Automating EC2 Isolation with AWS Systems Manager Automation from GuardDuty Findings
A company is designing an automated incident response workflow. When a high-severity GuardDuty finding is generated, the security team wants to automatically isolate the affected EC2 instance by modifying its security group to deny all traffic. Which service should orchestrate this response?
Quick Answer
The answer is AWS Systems Manager Automation, which is the correct choice because it provides a pre-built runbook, AWS-DetachAndIsolateEC2Instance, that can be triggered by Amazon EventBridge when a high-severity GuardDuty finding is generated. This runbook automatically modifies the instance’s security group to deny all traffic, enabling automated EC2 isolation with Systems Manager Automation from GuardDuty findings without requiring custom code or manual intervention. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding of incident response orchestration—specifically, that Systems Manager Automation is designed for operational workflows with built-in error handling and approval steps, unlike AWS Lambda, which would require custom scripting. A common trap is choosing Lambda because it can also react to events, but the exam emphasizes that Systems Manager Automation is the managed, no-code solution for this exact use case. Memory tip: think “Automation for isolation, Lambda for custom logic”—if the task is a standard runbook action, Automation is your answer.
⚠ Common exam trap
Many exam-takers choose AWS Lambda because they think they need custom code to modify security groups, overlooking that AWS Systems Manager Automation provides a purpose-built, no-code runbook for EC2 isolation that integrates directly with GuardDuty findings via EventBridge.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Systems Manager Automation
AWS Systems Manager Automation is the correct choice because it provides a pre-built runbook (AWS-DetachAndIsolateEC2Instance) that can be triggered by Amazon EventBridge when a GuardDuty finding is generated. This runbook automatically modifies the EC2 instance's security group to deny all traffic, effectively isolating the instance without requiring custom code. Systems Manager Automation is designed for such operational workflows, offering built-in error handling and approval steps.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Lambda
Why it's wrong here
Lambda functions lack native event-driven orchestration logic required to manage the stateful workflow and conditional branching of a multi-step incident response. While Lambda is ideal for executing the discrete code necessary to modify security group rules once triggered, it cannot serve as the primary orchestrator. Instead, AWS Step Functions should be used to coordinate the sequence of events and handle retries or error logic within the automated workflow.
- ✗
AWS Config
Why it's wrong here
Config is for compliance, not automated response.
- ✗
AWS Step Functions
Why it's wrong here
Step Functions can orchestrate but is less specialized than Automation.
- ✓
AWS Systems Manager Automation
Why this is correct
Automation provides predefined runbooks for incident response, including security group modification.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to automate the response to a specific GuardDuty finding. When GuardDuty detects a finding of type `UnauthorizedAccess:EC2/SSHBruteForce`, they want to automatically block the offending IP address using a network ACL. Which AWS service can they use to orchestrate this response?
easy- A.AWS Lambda
- ✓ B.AWS Systems Manager Automation
- C.AWS Config
- D.AWS CloudFormation
Why B: AWS Systems Manager Automation is the correct service because it provides a runbook-based automation framework that can be triggered by Amazon EventBridge events from GuardDuty. When GuardDuty generates a finding of type `UnauthorizedAccess:EC2/SSHBruteForce`, an EventBridge rule can invoke an SSM Automation document that modifies the network ACL to block the offending IP address. This orchestration is natively supported by SSM Automation without requiring custom code, making it the ideal choice for automated incident response workflows.
Variation 2. A security engineer is configuring automated response to a GuardDuty finding of type 'UnauthorizedAccess:EC2/SSHBruteForce'. The engineer needs to isolate the compromised instance by modifying the security group to deny all inbound traffic. Which AWS service should be used to orchestrate this response?
medium- A.AWS Lambda
- B.AWS CloudFormation
- C.AWS Config
- ✓ D.AWS Systems Manager Automation
Why D: AWS Systems Manager Automation is the correct service because it provides a pre-built runbook, AWS-IsolateInstanceEC2, specifically designed to isolate an EC2 instance by modifying its security group to deny all inbound traffic. This runbook can be triggered directly by a CloudWatch Events rule that matches the GuardDuty finding, enabling fully automated incident response without custom code. Systems Manager Automation also supports cross-account and cross-region execution, making it suitable for enterprise-scale response orchestration.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.