AWS Certified Security Specialty (SCS-C03)

1. A security engineer needs to enable threat detection for an AWS account. The engineer wants to automatically detect when an EC2 instance is communicating with known malicious IP addresses. Which AWS service should the engineer enable to accomplish this with the least operational overhead?

2. A security engineer is reviewing Amazon GuardDuty findings and notices a finding type CryptoCurrency:EC2/BitcoinTool.B!DNS. The engineer needs to understand what this finding indicates. Which of the following best describes this finding?

3. A security engineer is building an incident response playbook for AWS environments. The playbook must define the first action to take when Amazon GuardDuty generates a high-severity finding indicating that an EC2 instance is communicating with a known command-and-control server. Which action should be the FIRST step according to incident response best practices?

4. A security engineer needs to build an automated incident response workflow that: (1) detects when an EC2 instance is tagged as compromised, (2) captures an EBS snapshot, (3) isolates the instance via security group change, and (4) notifies the security team. Which AWS service combination BEST orchestrates this multi-step workflow?

5. A security engineer is responding to a credential exposure incident where an EC2 instance role's temporary credentials were exfiltrated and are being used from an external IP. The engineer deactivates the access key but the attack continues. Why, and what should the engineer do?