Incident Response (14%)

SCS-C03 · 42 questions

• A fintech runs 400 EC2 instances handling payments and must pass an audit showing a repeatable malware response. The CISO requires centralized incident tracking, automated isolation steps every analyst follows, and isolated forensic analysis of disk artifacts. Which approach to response plans and runbooks meets all three needs?
• A SaaS company sees GuardDuty malware findings on production EC2 hosts. Leadership requires automatic isolation within minutes, forensic disk capture for legal hold, and a tracked approval before rejoining fleet. Which automated remediation design satisfies the incident response requirement?
• At 02:00 UTC GuardDuty flags an EC2 web server mining crypto, with outbound connections to an unknown IP and IAM role credentials used from that IP. The runbook requires stopping spread, preserving forensics, and restoring service. Which containment and recovery sequence should the responder execute first to isolate the threat?
• A SaaS company must cut mean time to respond for ransomware in three AWS Regions, requiring pre-provisioned forensic jump access, isolated evidence storage with Object Lock, and pre-deployed GuardDuty, Security Hub, and Detective. Legal requires tested runbooks and no production credential reuse. Which incident preparation design meets these readiness requirements?
• A retail platform suffered checkout fraud spanning ALB access logs, WAF logs, and application JSON logs in CloudWatch, and analysts must run ad-hoc joins by IP and trace ID across all three sources for the last 7 days. Which log search and correlation approach should the responder choose to investigate this fraud event?
• After GuardDuty flags cryptocurrency mining on an EC2 instance, the IR team must determine the initial access vector, lateral movement, and whether other accounts were touched during a 14-day window. VPC flow logs and CloudTrail are voluminous. Which method should the responder use to conduct root cause analysis?
• A fintech company suspects an EC2 web fleet was compromised overnight. Legal requires tamper-evident system and application logs preserved for investigation with clear chain of custody and no modification for one year. Which forensic log preservation strategy should the responder implement to retain admissible system and application evidence?
• A fintech startup runs production in three AWS accounts with GuardDuty disabled and no forensic process. The CISO requires isolated forensic analysis, pre-provisioned emergency access, and always-on detective tooling before launch. Which preparedness design provisions access and security tooling to meet incident readiness?
• A 200-person fintech runs a trading API on EKS across two Regions with DynamoDB global tables. Auditors require quarterly proof that pod-isolation and Regional failover playbooks meet a 1-hour RTO. Testing must not disrupt live trading and must produce repeatable pass/fail evidence. Which testing procedure should the security lead recommend to validate the incident response plan's containment and recovery effectiveness?
• A fintech runs 200 EC2 instances in one account. GuardDuty reports UnauthorizedAccess:EC2/MaliciousIPCaller.Custom for one instance, and Security Hub shows a related high-severity finding. The instance processes payments and shares a VPC with other workloads. Which validation workflow should the responder execute to assess the scope and impact of the GuardDuty finding?
• A GuardDuty finding flags an EC2 instance communicating with a known malicious IP, followed by unusual IAM calls. The responder must reconstruct the timeline, lateral movement, and affected users quickly without manually joining CloudTrail and VPC logs. Which root cause analysis method should the responder use?
• A retail company needs faster EC2 malware response with consistent isolation steps, assigned owners, and timeline tracking across shifts. Analysts currently use chat messages and manual console clicks with no audit trail. Which runbook design should the incident lead adopt to standardize response tracking with automated isolation?
• An online gaming studio runs matchmaking on EC2 Auto Scaling groups across three AZs. Security requires that suspected compromised hosts be isolated automatically, have EBS snapshots captured for forensics with chain-of-custody tags, and notify moderators for approval before termination. Which automated remediation design should the architect implement to contain EC2 incidents forensically?
• A logistics company suffered slow containment because no forensic accounts, tools, or network captures existed before a ransomware event. Leadership now requires pre-staged isolation capability, immutable logs, and ready analyst access for the next incident. Which preparedness setup should the architect implement to enable rapid forensic-ready response?
• A fintech exchange faces stolen IAM keys used to launch mining EC2 instances across two accounts. Leadership wants defined responder roles, isolated forensic examination without contaminating evidence, tracked containment tasks, and post-incident analysis of large CloudTrail datasets. Auditors require repeatable runbooks. Which response plan should the incident lead implement to coordinate roles, forensics, and lessons learned?
• A bank rehearses ransomware containment quarterly but has never tested backup restores or network isolation under load. Regulators demand evidence that the IR plan actually works during realistic failures. Which testing procedure validates the effectiveness of the incident response plan under controlled disruption?
• An e-commerce EC2 fleet in an Auto Scaling group shows ransomware behavior on two instances, with GuardDuty Malware Protection findings and suspicious outbound traffic. The team must stop spread, preserve forensics, and restore service within two hours without losing customer data. Which containment and recovery sequence should the responder execute to handle affected resources?
• After a credential leak, a gaming studio sees odd Lambda invocations, S3 access, and login spikes but cannot connect events across CloudTrail, VPC, and app logs. Analysts need unified search and timeline correlation. Which log search and correlation approach should the responder deploy to trace the attack chain?
• A SaaS startup must improve readiness for EC2 ransomware containment with isolated forensics, pre-approved responder access, and deployed investigation tooling before any incident occurs. Limited staff need automated isolation and evidence collection. Which incident preparation approach using AWS capabilities best meets these readiness requirements?
• A healthcare SaaS must prove its ransomware runbook for EC2 and RDS actually restores service within four hours, but leadership forbids disrupting production. The plan requires isolated testing of containment, backup restore, and failover steps with measured results. Which procedure validates the effectiveness of this incident response plan?
• A regional bank SOC gets a GuardDuty finding for anomalous GetSecretValue and DescribeInstances calls from a production app role, followed by failed console logins in staging. Analysts must identify the originating principal, build a full event timeline, and assess cross-account scope without manually querying raw logs. Which root cause analysis method best traces the initial compromise and blast radius?
• A logistics firm runs critical billing APIs on EC2. Auditors require that leaked IAM access keys be neutralized within minutes without human approval, with full audit trail and stakeholder notice. Manual rotation missed a prior leak for hours. Which automated remediation workflow neutralizes exposed IAM keys within minutes?
• GuardDuty reports cryptocurrency mining on an EC2 instance and Security Hub shows an associated IAM credential leak, but the owner claims both are test activity. Which validation workflow best assesses the true scope and impact of the security event?
• A gaming studio suspects EC2 cryptomining, must preserve memory, disk, and application logs for legal review, maintain chain of custody, and avoid altering the suspect host. Which forensic log capture design preserves admissible artifacts safely?
• An online learning platform runs 80 EC2 instances for virtual labs. Security requires GuardDuty EC2 findings to trigger isolation within minutes, capture disk evidence automatically, open a ticket, and avoid manual logins. Which automated remediation workflow isolates the host and preserves forensic evidence within minutes?
• A regional bank runs payment APIs in two Availability Zones and must prove its incident response runbook restores service within 15 minutes without causing data loss. Leadership wants controlled disruption testing plus a resilience score before the next audit. Which testing procedure best validates the incident response plan's effectiveness?
• After a credential-stuffing alert, a retailer sees failed logins in its ecommerce app logs, suspicious AssumeRole calls in CloudTrail, and anomalous egress in VPC Flow Logs across three accounts. Analysts need one timeline correlating application events with AWS API and network telemetry for the same identities and IPs. Which log search and correlation approach builds that unified timeline?
• A retailer finds an EC2 web server mining cryptocurrency, still connected to an RDS database with customer orders. The team must stop lateral movement, preserve evidence, eradicate the miner, and restore service quickly. Which containment, eradication, and recovery sequence meets all goals?
• A gaming startup suspects an EC2 instance was compromised via a web app, and legal requires bit-for-bit disk copies plus volatile memory and instance metadata preserved in a separate forensic account with chain of custody. The instance must stay isolated but running. Which forensic log and artifact capture plan preserves admissible evidence?
• A bank's SOC handles EC2 malware alerts inconsistently, with analysts using manual console steps for isolation and evidence collection. Regulators require documented, repeatable runbooks with assigned tasks, timelines, and forensic notes. Which design delivers consistent response plans and trackable execution?
• An e-commerce platform sees GuardDuty EC2 malware findings at night and needs automatic isolation, forensic snapshot capture, and tagging for investigation without waiting for on-call approval. The workflow must be auditable and retry on API throttling. Which automated remediation design best contains the compromised EC2 incident?
• A gaming studio suspects EC2 instances are mining cryptocurrency and must preserve volatile memory, disk snapshots, and OS and application logs as court-admissible evidence while keeping production running. Chain of custody and timestamps are critical. Which forensic artifact collection approach should the responder execute to ensure complete preservation?
• A logistics firm with 15 AWS accounts has no standing incident capability. Past events stalled waiting for access approvals and missing forensic tools. Leadership wants pre-staged access, tooling, and evidence storage ready before the next incident. Which preparedness design best ensures rapid response?
• After GuardDuty alerts on unusual API calls from a finance analyst's credentials, the IR team must map accessed S3 buckets, EC2 instances, and IP history to find how the credentials were abused. Which root cause analysis method reconstructs the attack timeline fastest?
• Security Hub aggregates a GuardDuty CryptoCurrency mining finding and a Macie sensitive-data finding for the same production EC2 instance that processes payment files. Leadership needs confirmed scope, data impact, and attacker path before containment. Which finding-validation workflow assesses the scope and impact of this security event?
• After a credential leak, a media firm sees suspicious AssumeRole and S3 data access across CloudTrail, GuardDuty, and app logs in CloudWatch, and analysts must link the IAM principal to API calls and WAF blocks in one timeline without exporting CSVs manually. Which search and correlation method builds a unified incident timeline?
• A fintech startup detects cryptomining on a payment EC2 instance, must preserve memory, disk, and VPC flow context for legal review, and keep evidence isolated from production tampering. Which forensic preservation workflow should the responder execute to capture isolated system and application logs?
• A media firm detected cryptomining on three EC2 instances in a public subnet, with suspicious outbound connections and a potentially exposed key pair. The workload must stay online for forensics, stop lateral movement, remove the miner, and restore clean operation. Which incident response sequence contains and eradicates the threat while enabling recovery?
• A fintech must formalize card-data breach response with assigned roles, isolated forensic notebooks, and tracked tasks that auditors can review after each drill. Which response plan and runbook design meets isolation, accountability, and auditability?
• A GuardDuty finding flags EC2 credential exfiltration and Security Hub shows a critical S3 public exposure in prod. The SOC must confirm true positives, scope, and blast radius before containment during an active alert. Which validation workflow should the responder follow to assess event impact?
• After a stolen access key alert, a retailer must trace the key's use across CloudTrail, WAF, and custom app logs in CloudWatch to map accessed buckets, IPs, and follow-on calls within hours. Which search and correlation workflow should the responder execute to reconstruct the security event timeline?
• A logistics company documented a ransomware containment runbook for EBS-backed fleets but has never executed it, and leaders doubt backup restores and IAM lockdown steps work under stress. The team needs controlled failure drills with measured recovery. Which testing control validates the response plan under realistic failure?