Chapter 2 of 6 · AWS SCS-C03
Incident Response
Planning and testing, automated response, compromised credentials, workload forensics and investigation.
- 5topics
- 27 minfast track
- 3diagrams and exhibits
- 14%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Incident Response Plan and TestingDesign an AWS incident response plan with phases, roles, ready access, runbooks and Incident Manager, then test it with tabletop…5 min
- 2Automated Response and RemediationBuild automated security response with EventBridge, Systems Manager Automation, Lambda, Step Functions and Config remediation…Diagram5 min
- 3Responding to Compromised CredentialsContain exposed IAM user keys, role session credentials, instance profile credentials and root access, then hunt for persistence…Diagram6 min
- 4Compromised Workload ForensicsIsolate and preserve a compromised EC2 instance, container or Lambda function, capture snapshots and memory, and analyse evidence…Diagram6 min
- 5Investigating Security EventsInvestigate AWS security events by correlating CloudTrail, Athena, CloudTrail Lake, Detective, flow logs and Access Analyzer…5 min
About this chapter
What this chapter covers
Incident response is what you do when detection tells you that something has gone wrong.
The chapter has two parts that follow the exam outline. The first is designing and testing a response plan before anything happens. The second is responding to real security events, which includes containing the problem, preserving evidence, finding the cause and recovering.
The chapter follows the Incident Response domain of the AWS Certified Security Specialty SCS-C03 exam. Five pages cover its two outline topics.
How the topics fit together
The plan sets up the people, access and automation, and the response pages use them on specific kinds of incident.
- The plan names roles, creates ready access and sets up Incident Manager.
- Automation performs the safe first steps quickly and the same way every time.
- Credential incidents are handled with key deactivation, session revocation and a hunt for persistence.
- Workload incidents are handled with isolation, snapshots, memory capture and a forensic account.
- Investigation uses CloudTrail, Athena, flow logs and Detective to find scope and cause.
Exam answers in this chapter usually favour actions that contain a problem while keeping evidence, such as isolate and snapshot instead of terminate.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Read the pages in order, because the later ones assume the vocabulary of the plan page. If you can, practise the key containment commands in a sandbox account, such as deactivating a test key and isolating a test instance.
Ready for more practice?
The full AWS SCS-C03 question bank has 858 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.