AWS SCS-C02 Practice Test

SCS-C02 practice test: what's covered

• SCS-C02

Free SCS-C02 sample questions

1. A security team wants a managed service that continuously analyzes VPC Flow Logs, DNS query logs, and CloudTrail management events to surface compromised instances and credential misuse without deploying agents. Which service fits this requirement?

   • A. Amazon GuardDuty applies machine learning and threat intelligence to those log sources to detect anomalies
   • B. AWS Config records resource configuration history but does not perform threat detection on logs
   • C. Amazon Inspector scans for software vulnerabilities and CVEs rather than analyzing traffic logs
   • D. AWS CloudTrail records API activity but does not analyze it for threats on its own
   Show answer

   Correct: A. GuardDuty is correct because it ingests VPC Flow Logs, DNS logs, and CloudTrail events to detect threats agentlessly. Config is incorrect because it tracks configuration drift, not threats. Inspector focuses on CVE vulnerability scanning, not log analysis. CloudTrail records API calls but does not by itself detect malicious behavior.

2. An organization running containerized workloads on EKS wants to detect runtime threats such as malicious process execution and reverse shells inside running pods, beyond the network-level signals GuardDuty already provides. Which GuardDuty capability should they enable?

   • A. GuardDuty Runtime Monitoring deploys a security agent to observe OS-level process and file activity
   • B. GuardDuty S3 Protection only analyzes data-plane access patterns on S3 buckets
   • C. GuardDuty Malware Protection scans EBS volumes but not live container processes
   • D. GuardDuty RDS Protection monitors database login anomalies, not container runtimes
   Show answer

   Correct: A. Runtime Monitoring is correct because its agent inspects process, file, and network activity inside EC2, ECS, and EKS workloads. S3 Protection is incorrect because it watches bucket access, not runtime behavior. Malware Protection scans volumes, not live processes. RDS Protection covers database authentication anomalies, which is unrelated to container runtime threats.

3. A multi-account enterprise needs a single console that aggregates findings from GuardDuty, Inspector, Macie, and partner tools while measuring posture against AWS Foundational Security Best Practices and CIS benchmarks. Which service provides this?

   • A. AWS Security Hub centralizes findings and runs automated security standard checks across accounts
   • B. Amazon Detective only builds investigation graphs and does not run compliance standards
   • C. AWS Trusted Advisor gives best-practice checks but does not aggregate GuardDuty findings
   • D. Amazon CloudWatch dashboards visualize metrics but do not normalize security findings
   Show answer

   Correct: A. Security Hub is correct because it normalizes findings into ASFF and evaluates accounts against standards like AFSBP and CIS. Detective is incorrect because it focuses on root-cause investigation graphs, not aggregation. Trusted Advisor offers recommendations but is not a findings aggregator. CloudWatch shows metrics and is not a security finding normalization service.

4. After GuardDuty raises a finding about a potentially compromised IAM role, an analyst needs to visualize the role's API call history, the IP addresses involved, and related resources over time to determine scope. Which service is purpose-built for this investigation?

   • A. Amazon Detective builds linked behavior graphs from CloudTrail, VPC Flow, and GuardDuty data
   • B. AWS Config Rules evaluate compliance but cannot correlate behavior across time for an entity
   • C. Amazon Athena can query logs but does not provide an interactive entity-relationship graph
   • D. AWS Systems Manager automates remediation actions rather than visualizing investigation context
   Show answer

   Correct: A. Detective is correct because it automatically correlates logs into interactive graphs to accelerate scoping. Config Rules check compliance state and are not investigation tools. Athena can run SQL on logs but requires manual correlation and offers no graph view. Systems Manager executes remediation but does not provide investigative visualizations.

5. A platform team wants continuous, automated vulnerability scanning across their compute estate using Amazon Inspector v2. Which resource types can Inspector scan for software vulnerabilities and CVEs? (Choose THREE)

   • A. Amazon EC2 instances using the SSM agent for software inventory and CVE matching
   • B. Container images stored in Amazon Elastic Container Registry (ECR)
   • C. AWS Lambda functions and their application dependencies
   • D. Amazon S3 buckets for sensitive data classification and exposure
   • E. Amazon Route 53 hosted zones for DNS misconfiguration
   Show answer

   Correct: A and B and C. Inspector v2 scans EC2 instances, ECR container images, and Lambda functions for CVEs, so those three are correct. S3 sensitive-data classification is incorrect because that is Macie's role, not Inspector's. Route 53 DNS analysis is also incorrect because Inspector does not evaluate hosted zones; it focuses on software vulnerabilities in compute resources.

Last updated: 2026-10-19

SCS-C02 practice test FAQ

Related practice tests

• AWS SAA-C03 practice test
• AWS SAP-C02 practice test
• Microsoft SC-100 practice test
• ISC2 CCSP practice test
• Google Cloud PCSE practice test
• CCSK practice test