SCS-C03 Incident Response Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Attempt to brute-force the ransomware decryption key using high-performance compute instances.

  Why it's wrong here

  Ransomware encryption is typically based on strong, complex algorithms like AES-256 or RSA-4096, making brute-force attacks computationally infeasible. This strategy would waste valuable time and resources during a critical recovery period when restoring from backups is the standard, reliable recovery path for infrastructure impacted by encryption-based threats.

• ✓

  Restore the affected volumes from the latest pre-incident EBS snapshots.

  Why this is correct

  Restoring from snapshots is the most efficient and reliable method to recover from a ransomware incident. It ensures the integrity of the data by rolling back to a known-good state before the encryption occurred, effectively bypassing the malicious encryption and allowing the team to resume operations quickly.

• ✗

  Copy the encrypted volumes to a new account and run a vulnerability scan.

  Why it's wrong here

  Scanning encrypted volumes will not reveal the underlying data or help recover it from the ransomware. Moving the volumes to a new account consumes time and does not provide a recovery path, failing to address the business need for restoring service availability and accessing the encrypted data.

• ✗

  Format the EBS volumes and manually copy data from the underlying S3 logs.

  Why it's wrong here

  Manual data reconstruction from log files is extremely slow, error-prone, and likely incomplete. EBS volumes contain structured data and file systems that cannot be easily recreated from unstructured application logs, making this an ineffective recovery strategy that would result in significant data loss and prolonged downtime.