The correct first step is to isolate the compromised EC2 instance by modifying its security group to remove all inbound and outbound rules except for the forensic analysis instance. This approach directly contains the threat by cutting off all network communication to Tor exit nodes and the internet while preserving a controlled, single-path channel for investigation, which is critical since the instance cannot be terminated. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding of the "isolate first, investigate later" incident response principle, often appearing as a trap where candidates might jump to snapshotting or disabling GuardDuty instead of using security groups for immediate containment. Remember that security groups act as a virtual firewall—revoking all rules except for a trusted forensic source is the fastest, reversible way to stop malicious outbound traffic without losing the instance. A useful memory tip is "SG isolation before termination hesitation," emphasizing that security group modification is your first containment tool when termination is off the table.
SCS-C02 Threat Detection and Incident Response Practice Question
This SCS-C02 practice question tests your understanding of threat detection and incident response. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Your company has a single AWS account with a production VPC that contains several EC2 instances running a web application. The security team has enabled Amazon GuardDuty and AWS CloudTrail. Recently, GuardDuty reported a finding 'UnauthorizedAccess:EC2/TorClient' for one of the instances. The finding indicates that the instance is making connections to Tor exit nodes. You need to investigate and contain the incident. The instance is critical to the application and cannot be terminated. You have a forensic analysis instance in a separate security group. What should you do FIRST?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "first"
Why it matters: Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the instance by modifying its security group to remove all inbound and outbound rules except for the forensic analysis instance.
Option A is correct because the first step in incident response for a compromised instance that cannot be terminated is to contain the threat by isolating it from the network. Modifying the security group to remove all inbound and outbound rules except for a specific forensic analysis instance prevents the compromised EC2 instance from communicating with Tor exit nodes or other external hosts, while still allowing controlled forensic access. This containment is immediate and reversible, aligning with the AWS incident response best practice of 'isolate first, investigate later'.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Isolate the instance by modifying its security group to remove all inbound and outbound rules except for the forensic analysis instance.
Why this is correct
Isolation stops exfiltration and allows safe investigation.
Clue confirmation
The clue word "first" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Terminate the instance immediately and launch a replacement.
Why it's wrong here
Termination causes downtime and loses forensic data.
✗
Take an EBS snapshot of the instance's root volume for analysis.
Why it's wrong here
Snapshot is good but should be done after isolation.
✗
Use AWS Systems Manager Run Command to install a forensic agent on the instance.
Why it's wrong here
Installing agent may not be safe if instance is compromised.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may rush to collect forensic evidence (snapshot or agent) before containing the threat, failing to recognize that the first priority in incident response is to stop the active malicious behavior (outbound Tor connections) to prevent data exfiltration or further compromise.
Detailed technical explanation
How to think about this question
Security groups act as a stateful virtual firewall at the EC2 instance level. By removing all outbound rules, the instance's traffic is dropped immediately without requiring a restart, effectively cutting off communication to Tor exit nodes (which typically use ports 9001, 9030, or 443). The forensic analysis instance can be granted access via a separate security group rule that allows inbound traffic only from that specific instance's private IP or security group ID, ensuring a controlled investigation path.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Threat Detection and Incident Response — This question tests Threat Detection and Incident Response — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Isolate the instance by modifying its security group to remove all inbound and outbound rules except for the forensic analysis instance. — Option A is correct because the first step in incident response for a compromised instance that cannot be terminated is to contain the threat by isolating it from the network. Modifying the security group to remove all inbound and outbound rules except for a specific forensic analysis instance prevents the compromised EC2 instance from communicating with Tor exit nodes or other external hosts, while still allowing controlled forensic access. This containment is immediate and reversible, aligning with the AWS incident response best practice of 'isolate first, investigate later'.
What should I do if I get this SCS-C02 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "first". Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.