SCS-C02 exam dumps: questions 101 to 200 of 503

Correct answers: A, B

• A. Correct.

  Amazon GuardDuty is a threat detection service that monitors for unusual activities, unauthorized access attempts, and other security threats by analyzing AWS CloudTrail logs, VPC Flow Logs, and DNS logs.

• B. Correct.

  AWS Config allows you to assess, audit, and evaluate the configurations of your AWS resources to ensure they comply with predefined baselines, making it useful for security posture monitoring.

• C. Incorrect.

  AWS Shield Advanced is primarily designed for protecting against Distributed Denial of Service (DDoS) attacks. While useful for security, it is not relevant to monitoring metrics, baselines, or detecting unauthorized access.

• D. Incorrect.

  Amazon CloudWatch is a monitoring and management service that can be used for collecting and tracking metrics and logs, but it does not specialize in detecting security threats or validating baseline compliance.

• E. Incorrect.

  AWS Systems Manager is a tool for operational management, such as automation and patch management, but it does not provide capabilities for detecting anomalous activity or monitoring configuration baselines.

Correct answers: B, D

• A. Incorrect.

  AWS GuardDuty and Amazon SNS can send notifications about findings, but this combination alone does not provide an automated mechanism to isolate compromised instances.

• B. Correct.

  This is correct. AWS GuardDuty detects findings, AWS Lambda can trigger custom response scripts, and AWS Systems Manager Automation can perform actions like isolating an EC2 instance by modifying its security group.

• C. Incorrect.

  AWS Config helps monitor compliance with security baselines, but it is not directly involved in automating responses to GuardDuty findings.

• D. Correct.

  This is correct. AWS GuardDuty provides threat intelligence, and AWS Security Hub can aggregate GuardDuty findings across accounts and prioritize them for action.

• E. Incorrect.

  AWS CloudTrail provides event history and logging but does not provide automated remediation for GuardDuty findings.

Correct answers: A, B, C

• A. Correct.

  AWS GuardDuty is a threat detection service that helps monitor AWS accounts for unusual and potentially unauthorized behavior, making it an essential tool for detecting threats.

• B. Correct.

  AWS Config is used to monitor and enforce compliance baselines for AWS resources, ensuring they adhere to the organization's security and compliance requirements.

• C. Correct.

  AWS Systems Manager provides unified management for both AWS and on-premises resources, allowing you to monitor and manage systems in a hybrid environment effectively.

• D. Incorrect.

  Amazon Inspector is primarily used for automated vulnerability management and not for monitoring metrics or baselines in on-premises environments.

• E. Incorrect.

  AWS CloudTrail tracks API activity and can detect security anomalies but does not provide direct monitoring of metrics or compliance baselines.

Correct answers: A, B

• A. Correct.

  Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, such as port scans or brute-force attacks, making it an appropriate tool for this scenario.

• B. Correct.

  AWS CloudTrail records API calls and user activities, providing valuable information about unauthorized access attempts or changes to resources in the environment. It complements GuardDuty by offering detailed logs for analysis.

• C. Incorrect.

  Amazon Macie focuses on data classification and protection, identifying sensitive data such as personally identifiable information (PII). It is not designed to detect suspicious activities like port scans or unauthorized access attempts.

• D. Incorrect.

  AWS Systems Manager provides operational insights and management capabilities for AWS resources but is not a threat detection tool for monitoring suspicious activities or unauthorized behavior.

• E. Incorrect.

  AWS Config tracks the resource configuration state for compliance purposes but does not detect or respond to security threats, such as unauthorized access attempts or port scans.

Correct answers: A, B, E

• A. Correct.

  Correct: If the SNS topic does not have subscriptions configured properly (e.g., email addresses or endpoints), notifications will not reach the intended recipients.

• B. Correct.

  Correct: GuardDuty needs appropriate IAM permissions to publish findings to the SNS topic. Without these permissions, no alerts will be sent.

• C. Incorrect.

  Incorrect: GuardDuty findings and SNS topics do not need to be in the same region to function properly. This is not a requirement.

• D. Incorrect.

  Incorrect: GuardDuty findings generate notifications regardless of their severity level. Notification delivery depends on SNS configuration and permissions, not severity levels.

• E. Correct.

  Correct: If the security team's email provider blocks messages from SNS, notifications may fail to be delivered. This should be checked to ensure smooth alert delivery.