SCS-C02 Threat Detection and Incident Response Practice Question

During an incident response, a security engineer needs to collect memory forensics from a running EC2 instance without shutting it down. The instance is running Amazon Linux 2. Which tool is MOST appropriate?

⚠ Common exam trap

Candidates often confuse memory acquisition tools (LiME) with memory analysis frameworks (Volatility), or mistakenly believe that dd /dev/mem still works on modern Linux kernels for full memory capture.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

LiME (Linux Memory Extractor)

LiME (Linux Memory Extractor) is the most appropriate tool for capturing volatile memory from a running Amazon Linux 2 EC2 instance without shutting it down. It is specifically designed to dump RAM contents to a file or over a network, minimizing the footprint on the target system and ensuring the integrity of the forensic acquisition.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
tcpdump
Why it's wrong here
tcpdump is a packet capture utility that uses libpcap and a BPF to inspect traffic on network interfaces. It only collects frames crossing the wire, not the contents of RAM, so it cannot provide the running processes, open sockets, or hidden kernel structures needed for memory forensics on a Linux host.
✗
Volatility
Why it's wrong here
Volatility is a post-mortem memory analysis framework; it parses and extracts artifacts from an existing memory image, such as a .lime or .raw file. It has no acquisition module and cannot send commands to a live kernel to dump RAM, so it must always be paired with a collector like LiME.
✓
LiME (Linux Memory Extractor)
Why this is correct
LiME is a loadable kernel module designed specifically for Linux memory acquisition. Loading it on the target system grants direct access to the kernel's physical address space, allowing a full RAM image to be written to a file or over the network; unloading it restores the system to a usable state.
✗
dd command to capture /dev/mem
Why it's wrong here
The dd command is a block-level copier designed for disks and partitions; using it on /dev/mem is not a viable memory acquisition path because strict kernel restrictions (CONFIG_STRICT_DEVMEM) block most physical address ranges, and the resulting copy is incomplete and lacks forensically meaningful metadata for analysis.

Go deeper

SCS-C02 Threat Detection and Incident Response Practice Question

Why each option matters

Option-by-option breakdown

Related to this question