Design and implement an incident response plan.
4 practice questions under this official exam objective (SCS-C02) — each with the community-verified answer, a full option-by-option explanation and instant feedback.
Auto-respond to GuardDuty malware by detaching and tagging EBS then terminating the instance
When GuardDuty detects malware on an EC2 instance, an automated response must mitigate and follow incident-response best practices. An EC2 instance ca
Immediately contain a running EC2 by associating a Deny-all NACL with its (sole-occupant) subnet
A critical EC2 instance must be contained at once while staying running, and it has active connections. A network ACL is stateless, so a Deny rule for
Deploy security patches immediately with a 0-day baseline and Patch Now, logging to S3 for evidence
A media company needs to push security patches to its EC2 fleet on demand during an incident and prove they were applied. The solution is to set a pat
Remediate Security Hub non-compliance near-real-time via Config rule, Security Hub custom action, and EventBridge-to-Lambda
Security Hub is already on for the organization and the team wants near-real-time detection and remediation of resources that fail security standards,