After a ransomware attack, a company's security team needs to restore an EC2 instance from a backup. The team has an EBS snapshot from before the attack. The instance is in a production environment and must be restored with minimal downtime. Which action should the team take?

Restore the snapshot to the existing instance's root volume by overwriting it.

Use AWS Backup to restore the instance from the snapshot directly.

Terminate the existing instance and launch a new one from the same AMI, then copy the snapshot data manually.

Create a new EBS volume from the snapshot and attach it to a new instance, then update the DNS to point to the new instance.

A company's security team is investigating a suspected data exfiltration from an EC2 instance. The instance is still running, and the team needs to preserve forensic evidence while minimizing disruption. The instance uses an instance store for its operating system and an EBS volume for application data. Which action should the team take to preserve the most relevant forensic artifacts?

Create a snapshot of the EBS volume and copy the instance store's system logs to S3 with versioning enabled.

Copy the entire instance store to an S3 bucket using the AWS CLI, then terminate the instance.

Stop the instance and create a snapshot of the instance store volume.

Enable CloudTrail for the instance and wait for logs to accumulate before taking any action.

A security analyst receives a GuardDuty finding that an EC2 instance is communicating with a known malicious IP address. Before taking action, what should the analyst do to validate the finding?

Ignore the finding because GuardDuty findings are always false positives

Change the instance's security group to block all traffic

Review the finding details and correlate with other logs (e.g., VPC Flow Logs, CloudTrail) to confirm the activity

Immediately terminate the instance to contain the threat

After confirming that an EC2 instance is compromised, a security engineer decides to terminate the instance to eradicate the threat. What should the engineer do BEFORE terminating the instance to preserve forensic evidence?

Delete the instance's security group

Create a snapshot of the instance's EBS volumes

Stop the instance instead of terminating it

AWSCertified Security - Specialty

Domain 2Objective 2

Task 2.2: Respond to Security Events SCS-C03 Practice Questions (Page 2)

Part of the Content Domain 2: Incident Response domain, which accounts for 14% of the SCS-C03 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~10–16 in this domain), expect 5–8 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

7concepts

14%of the exam

Questions 6–10

6foundation · easy
A security analyst needs to preserve a record of all API calls made in an AWS account for forensic analysis after a suspected compromise. Which service should be enabled to capture this information?
Select an answer first
7application · medium
After a ransomware attack, a company's security team needs to restore an EC2 instance from a backup. The team has an EBS snapshot from before the attack. The instance is in a production environment and must be restored with minimal downtime. Which action should the team take?
Select an answer first
8application · medium
A company's security team is investigating a suspected data exfiltration from an EC2 instance. The instance is still running, and the team needs to preserve forensic evidence while minimizing disruption. The instance uses an instance store for its operating system and an EBS volume for application data. Which action should the team take to preserve the most relevant forensic artifacts?
Select an answer first
9foundation · easy
A security analyst receives a GuardDuty finding that an EC2 instance is communicating with a known malicious IP address. Before taking action, what should the analyst do to validate the finding?
Select an answer first
10foundation · easy
After confirming that an EC2 instance is compromised, a security engineer decides to terminate the instance to eradicate the threat. What should the engineer do BEFORE terminating the instance to preserve forensic evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCS-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SCS-C03” is a trademark of its owner, used for identification only.

Task 2.2: Respond to Security Events SCS-C03 Practice Questions (Page 2)

Questions 6–10

A security analyst needs to preserve a record of all API calls made in an AWS account for forensic analysis after a suspected compromise. Which service should be enabled to capture this information?

After a ransomware attack, a company's security team needs to restore an EC2 instance from a backup. The team has an EBS snapshot from before the attack. The instance is in a production environment and must be restored with minimal downtime. Which action should the team take?

A security analyst receives a GuardDuty finding that an EC2 instance is communicating with a known malicious IP address. Before taking action, what should the analyst do to validate the finding?

After confirming that an EC2 instance is compromised, a security engineer decides to terminate the instance to eradicate the threat. What should the engineer do BEFORE terminating the instance to preserve forensic evidence?

Keep studying — Content Domain 2: Incident Response