SCS-C02 Threat Detection and Incident Response Practice Question
A security engineer is investigating a potential compromise of an EC2 instance. The engineer wants to capture memory and disk forensics without shutting down the instance. Which service should the engineer use?
⚠ Common exam trap
Watch out — candidates often confuse AWS Systems Manager with EC2 Instance Connect, thinking that SSH access alone is sufficient for forensic collection, but Systems Manager provides the necessary automation and agent-based execution to capture memory and disk data without requiring the instance to be stopped or terminated.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Systems Manager
AWS Systems Manager (SSM) is the correct service because it provides the capability to perform forensic data collection on a running EC2 instance without shutting it down. Specifically, SSM Automation documents like AWS-RunShellScript or AWS-GatherEC2InstanceInfo can execute commands to capture memory (e.g., using LiME or fmem) and disk forensics (e.g., dd or volume snapshots) via the SSM Agent, which runs as a system service and does not require instance termination.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config
Why it's wrong here
AWS Config is a governance and compliance service that evaluates your resource configurations against desired policies, recording configuration item history and detecting drift. It never touches the instance's operating system, so it cannot capture volatile memory, running processes, or disk artifacts needed for forensics. Its data is metadata about the managed resource, not a forensic image.
- ✓
AWS Systems Manager
Why this is correct
AWS Systems Manager, especially via Run Command and Session Manager, gives you a controlled, auditable channel to execute arbitrary scripts on EC2 instances without opening SSH or RDP. You can run built-in SSM documents or custom scripts to capture memory dumps, collect disk evidence, and pull system logs for an investigation. Its agent is already installed on many instances, making it the standard tool for on-host forensic collection.
- ✗
EC2 Instance Connect
Why it's wrong here
EC2 Instance Connect is simply a temporary-key SSH or RDP access mechanism from the AWS console or CLI. It does not include any built-in forensic tooling, and it only provides the same interactive shell you'd get with a normal SSH client. With it you would still have to manually install and run acquisition tools and manage evidence integrity, so it is not a forensic service by itself.
- ✗
Amazon CloudWatch Logs
Why it's wrong here
Amazon CloudWatch Logs is designed to aggregate, monitor, and alert on application log streams and metrics from the OS or services. It cannot capture a full disk image or memory snapshot, and it doesn't initiate commands on the instance. Its purpose is observability and audit of log data, not the hands-on forensic acquisition that an incident response requires.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.