SCS-C02 Threat Detection and Incident Response Practice Question
Your company has a single AWS account with a production VPC that contains several EC2 instances running a web application. The security team has enabled Amazon GuardDuty and AWS CloudTrail. Recently, GuardDuty reported a finding 'UnauthorizedAccess:EC2/TorClient' for one of the instances. The finding indicates that the instance is making connections to Tor exit nodes. You need to investigate and contain the incident. The instance is critical to the application and cannot be terminated. You have a forensic analysis instance in a separate security group. What should you do FIRST?
⚠ Common exam trap
The trap here is that candidates may rush to collect forensic evidence (snapshot or agent) before containing the threat, failing to recognize that the first priority in incident response is to stop the active malicious behavior (outbound Tor connections) to prevent data exfiltration or further compromise.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the instance by modifying its security group to remove all inbound and outbound rules except for the forensic analysis instance.
The first step in incident response for a compromised instance that cannot be terminated is to contain the threat by isolating it from the network. Modifying the security group to remove all inbound and outbound rules except for a specific forensic analysis instance prevents the compromised EC2 instance from communicating with Tor exit nodes or other external hosts, while still allowing controlled forensic access. This containment is immediate and reversible, aligning with the AWS incident response best practice of 'isolate first, investigate later'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Isolate the instance by modifying its security group to remove all inbound and outbound rules except for the forensic analysis instance.
Why this is correct
This is the correct immediate response because modifying the security group to remove all inbound and outbound rules—except for a single forensic analysis instance—instantly severs the attacker's network channel while preserving the running instance for investigation. It halts data exfiltration in real time and prevents the attacker from issuing further commands over the network, unlike a snapshot that captures disk state but does not stop ongoing activity. The isolated instance retains volatile evidence like process memory and active network connections, which a forensic analyst can later harvest using controlled, trusted access.
- ✗
Terminate the instance immediately and launch a replacement.
Why it's wrong here
Terminating the instance immediately is wrong because it is a destructive action that by default deletes the root volume, destroying all disk-based evidence such as malware binaries, logs, and attacker scripts, along with any memory-resident data. It also causes an immediate production outage without first containing the compromise, which is premature because the incident response team has not yet preserved the system state or determined the blast radius. Launching a replacement from a clean AMI may restore service, but it forfeits the forensic artifacts needed to identify the root cause and prevent recurrence.
- ✗
Take an EBS snapshot of the instance's root volume for analysis.
Why it's wrong here
Taking an EBS snapshot is a reasonable forensic step, but it is wrong as the first action because it does not contain the live compromise—an attacker can continue to exfiltrate data and move laterally while the snapshot is being taken. A snapshot only captures the disk at a point in time and misses memory, open network sockets, and running processes, so it provides an incomplete picture of the incident. It should be performed after isolating the instance, as part of a documented evidence collection process, not as a substitute for immediate containment.
- ✗
Use AWS Systems Manager Run Command to install a forensic agent on the instance.
Why it's wrong here
Using SSM Run Command to install a forensic agent on a potentially compromised instance is risky because the instance's integrity is already suspect; an attacker with root or elevated privileges could have tampered with the SSM agent, its certificates, or the instance's IAM role, meaning the command may be modified or the agent may exfiltrate the forensic tooling. Installing software also writes new files and changes system state, potentially overwriting the very evidence you are trying to collect. In incident response, you must never trust a compromised host to execute your tools; instead, isolate it and analyze a snapshot or attached volume from a separate, trusted forensic instance.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.