SCS-C02 Threat Detection and Incident Response Practice Question
During an incident response, a security engineer needs to preserve the state of an EC2 instance's root volume for forensic analysis. The instance is still running. Which action should be taken to ensure the data is preserved without altering it?
⚠ Common exam trap
Candidates often think stopping the instance (Option A) is necessary to ensure data consistency, but they overlook that stopping alters the system state and that a snapshot of a running instance is still a valid, unaltered point-in-time copy for forensic purposes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a snapshot of the root volume.
Creating a snapshot of the root volume is the correct action because it captures a point-in-time, crash-consistent copy of the volume's data without requiring the instance to be stopped or the volume to be detached. This preserves the current state of the running instance for forensic analysis while ensuring the data is not altered by the snapshot process itself, as AWS snapshots are read-only and do not modify the source volume.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Stop the instance and then create an AMI.
Why it's wrong here
Stopping the instance triggers a graceful OS shutdown that runs shutdown scripts and flushes caches, thereby altering the very state that is the subject of the incident investigation and potentially destroying ephemeral evidence. Moreover, creating an AMI packages the OS image for deployment rather than capturing a pristine forensic copy, and stopping the instance changes the instance state, which could impact legal or chain-of-custody requirements.
- ✓
Create a snapshot of the root volume.
Why this is correct
A snapshot is a point-in-time, crash-consistent copy of the EBS root volume that preserves the current on-disk state without stopping or detaching the instance. Taking a snapshot is the standard forensic first step because it is non-intrusive, does not trigger shutdown scripts, and keeps the original volume intact for later analysis while the snapshot can be inspected on a separate examination instance.
- ✗
Use dd if=/dev/xvda over SSH to copy the volume.
Why it's wrong here
Using dd to stream the raw block device over SSH while the instance is running produces a copy that is neither crash-consistent nor verifiable, because concurrent writes from the OS can alter the volume mid-copy and network transfer injects latency. Additionally, this approach is slow, consumes high bandwidth, and, unlike a snapshot, provides no built-in integrity verification such as SHA-256 hashing of the resulting EBS volume.
- ✗
Detach the root volume and attach it to a forensics instance.
Why it's wrong here
Detaching a root volume from a running EC2 instance forces the block device to be unmounted while buffers and page cache have not been flushed, which can leave the file system in an inconsistent state and render the evidence unreliable. A proper forensic acquisition should always snapshot the volume first, then optionally detach the original or attach the snapshot copy to a dedicated forensics instance for an orderly, read-only analysis.
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.