SCS-C03 Incident Response Practice Question
An organization detects unauthorized access to an Amazon S3 bucket containing sensitive customer data. The Security team needs to immediately isolate the bucket while ensuring logs are preserved for forensic analysis. Which action should the team take first?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a bucket policy that denies all 's3:*' actions for all users except the security incident response role.
Immediately restricting access via a restrictive bucket policy is the most effective way to stop data exfiltration while keeping the bucket available for investigation. Unlike deleting the bucket, which destroys evidence, a policy change enforces least privilege while maintaining the integrity of the data store for future forensics. This approach aligns with the containment phase of the AWS incident response lifecycle, prioritizing the cessation of malicious activity before proceeding to deeper investigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the S3 bucket to prevent further unauthorized data access.
Why it's wrong here
Deleting the bucket destroys potential forensic evidence and logs required to understand the scope of the breach. Incident response protocols dictate that resources should be isolated and preserved for investigation rather than destroyed, as data recovery or root cause analysis would be impossible without the original environment state.
- ✗
Disable AWS CloudTrail logging to stop generating potentially malicious log entries.
Why it's wrong here
Disabling CloudTrail hides the attacker's actions and prevents investigators from tracking subsequent lateral movement or persistence mechanisms. Maintaining visibility is critical during an active incident, and stopping logs would prevent security teams from reconstructing the attack timeline and identifying exactly which objects were accessed during the breach.
- ✓
Apply a bucket policy that denies all 's3:*' actions for all users except the security incident response role.
Why this is correct
Applying a restrictive policy effectively contains the breach by blocking all traffic while ensuring the security team retains access for forensic examination. This preserves the environment's state for analysis while immediately halting ongoing unauthorized data exfiltration, satisfying the containment requirement without destroying the underlying data or audit logs.
- ✗
Revoke all IAM user credentials globally to lock down the entire AWS account.
Why it's wrong here
Revoking all credentials globally is an overly broad response that causes massive business disruption beyond the scope of the incident. It would halt all legitimate operations and potentially trigger automated service failures across the account, whereas the incident is specifically identified to be isolated to a single bucket.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva writes every SCS-C03 question from scratch — 99 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.