SCS-C02 Threat Detection and Incident Response Practice Question
During an incident response, a security engineer needs to preserve the state of an EC2 instance for forensic analysis. The instance is running a production workload that cannot be interrupted. Which of the following actions should the engineer take FIRST to ensure data integrity?
⚠ Common exam trap
The trap here is that candidates often prioritize disk-level preservation (snapshots or AMIs) as the first step, forgetting that volatile memory contains critical evidence that is lost the moment the instance is stopped or snapshotted, and that AWS Systems Manager can capture this data without interrupting the workload.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Systems Manager Run Command to create a memory dump and store it in S3.
During an incident response, preserving volatile data (such as memory contents) is critical before any other action that might alter the system state. AWS Systems Manager Run Command can execute a command (e.g., using `dd` or `LiME`) to capture a memory dump and store it in Amazon S3 without interrupting the production workload. This ensures that forensic artifacts like running processes, network connections, and encryption keys are preserved before any disk-level operations that could overwrite or modify evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run the dd command to clone the root volume to another EBS volume.
Why it's wrong here
Running dd to clone the root volume to another EBS volume on a live instance performs an unsynchronized, block-level copy, which can capture torn writes and inconsistent filesystem metadata. This creates an unreliable forensic image because active writes are not coordinated, and it also fails to preserve volatile memory, which is often the most critical evidence in incident response. A proper acquisition would halt or freeze the filesystem first.
- ✗
Create an AMI from the instance while it is running.
Why it's wrong here
Creating an AMI from a running instance triggers EBS snapshots without pausing the operating system or flushing application buffers, so the resulting image can contain files whose writes are still in page cache and not yet durably stored. The AMI might therefore boot into a state where the filesystem journal is incomplete, meaning active data is missing or corrupted. Additionally, AMIs capture only disk state, never RAM, so any volatile evidence such as running processes or network connections is lost.
- ✗
Take a snapshot of the attached EBS volumes while the instance is running.
Why it's wrong here
Taking EBS snapshots of attached volumes while the instance is running provides only crash-consistent copies, since AWS does not quiesce the operating system or freeze I/O operations; snapshots may reflect a mix of old and new blocks that do not correspond to any single point in time. They are not application-consistent, so database or journal writes can be captured in a partially ordered state. More importantly, EBS snapshots only cover durable storage, leaving the contents of RAM entirely absent from the forensic collection.
- ✓
Use AWS Systems Manager Run Command to create a memory dump and store it in S3.
Why this is correct
AWS Systems Manager Run Command can invoke a memory acquisition utility on the live instance, such as one using the Linux kernel module LiME, to copy the contents of RAM to an EBS volume or S3 without requiring a reboot or instance stop. This preserves volatile evidence like loaded kernel modules, open network sockets, and running processes, which are essential for determining the scope of compromise. Storing the memory dump in S3 protects chain of custody if versioning and object lock are enabled, and it does not alter the underlying disk volumes.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.