Task 2.1: Design and Test an Incident Response Plan SCS-C03 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   A company wants to ensure that incident responders can quickly gain access to AWS resources during a security incident without waiting for manual approval. What is the most effective way to provision access for incident responders?

   • AUse the AWS account root user for all incident response actions
   • BCreate a new IAM user for each incident and attach policies manually
   • CShare the root user credentials with the incident response team
   • DPre-configure IAM roles with the necessary permissions and allow responders to assume them when needed
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A security engineer wants to introduce controlled failures into an application to test how the incident response plan performs under stress. Which AWS service should the engineer use?

   • AAWS Config
   • BAWS CloudTrail
   • CAWS Fault Injection Service
   • DAmazon GuardDuty
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team wants to automate the response to a specific type of incident: an EC2 instance that is sending outbound traffic to a known malicious IP. They want to automatically isolate the instance and terminate the malicious traffic. What should they implement?

   • ACreate a Systems Manager Automation runbook that changes the instance's security group to deny all outbound traffic, and trigger it from a GuardDuty finding.
   • BCreate a Lambda function that terminates the instance immediately upon detection.
   • CManually isolate the instance after receiving an alert from GuardDuty.
   • DUse AWS Config to automatically remediate the security group when the instance is noncompliant.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   During an incident, a forensic investigator needs to analyze a large volume of EC2 instance logs and memory dumps. The investigator wants to use a pre-configured environment with common forensic tools and libraries, and must ensure that the analysis environment is isolated from the production network. What should the investigator use?

   • AUse an EC2 instance in the same VPC as the compromised instance to run forensic tools directly.
   • BUse Amazon Athena to query the logs directly, without needing a separate analysis environment.
   • CUse AWS Glue to run interactive queries against the logs and memory dumps.
   • DLaunch an Amazon SageMaker notebook instance in a private subnet of a dedicated VPC, and load the forensic data from S3.
   Reveal Solution Discussion Select an answer first
6. 15expert · medium

   A company has a runbook for responding to a compromised EC2 instance. The runbook includes steps to isolate the instance, collect memory, and then terminate the instance. The security team wants to automate the isolation and evidence collection, but they want a human to approve the termination step. What should they implement?

   • AA manual process where a responder performs all steps.
   • BA Lambda function that performs all steps, including termination, without human intervention.
   • CA Systems Manager Automation runbook that performs isolation and evidence collection, and includes an approval step before termination.
   • DA Step Functions state machine that performs isolation and evidence collection, and then terminates the instance automatically.
   Reveal Solution Discussion Select an answer first