DOP-C02 Incident and Event Response Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Delete the error logs to free up storage space.

  Why it's wrong here

  Deleting the error logs to free up storage space is counterproductive during an incident investigation. RDS error logs contain critical forensic data such as failed connection attempts, authentication failures, and database engine errors that help identify the attack vector or root cause. Removing them destroys potential evidence and violates standard incident response procedures, while the underlying storage issue should be addressed by scaling storage or exporting logs to Amazon S3.

• ✓

  Enable automated backups and ensure point-in-time recovery is configured.

  Why this is correct

  Enabling automated backups with point-in-time recovery (PITR) is the correct immediate response because it lets you restore the database to any second within the retention window, such as a timestamp just before the compromise occurred. Automated backups take daily snapshots, and RDS continuously records transaction logs to enable PITR, minimizing data loss if tables were dropped or data was tampered with. This is the foundational recovery mechanism to return the system to a known-good state.

• ✓

  Enable RDS Enhanced Monitoring and audit logs to capture SQL queries.

  Why this is correct

  Enabling RDS Enhanced Monitoring and audit logs is also correct for the investigation phase. Enhanced Monitoring provides OS-level metrics like CPU, memory, file I/O, and network traffic, helping you spot anomalous behavior or resource spikes during the incident window. Audit logs capture every SQL statement and login attempt, giving you a record of exactly what queries were executed and by which account, which is essential for post-incident forensics and identifying the attacker's actions.

• ✗

  Create a read replica to offload traffic from the primary instance.

  Why it's wrong here

  Creating a read replica does not help address a security incident because a read replica only offloads read traffic and does not enhance data integrity, traceability, or recovery. Worse, if the primary instance is compromised, replication can propagate malicious changes or triggers to the replica. It would neither identify the attack source nor prevent data loss, so it is an inappropriate response.

• ✗

  Increase the DB instance size to handle the increased load.

  Why it's wrong here

  Increasing the DB instance size to handle the increased load is irrelevant to the underlying security incident. Vertical scaling addresses performance and capacity constraints, but if the incident involves unauthorized access, data corruption, or malicious queries, adding CPU or memory will not resolve the root cause and may temporarily mask symptoms while leaving the attack unmitigated. This action also incurs cost without contributing to forensic analysis or recovery.

Go deeper

Related to this question