SCS-C02 EBS Snapshot Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use the dd command via AWS Systems Manager to create a raw image and store it in S3.

  Why it's wrong here

  Using `dd` via Systems Manager requires the volume to be unmounted or the filesystem to be frozen to ensure a consistent snapshot, which is impossible while the instance is running and cannot be stopped. This approach is tempting because `dd` is a standard tool for bit-for-bit forensic imaging, and Systems Manager provides a convenient automation path; it would be correct if the instance could be stopped or the volume detached.

• ✗

  Detach the volume from the instance, create a snapshot, and then attach it to a forensic analysis instance.

  Why it's wrong here

  This option is incorrect because detaching the root volume from a running instance is not possible without stopping the instance first (root volumes cannot be detached while the instance is running, as the device is in use). Stopping the instance would kill the running processes and potentially lose volatile memory evidence, which directly violates the requirement to not stop the instance. Even if you could detach a non-root data volume, the process of detaching and re-attaching to a forensic instance changes the evidence chain and may require the instance to be stopped; the correct procedure is to take a snapshot while the volume is still attached, then create a forensic volume from that snapshot and attach it to an analysis instance.

• ✓

  Create a snapshot while the volume is attached to the instance.

  Why this is correct

  Creating a snapshot while the volume is attached is the correct approach because Amazon EBS snapshots are designed to be taken of in-use volumes without stopping the instance. The snapshot is crash-consistent (or file-system-consistent if the instance has the AWS backup agent or you freeze the filesystem), and it provides a point-in-time forensic copy that can later be analyzed by creating a new volume from the snapshot. This satisfies the incident response requirement to preserve evidence while keeping the instance running for continued investigation or memory acquisition.

• ✗

  Use AWS Systems Manager to run a command that copies the volume content to S3.

  Why it's wrong here

  Using AWS Systems Manager to copy volume content to S3 is not a valid forensic image method because Systems Manager Run Command operates at the OS level; it would require a script or utility running inside the instance, which introduces writes to the filesystem (including logs, temporary files, and potentially altering evidence). Even if you could read the block device, copying raw bytes through the network to S3 is neither crash-consistent nor a point-in-time snapshot of the entire EBS volume, and it does not preserve metadata or deleted blocks in the same reliable way as an EBS snapshot. AWS also does not provide a native Systems Manager action that performs a block-level forensic copy; this would be a manual, error-prone process that risks contaminating evidence.

Go deeper

Related to this question