SCS-C02 Threat Detection and Incident Response Practice Question
During incident response, a security engineer needs to preserve the state of a running EC2 instance for forensic analysis without losing volatile data. The instance is in an Auto Scaling group. Which action should the engineer take FIRST?
⚠ Common exam trap
Watch out — candidates often choose to stop the instance or take an AMI first, not realizing that those actions destroy volatile data or require a stable state, whereas the correct first step is to prevent the Auto Scaling group from interfering with the running instance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Suspend the `HealthCheck` and `ReplaceUnhealthy` processes on the Auto Scaling group.
Suspending the `HealthCheck` and `ReplaceUnhealthy` processes on the Auto Scaling group prevents the group from detecting the instance as unhealthy and terminating it while the engineer preserves volatile data. This is the first step to ensure the instance remains running and accessible for forensic collection (e.g., memory dump) before any other actions that could alter its state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Detach the instance from the Auto Scaling group.
Why it's wrong here
Detaching from the Auto Scaling group does not itself preserve volatile data; the instance keeps running and memory decays, and the group may still act. Detachment is correct when you need to keep an instance alive outside scaling policies, not as the first forensic preservation step.
- ✗
Stop the instance to preserve its EBS volumes.
Why it's wrong here
Stopping the instance discards RAM and all volatile state, which is exactly what forensic analysis needs to retain. Stopping suits cost control or resizing EBS-backed instances, but here it destroys the evidence the engineer must capture before any shutdown or snapshot.
- ✗
Take an AMI of the instance immediately.
Why it's wrong here
An AMI captures only the EBS volume state and cannot preserve volatile memory such as RAM, running processes or network connections. AMIs are the right tool for golden-image backups or launching replacement instances, not for live forensic capture where volatile data must survive.
- ✓
Suspend the `HealthCheck` and `ReplaceUnhealthy` processes on the Auto Scaling group.
Why this is correct
Suspending HealthCheck and ReplaceUnhealthy stops the Auto Scaling group terminating or replacing the instance while it is isolated for forensics. This preserves volatile memory and disk state, which would otherwise be lost if the group launched a replacement.
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.