The answer is to create IAM roles with limited permissions for incident responders, enable AWS CloudTrail in all regions, and automate the isolation of compromised resources. These three actions are foundational because they ensure that responders have only the necessary access to investigate and contain an incident without risking further exposure, while multi-region CloudTrail provides a complete audit trail of all API calls across the entire AWS infrastructure, preventing an attacker from operating undetected in an unmonitored region. On the AWS Certified Security Specialty SCS-C02 exam, this question tests your understanding of the principle of least privilege in incident response and the necessity of comprehensive logging for forensic analysis—a common trap is selecting overly permissive roles or forgetting that CloudTrail must be enabled globally, not just in the primary region. Remember the memory tip: “Least privilege, log everywhere, automate containment.”
SCS-C02 Threat Detection and Incident Response Practice Question
This SCS-C02 practice question tests your understanding of threat detection and incident response. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which THREE actions should be taken when preparing an incident response plan for AWS?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable AWS CloudTrail in all regions.
AWS CloudTrail must be enabled in all regions to ensure that all API calls across the entire AWS infrastructure are logged. This provides a comprehensive audit trail essential for forensic investigation and identifying the scope of a security incident. Without multi-region CloudTrail, an attacker could operate in an unmonitored region, leaving no trace for incident responders.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Enable AWS CloudTrail in all regions.
Why this is correct
CloudTrail provides a log of all API calls for investigation.
Related concept
Read the scenario before looking for a memorised answer.
✗
Share the AWS account root user password with the incident response team.
Why it's wrong here
Root access should be avoided and shared credentials are insecure.
✓
Automate incident response using AWS Systems Manager Automation runbooks.
Why this is correct
Automation ensures consistent and rapid response.
Related concept
Read the scenario before looking for a memorised answer.
✗
Disable VPC Flow Logs to reduce log volume.
Why it's wrong here
Flow logs provide valuable network traffic data for investigation.
✓
Create IAM roles with limited permissions for incident responders.
Why this is correct
Roles allow access without sharing long-term credentials.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may think sharing the root password is acceptable for emergency access, but AWS explicitly prohibits this and recommends using IAM roles with break-glass procedures instead.
Detailed technical explanation
How to think about this question
CloudTrail logs are delivered to an S3 bucket, and enabling multi-region trails ensures that management events from all regions are captured in a single log stream. Incident response automation via Systems Manager Automation runbooks can execute pre-approved response actions, such as isolating an EC2 instance by modifying security group rules, without requiring manual intervention. IAM roles for incident responders should be scoped to read-only access for investigation and specific write actions (e.g., stopping instances) to contain threats, following the principle of least privilege.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Threat Detection and Incident Response — This question tests Threat Detection and Incident Response — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Enable AWS CloudTrail in all regions. — AWS CloudTrail must be enabled in all regions to ensure that all API calls across the entire AWS infrastructure are logged. This provides a comprehensive audit trail essential for forensic investigation and identifying the scope of a security incident. Without multi-region CloudTrail, an attacker could operate in an unmonitored region, leaving no trace for incident responders.
What should I do if I get this SCS-C02 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.