ExamPark
Course menuSCS-C03

Exams / SCS-C03 / Forensic evidence capture and preservation / Question 1

SCS-C03 practice question: Forensic evidence capture and preservation

Incident Response A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A healthcare SaaS company gets a GuardDuty finding that a production EC2 instance is contacting a known command-and-control server. The instance runs a patient-scheduling service. It must not be stopped or rebooted, because malware that exists only in memory must be preserved for analysis.

The responder can reach the instance only through AWS Systems Manager Run Command, which needs outbound access to the Systems Manager endpoints. The isolation security group that the team plans to use blocks all outbound traffic. The responder must also preserve the EBS volumes and record the case number on the instance.

Which sequence of steps should the responder follow?

Choose one answer.

  1. A. Stop the instance to freeze its state, snapshot the EBS volumes, capture a memory image from the stopped disk, and then tag the instance with the case number.
  2. B. Swap the instance to the isolation security group, capture memory with Run Command, snapshot the EBS volumes, and then tag the instance with the case number.
  3. C. Tag the instance with the case number, capture memory with Run Command, then swap to the isolation security group and snapshot the EBS volumes.
  4. D. Snapshot the EBS volumes and tag the case first, then swap to the isolation group, and skip the memory capture because the disks hold the evidence.
Show the answer and explanation

Answer: C

  • A. Wrong: Stopping the instance breaks the rule that it must not be stopped, and it clears the memory that must be preserved. A disk snapshot cannot recover the process state that existed in memory.
  • B. Wrong: Once the isolation group blocks all outbound traffic, Systems Manager Run Command cannot reach its endpoints, so the memory capture would fail. The capture has to run before the swap.
  • C. Right: Correct. Tagging records the case, and the memory capture runs while Run Command can still reach the instance. The swap then cuts the command-and-control traffic, and the snapshots preserve the disks without stopping the service. Learn more: Run Command in Systems Manager (opens in a new tab)
  • D. Wrong: Disk snapshots miss malware that exists only in memory, and they do not hold the running process state. Skipping the memory capture breaks the requirement to preserve it.

Explanation

Memory is volatile, so it is captured first while the responder can still reach the instance. Isolation then stops the traffic, and snapshots preserve the disks without stopping the service. Stopping the instance, isolating before the capture and skipping memory each break a stated constraint.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free SCS-C03 practice examPractice Forensic evidence capture and preservationAll Forensic evidence capture and preservation questions

Want more on Forensic evidence capture and preservation? The 5 full-length practice sets have 8 more Forensic evidence capture and preservation questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets