SCS-C02 Threat Detection and Incident Response Practice Question
During a security incident, a forensic investigator needs to capture the memory of a running EC2 instance without shutting it down. Which AWS feature should be used?
⚠ Common exam trap
It's easy for candidates to confuse capturing volatile memory with taking a disk snapshot (Option D), not realizing that memory is stored in RAM and is not preserved by EBS snapshots, which only capture persistent storage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
EC2 Rescue for Linux or Systems Manager Run Command with a memory dump script
EC2 Rescue for Linux (via Systems Manager Run Command) includes a built-in script that can capture a full memory dump from a running EC2 instance without requiring a shutdown. This is essential for forensic analysis to preserve volatile data like running processes, network connections, and kernel structures. The script leverages the Linux 'vmcore' or 'LiME' (Linux Memory Extractor) tool to safely extract memory contents while the instance remains operational.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon CloudWatch agent
Why it's wrong here
The Amazon CloudWatch agent is a telemetry daemon that publishes operating-system-level metrics such as CPU, disk, memory utilization, and custom logs to CloudWatch. It does not provide any mechanism for capturing raw RAM contents or a kernel memory dump; at best it reports aggregate utilization percentages. Therefore it cannot serve as a forensic memory acquisition tool.
- ✓
EC2 Rescue for Linux or Systems Manager Run Command with a memory dump script
Why this is correct
EC2 Rescue for Linux includes diagnostic modules that can trigger a memory dump, and AWS Systems Manager Run Command can execute a memory-dump script on the target instance; both operate inside the guest OS to copy volatile memory while the instance remains running. By writing the output to an EBS volume or Amazon S3, they preserve process, kernel, and network state for forensic analysis. This is the correct option because no AWS control-plane API can read guest RAM directly.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail records read/write API activity across AWS services, such as who called RunInstances or CreateSnapshot, along with request metadata and source IP addresses. Its audit logs show control-plane actions but never capture the contents of instance memory, nor do they inspect guest processes, kernel data structures, or unencrypted memory pages. CloudTrail is useful for reconstructing when and how access occurred, not for acquiring volatile evidence.
- ✗
Amazon EBS snapshot
Why it's wrong here
An Amazon EBS snapshot is a point-in-time, block-level backup of the attached root or data volume, capturing only non-volatile storage such as files, logs, and installed binaries. Because memory resides in the instance's RAM and is lost on stop or termination, a disk-only snapshot cannot recover live processes, open network sockets, or memory-resident artifacts like plaintext keys. A complete forensic reconstruction requires both the EBS snapshot and a separate memory dump.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 1,205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.