Respond to compromised resources and workloads.
9 practice questions under this official exam objective (SCS-C02, SCS-C03), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
9 total · page 1 of 1Preserve EC2 forensic evidence by isolating first, then capturing memory before stopping t
To preserve all forensic evidence from one instance in an Auto Scaling group behind an ALB, the engineer should first detach the instance from the Aut
Auto-respond to GuardDuty malware by detaching and tagging EBS then terminating the instan
When GuardDuty detects malware on an EC2 instance, an automated response must mitigate and follow incident-response best practices. An EC2 instance ca
Check GuardDuty InstanceCredentialExfiltration findings to confirm EC2 metadata credential
A company suspects an attacker used an overly permissive role to export EC2 instance-profile credentials from metadata and then used them from an exte
How Should You Handle Leaked IAM Access Keys?
Exposed IAM access keys in a public repository require immediate containment and usage review. The correct SCS-C03 response is to deactivate the key a
Investigate the exposed key with IAM Access Analyzer and deactivate it to stop further use
An IAM access key was leaked in a public repo. To both find out whether it was misused and stop misuse, deactivate the exposed key immediately (preven
Deny all outbound at the NACL, isolate with a diagnostics security group, and investigate
A suspicious EC2 is connecting to malicious addresses. To immediately mitigate and preserve evidence, update the subnet NACL's outbound rules to expli
Filter CloudTrail for TerminateInstances and review AssumeRoleWithSAML to identify the fed
The fastest way to find which federated user terminated an EC2 instance a week ago is to filter CloudTrail event history (90-day window) for the Termi
How Do You Disable a Compromised IAM Identity Center User and Audit Activity?
This SCS-C03 question tests immediate containment of a compromised workforce identity in IAM Identity Center and retrospective analysis of seven days
How to recover an RDS cluster to the last known good version after an attack?
This SCS-C03 scenario tests recovery of an Amazon RDS database cluster after a malicious attack using automated backups. The page establishes that poi