SCS-C02 Threat Detection and Incident Response Practice Question

A security engineer is configuring automated response to a GuardDuty finding of type 'UnauthorizedAccess:EC2/SSHBruteForce'. The engineer needs to isolate the compromised instance by modifying the security group to deny all inbound traffic. Which AWS service should be used to orchestrate this response?

⚠ Common exam trap

Candidates often choose AWS Lambda because they think they need custom code to modify security groups, but AWS Systems Manager Automation provides a pre-built, auditable, and fully managed runbook that eliminates the need for custom code and is the recommended service for orchestrating automated incident response actions.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

AWS Systems Manager Automation

AWS Systems Manager Automation is the correct service because it provides a pre-built runbook, AWS-IsolateInstanceEC2, specifically designed to isolate an EC2 instance by modifying its security group to deny all inbound traffic. This runbook can be triggered directly by a CloudWatch Events rule that matches the GuardDuty finding, enabling fully automated incident response without custom code. Systems Manager Automation also supports cross-account and cross-region execution, making it suitable for enterprise-scale response orchestration.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
AWS Lambda
Why it's wrong here
Lambda is a serverless compute service, not an orchestration engine; while a Lambda function can be triggered by EventBridge or GuardDuty to perform remediation like modifying a security group, it lacks the built-in runbook lifecycle, approval steps, and rollback controls that incident response requires. Using Lambda directly means you must code the workflow, handle IAM permissions, and manage idempotency yourself, making it a downstream building block rather than the automated response service the question is asking for.
✗
AWS CloudFormation
Why it's wrong here
CloudFormation is an infrastructure-as-code provisioning engine that creates, updates, and deletes stacks from templates; it reacts to manual or CI/CD driven changes, not to real-time security findings. Although you could use a custom resource or a stack update to adjust security groups, CloudFormation has no native event-driven trigger for GuardDuty findings or automatic runbook execution. It is the wrong tool because incident response requires immediate, event-driven remediation, not template-driven infrastructure deployment.
✗
AWS Config
Why it's wrong here
AWS Config tracks resource configurations and evaluates them against rules, but its core purpose is compliance posture assessment, not executing response actions. It can invoke remediation actions—often through SSM Automation documents or Lambda—when a rule is noncompliant, yet Config itself only generates evaluations and triggers; it lacks the operational runbook capability to orchestrate multi-step response across AWS services. Therefore, Config is a detective/triggering component rather than the automated response orchestrator.
✓
AWS Systems Manager Automation
Why this is correct
Systems Manager Automation is the correct service because it uses automation documents (runbooks) designed specifically to perform operational remediation in a controlled, repeatable way. A runbook can include steps that modify security group rules, stop or isolate EC2 instances, collect diagnostics, or invoke Lambda functions, and it supports IAM roles, approval gates, and rate controls for safe execution. EventBridge rules can trigger these runbooks automatically from security findings, making it the orchestration layer for automated incident response.

Go deeper

SCS-C02 Threat Detection and Incident Response Practice Question

Why each option matters

Option-by-option breakdown

Related to this question