Detect security threats and anomalies by using AWS services.
12 practice questions under this official exam objective (SCS-C02, SCS-C03), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
12 total · page 1 of 1Check GuardDuty InstanceCredentialExfiltration findings to confirm EC2 metadata credential
A company suspects an attacker used an overly permissive role to export EC2 instance-profile credentials from metadata and then used them from an exte
Use Amazon Inspector for ECR/ECS vulnerability scanning aggregated to a central Security H
A company runs Fargate ECS workloads and stores images in per-account ECR private registries. The audit team needs to identify OS and language-library
Get automated email for exposed IAM access keys via an EventBridge rule on AWS Health Risk
The company wants automated email alerts when IAM access keys from developer accounts are found on public code-repository sites. AWS detects credentia
Mitigate credential stuffing with the WAF ATP rule and a password-reset redirect for affec
A WAF with the CRS already fronts the login ALB; the company needs to cut credential-stuffing success and avoid penalizing legitimate users. Adding th
Use ECS Exec to inspect a Fargate container with the least operational effort
A security engineer suspects malicious requests to an ECS Fargate service and needs to inspect the running container, retrieving log and memory-dump f
Use GuardDuty RDS Protection with EventBridge and SNS for least-overhead Aurora unknown-us
The company wants email alerts when unknown users attempt to log in to Amazon Aurora MySQL, with the least operational overhead. GuardDuty RDS Protect
Enable GuardDuty EKS Audit Log Monitoring to detect unauthenticated EKS access with least
The company must detect unauthenticated access to existing EKS clusters with no additional EKS configuration and the least operational effort. Amazon
How to Find S3 Buckets with Sensitive Data Using Macie with Least Overhead?
Amazon Macie automated sensitive data discovery continuously samples S3 buckets and pinpoints which ones hold sensitive data, so full scans can be tar
Enable EKS control plane logs and ingest them into CloudWatch for GuardDuty to monitor
GuardDuty EKS Protection is enabled but not monitoring the Kubernetes workloads. GuardDuty's Kubernetes protection analyzes the EKS control plane (aud
Set up an Inspector delegated administrator and enable automatic scanning for new member a
For organization-wide host-based vulnerability and network-exposure scanning of EC2 and ECR, with findings to Security Hub and automatic coverage of n
Configure VPC Traffic Mirroring to copy packets to an IDS monitoring instance
A regulatory rule requires whole-packet inspection (promiscuous/IDS) of traffic to and from an EC2 workload. VPC Traffic Mirroring copies (mirrors) th
How to Detect EKS Audit Log and Runtime Risks with Email Alerts?
The question tests GuardDuty EKS Protection and Runtime Monitoring for detecting Kubernetes risks from EKS audit logs plus OS, network, and file event