SCS-C03 Incident Response Practice Question
A security incident indicates an EC2 instance is likely compromised and communicating with a C2 server. The security team needs to perform memory forensics and isolate the instance while preserving evidence. Which TWO actions should the team perform?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Snapshot the EBS volumes attached to the instance.
In an incident response scenario, capturing the volatile state of an instance is vital before isolation or termination occurs. Snapshotting the EBS volume allows for offline disk forensics, while memory dumps capture active threats that do not persist on disk. These actions follow standard digital forensics procedures to ensure evidence integrity, enabling a thorough investigation into the root cause of the compromise without losing critical data residing only in RAM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Terminate the EC2 instance immediately to stop the data exfiltration.
Why it's wrong here
Terminating an instance results in the loss of volatile memory and instance store data, destroying critical forensic evidence. Best practice dictates isolating the instance using security groups or network ACLs to block traffic while maintaining the state for memory analysis and post-mortem disk investigation.
- ✓
Snapshot the EBS volumes attached to the instance.
Why this is correct
Taking an EBS snapshot preserves the state of the file system at the time of the incident. This allows the security team to mount the volume to a separate, isolated forensic workstation for detailed analysis without alerting the attacker or modifying the original data on the production instance.
- ✗
Attach a new IAM role with administrative privileges to the instance.
Why it's wrong here
Attaching administrative privileges to a compromised instance increases the blast radius of the attack. Any existing malware could use the elevated permissions to perform further malicious actions, such as disabling logs, deleting snapshots, or escalating privileges across the entire AWS account environment, worsening the initial security incident.
- ✓
Capture the instance memory state before isolation.
Why this is correct
Memory forensics is essential for identifying fileless malware, active network connections, and hidden processes that do not appear on disk. Capturing the RAM content provides the necessary artifacts to understand what the attacker was actively doing on the system before the instance is shut down or isolated.
- ✗
Remove the VPC flow logs to save storage costs during the investigation.
Why it's wrong here
VPC Flow Logs are a critical source of truth for network traffic patterns, including source and destination IP addresses, ports, and protocols. Deleting these logs would remove the only evidence documenting the C2 communication, making it impossible to determine the extent of the exfiltration or the attacker's origin.
About these practice questions
One of 99 original SCS-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.