← SCS-C02·Amazon Web Services

Question 34 of 1,748

Threat Detection and Incident Response →hardMultiple ChoiceObjective-mapped

How to Automatically Isolate a Compromised EC2 Instance and Capture Forensic Evidence

This SCS-C02 practice question tests your understanding of threat detection and incident response. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application processes sensitive customer data. The Security team has enabled VPC Flow Logs, CloudTrail, and GuardDuty. Recently, the team received a GuardDuty finding indicating a potential SSH brute force attack originating from an external IP address 203.0.113.50 targeting one of the EC2 instances. The Security Engineer needs to automatically isolate the affected instance and capture forensic evidence for analysis. The company has strict requirements: the instance must be isolated immediately, and a snapshot of the EBS volume must be taken before any remediation actions are taken. The instance is part of an Auto Scaling group, and the Security Engineer wants to minimize manual intervention. The Security Engineer has access to AWS Systems Manager and AWS Lambda. Which combination of steps should the Security Engineer implement to meet the requirements?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "minimum / minimize"
Why it matters: Asks for the least resource use — fewest addresses, smallest subnet, lowest overhead. Eliminate over-provisioned options even if they would technically work.
Clue: "immediately / without restart"
Why it matters: Time or reboot constraint — the correct answer must take effect right away without requiring a reboot or reload.

A
Use AWS Systems Manager to automatically connect to the instance via EC2 Instance Connect, run commands to capture forensic data, and then modify the security group to deny all inbound traffic.
Why wrong: EC2 Instance Connect requires manual initiation and does not automatically respond to GuardDuty findings. Also, it may not trigger automatically.
B
Create a CloudWatch Logs metric filter on the VPC Flow Logs for the attacker IP. When the metric breaches a threshold, trigger an SNS topic that runs an AWS Systems Manager Automation document to isolate the instance and take an EBS snapshot.
Why wrong: CloudWatch Logs does not directly trigger on GuardDuty findings. GuardDuty integrates with EventBridge. Also, VPC Flow Logs may not capture the attack as quickly as GuardDuty.
C
Configure Amazon EventBridge to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function first calls the EC2 CreateSnapshot API to capture a forensic snapshot of the instance's EBS volume. Then, it uses AWS Systems Manager Automation to run a pre-defined automation document that isolates the instance by modifying the instance's security group to only allow traffic from a trusted management IP, and then stops the instance.
This correctly automates the response: EventBridge triggers on GuardDuty finding, Lambda takes a snapshot first for evidence, then Systems Manager Automation isolates and stops the instance.
D
Configure a CloudWatch Events rule to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function terminates the EC2 instance and then takes a snapshot of the EBS volume for forensic analysis.
Why wrong: Terminating the instance before taking a snapshot loses the evidence. The snapshot must be taken first.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Configure Amazon EventBridge to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function first calls the EC2 CreateSnapshot API to capture a forensic snapshot of the instance's EBS volume. Then, it uses AWS Systems Manager Automation to run a pre-defined automation document that isolates the instance by modifying the instance's security group to only allow traffic from a trusted management IP, and then stops the instance.

Option C is correct because it uses EventBridge to directly detect the GuardDuty finding, which triggers a Lambda function that first takes an EBS snapshot (forensic capture) via the CreateSnapshot API before any remediation. Then it uses Systems Manager Automation to isolate the instance by modifying the security group to allow only a trusted management IP and stops the instance, ensuring isolation without destroying the instance. This sequence satisfies the strict requirement that a snapshot must be taken before any remediation actions, and it minimizes manual intervention by automating the entire response.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use AWS Systems Manager to automatically connect to the instance via EC2 Instance Connect, run commands to capture forensic data, and then modify the security group to deny all inbound traffic.
Why it's wrong here
EC2 Instance Connect requires manual initiation and does not automatically respond to GuardDuty findings. Also, it may not trigger automatically.
✗
Create a CloudWatch Logs metric filter on the VPC Flow Logs for the attacker IP. When the metric breaches a threshold, trigger an SNS topic that runs an AWS Systems Manager Automation document to isolate the instance and take an EBS snapshot.
Why it's wrong here
CloudWatch Logs does not directly trigger on GuardDuty findings. GuardDuty integrates with EventBridge. Also, VPC Flow Logs may not capture the attack as quickly as GuardDuty.
✓
Configure Amazon EventBridge to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function first calls the EC2 CreateSnapshot API to capture a forensic snapshot of the instance's EBS volume. Then, it uses AWS Systems Manager Automation to run a pre-defined automation document that isolates the instance by modifying the instance's security group to only allow traffic from a trusted management IP, and then stops the instance.
Why this is correct
This correctly automates the response: EventBridge triggers on GuardDuty finding, Lambda takes a snapshot first for evidence, then Systems Manager Automation isolates and stops the instance.
Clue confirmation
The clue words "minimum / minimize", "immediately / without restart" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Configure a CloudWatch Events rule to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function terminates the EC2 instance and then takes a snapshot of the EBS volume for forensic analysis.
Why it's wrong here
Terminating the instance before taking a snapshot loses the evidence. The snapshot must be taken first.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates may choose Option D because they think termination is the fastest way to stop the attack, but they overlook the requirement to capture forensic evidence before remediation—termination destroys the instance and prevents a proper snapshot of the running state.

Detailed technical explanation

How to think about this question

Under the hood, GuardDuty findings are published as events to Amazon EventBridge (formerly CloudWatch Events), allowing near-real-time automated responses. The Lambda function must call CreateSnapshot before any security group modification or instance stop to ensure the EBS volume state is captured before changes occur; Systems Manager Automation documents can run multi-step workflows, such as modifying security group rules using the AWS-RestartEC2Instance or custom documents, and stopping the instance via the ec2:StopInstances API. In a real-world scenario, if the instance is part of an Auto Scaling group, stopping it may trigger a replacement instance, but the isolated instance remains stopped for forensic analysis while the ASG launches a new healthy instance to maintain availability.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.

Quick reference

Cloud Service Model Comparison

Model	You Manage	Provider Manages	Examples
IaaS	OS, runtime, apps, data	Hardware, hypervisor, networking	EC2, Azure VMs, GCP Compute Engine
PaaS	Apps and data	OS, runtime, middleware, hardware	Elastic Beanstalk, Azure App Service
SaaS	Data and settings only	Everything else	Microsoft 365, Salesforce, Workday
FaaS / Serverless	Function code only	Infra, scaling, runtime	Lambda, Azure Functions, Cloud Run
CaaS	Containers and apps	Kubernetes, OS, hardware	EKS, AKS, GKE

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related SCS-C02 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Threat Detection and Incident Response practice questions

Practise SCS-C02 questions linked to Threat Detection and Incident Response.

Security Logging and Monitoring practice questions

Practise SCS-C02 questions linked to Security Logging and Monitoring.

Identity and Access Management practice questions

Practise SCS-C02 questions linked to Identity and Access Management.

Management and Security Governance practice questions

Practise SCS-C02 questions linked to Management and Security Governance.

Infrastructure Security practice questions

Practise SCS-C02 questions linked to Infrastructure Security.

Data Protection practice questions

Practise SCS-C02 questions linked to Data Protection.

SCS-C02 fundamentals practice questions

Practise SCS-C02 questions linked to SCS-C02 fundamentals.

SCS-C02 scenario practice questions

Practise SCS-C02 questions linked to SCS-C02 scenario.

SCS-C02 troubleshooting practice questions

Practise SCS-C02 questions linked to SCS-C02 troubleshooting.

Practice this exam

Start a free SCS-C02 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

SCS-C02 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this SCS-C02 question test?

Threat Detection and Incident Response — This question tests Threat Detection and Incident Response — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Configure Amazon EventBridge to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function first calls the EC2 CreateSnapshot API to capture a forensic snapshot of the instance's EBS volume. Then, it uses AWS Systems Manager Automation to run a pre-defined automation document that isolates the instance by modifying the instance's security group to only allow traffic from a trusted management IP, and then stops the instance. — Option C is correct because it uses EventBridge to directly detect the GuardDuty finding, which triggers a Lambda function that first takes an EBS snapshot (forensic capture) via the CreateSnapshot API before any remediation. Then it uses Systems Manager Automation to isolate the instance by modifying the security group to allow only a trusted management IP and stops the instance, ensuring isolation without destroying the instance. This sequence satisfies the strict requirement that a snapshot must be taken before any remediation actions, and it minimizes manual intervention by automating the entire response.

What should I do if I get this SCS-C02 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "minimum / minimize", "immediately / without restart". Asks for the least resource use — fewest addresses, smallest subnet, lowest overhead. Eliminate over-provisioned options even if they would technically work.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more ways this is tested on SCS-C02

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A security engineer is configuring automated incident response for Amazon GuardDuty findings. The engineer wants to isolate a compromised EC2 instance by changing its security group and stopping the instance. Which THREE services should the engineer use together to achieve this? (Choose THREE.)

medium

A.Amazon EC2
B.AWS Config
✓ C.AWS Systems Manager
✓ D.Amazon EventBridge
✓ E.AWS Lambda

Why C: AWS Systems Manager (SSM) is correct because it provides the Automation runbook capability that can be used to stop an EC2 instance and modify its security groups as part of an incident response workflow. SSM Automation can be triggered by an EventBridge rule and can invoke Lambda functions or run commands directly on the instance to isolate it. This allows the security engineer to automate the isolation and stopping of the compromised instance without manual intervention.

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.