2.0 Incident Response SCS-C03 Practice Quiz

• A. Triage steps, severity criteria, affected-resource identification, containment actions, and evidence preservation
• B. Immediate termination of every EC2 instance in the account
• C. Only a link to the GuardDuty console with no response steps
• D. A request to disable CloudTrail during investigation

A useful incident runbook starts by turning the finding into a scoped, prioritized workflow that preserves evidence before destructive changes occur.

• A. How findings create OpsItems, required context fields, assignment, escalation, and linked automation documents
• B. Use OpsCenter only as a generic bookmark folder
• C. Place production credentials in OpsItem descriptions
• D. Create OpsItems manually only after all remediation is complete

OpsCenter is most effective when incident intake, ownership, context, and automation links are defined before incidents occur.

• A. The same containment command for every incident type
• B. Roles, severity model, communication path, evidence handling, escalation triggers, and closure criteria
• C. A requirement to wait for business hours before any response
• D. A policy to delete raw evidence after summary writing

Common response structure keeps incident execution consistent while allowing technical steps to differ by incident type.

• A. Store every user prompt publicly for community analysis
• B. Detection inputs, guardrail outcomes, abuse-scoping steps, model access review, and safe evidence handling
• C. Treat all model refusals as successful attacks
• D. Disable all application authentication to reproduce abuse

GenAI incident response needs application-specific evidence, control outcomes, and user or identity scope without overcollecting sensitive prompts.

• A. A blank template that responders fill in after closure
• B. Current state summary, completed actions, open hypotheses, evidence locations, and next decisions
• C. Only a list of AWS service names with no actions
• D. A requirement that the original responder stay online indefinitely

Shift handoff needs operational context that prevents repeated work and preserves decision continuity.

• A. Delete the IAM user and all CloudTrail records immediately
• B. Rotate unrelated KMS keys before confirming the principal's actions
• C. Deactivate the access key, preserve CloudTrail activity, and investigate recent API calls by the principal
• D. Open administrator access to all responders by default

Disabling the key limits further use while CloudTrail evidence identifies scope, actions, and resources affected.

• A. Runbooks edited only in an untracked chat thread
• B. A plan that depends entirely on one engineer's memory
• C. Version-controlled runbooks with approvals, test history, and mapped evidence requirements
• D. A single emergency role with no logging requirement

Auditable runbooks need change history, governance, and proof that procedures are tested and aligned to evidence needs.

• A. Disable S3 Versioning after the first suspicious delete
• B. Make the bucket public so external analysts can inspect it quickly
• C. Delete lifecycle and access logs to reduce storage charges
• D. Steps to isolate write paths, preserve object versions, review access logs, and validate clean recovery points

S3 ransomware response depends on stopping destructive writes, retaining object history, and recovering from trusted versions or backups.