SCS-C02 Threat Detection and Incident Response Practice Question
During incident response, a security engineer needs to preserve the state of a running EC2 instance for forensic analysis without losing volatile data. The instance is in an Auto Scaling group. Which action should the engineer take FIRST?
⚠ Common exam trap
Watch out — candidates often choose to stop the instance or take an AMI first, not realizing that those actions destroy volatile data or require a stable state, whereas the correct first step is to prevent the Auto Scaling group from interfering with the running instance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Suspend the `HealthCheck` and `ReplaceUnhealthy` processes on the Auto Scaling group.
Suspending the `HealthCheck` and `ReplaceUnhealthy` processes on the Auto Scaling group prevents the group from detecting the instance as unhealthy and terminating it while the engineer preserves volatile data. This is the first step to ensure the instance remains running and accessible for forensic collection (e.g., memory dump) before any other actions that could alter its state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Detach the instance from the Auto Scaling group.
Why it's wrong here
May cause Auto Scaling to launch a replacement instance, but the original instance is still at risk of termination.
- ✗
Stop the instance to preserve its EBS volumes.
Why it's wrong here
Stopping loses memory.
- ✗
Take an AMI of the instance immediately.
Why it's wrong here
AMI does not capture memory.
- ✓
Suspend the `HealthCheck` and `ReplaceUnhealthy` processes on the Auto Scaling group.
Why this is correct
Prevents Auto Scaling from interfering with the instance.
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.