generate its own threat detections. AWS Security Hub aggregates and prioritizes findings from other services but does not perform its own threat intelligence correlation. Amazon Macie focuses on discovering and protecting sensitive data in S3, not on IAM credential threat detection.

Key concept tested: GuardDuty's role in threat intelligence-based credential compromise detection.

Secure AWS at Specialist Level

Advanced AWS security: identity & detection

Security Specialization: IAM deep dive, KMS, CloudHSM, and Secrets Manager
Detection & Response: GuardDuty, Security Hub, Detective, and incident response
Infrastructure Protection: WAF, Shield, Network Firewall, and VPC security
30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
Risk-Free: 7-day free trial with all premium features!

Start Your Free 7-Day Trial

More Domain 1: Threat Detection and Incident Response questions

396 questions (total)

Practice 100 questions

One session at a time, always new questions