The correct approach is to use ECS Exec to access the container and capture a memory dump, then snapshot the task's ephemeral storage. This works because ECS Exec provides interactive shell access to a running Fargate container without stopping it, allowing you to extract a memory dump via tools like `gcore` or by reading `/proc/kcore`, while the ephemeral storage snapshot preserves the disk state for offline analysis. On the AWS Certified Security Specialty SCS-C02 exam, this question tests your understanding that Fargate lacks host-level access, so you must rely on container-level methods for forensic data capture. A common trap is assuming you need to stop the container or use EC2-based forensics, but ECS Exec is designed for live incident response in stateless environments. Memory tip: think "Exec and Snapshot" — you execute into the container for memory, then snapshot the disk, all while the container stays alive.
SCS-C02 Threat Detection and Incident Response Practice Question
This SCS-C02 practice question tests your understanding of threat detection and incident response. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security engineer is designing an incident response plan for a containerized application running on Amazon ECS with Fargate. The engineer needs to ensure that if a container is compromised, the incident response team can capture a memory dump and disk snapshot for forensic analysis. The containers are stateless and use ephemeral storage. Which approach provides the necessary forensic data?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use ECS Exec to access the container and capture a memory dump; snapshot the task's ephemeral storage.
Option C is correct because ECS Exec allows interactive access to a running container without stopping it, enabling the capture of a memory dump (e.g., via `gcore` or `/proc/kcore`). Additionally, the task's ephemeral storage can be snapshotted while the container is still running, preserving disk state for forensic analysis. This approach aligns with incident response best practices for stateless containers on Fargate, where traditional host-level forensics are unavailable.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Configure the container to stream /dev/mem to CloudWatch Logs.
Why it's wrong here
/dev/mem cannot be streamed to CloudWatch Logs; it requires specific tools.
✗
Enable ECS task memory dumps to CloudWatch Logs.
Why it's wrong here
ECS does not have a native memory dump feature; CloudWatch Logs is for logs.
✓
Use ECS Exec to access the container and capture a memory dump; snapshot the task's ephemeral storage.
Why this is correct
ECS Exec provides interactive access; snapshots can capture disk state.
Related concept
Read the scenario before looking for a memorised answer.
✗
Stop the task and create a new task from the same image.
Why it's wrong here
Stopping the task loses the container's state; a new task does not capture forensic data.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates assume stopping the task (Option D) is safe because containers are stateless, but they overlook that forensic data (memory and ephemeral disk) is lost upon task termination, making live capture via ECS Exec (Option C) the only viable method.
Detailed technical explanation
How to think about this question
Under the hood, ECS Exec leverages the AWS Systems Manager Agent (SSM Agent) to establish a secure, interactive session into the container via the ExecuteCommand API. For memory capture, you can use `gcore <pid>` to dump a process's memory or `cat /proc/kcore` (if kernel capabilities allow) to capture full memory. Ephemeral storage on Fargate is backed by an Amazon EBS volume that persists only for the task's lifetime, so snapshots must be taken while the task is running using the `CreateSnapshot` API on the underlying volume (if the task uses a configured volume) or by copying files via `aws s3 cp` from within the container. In real-world scenarios, this approach is critical for containers that cannot be paused or stopped without losing volatile evidence.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Threat Detection and Incident Response — This question tests Threat Detection and Incident Response — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Use ECS Exec to access the container and capture a memory dump; snapshot the task's ephemeral storage. — Option C is correct because ECS Exec allows interactive access to a running container without stopping it, enabling the capture of a memory dump (e.g., via `gcore` or `/proc/kcore`). Additionally, the task's ephemeral storage can be snapshotted while the container is still running, preserving disk state for forensic analysis. This approach aligns with incident response best practices for stateless containers on Fargate, where traditional host-level forensics are unavailable.
What should I do if I get this SCS-C02 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.