Containing, eradicating and recovering from security events: SCS-C03 study notes and practice questions
What to know about Containing, eradicating and recovering from security events for the SCS-C03 exam, from the Incident Response domain (14% of the exam guide), then 1 free question to test it. Part of the SCS-C03 study guide.
These questions describe an active event and ask which single action stops it fastest without causing more damage. The right answer matches the scope of the threat, whether that is one credential, one instance, one network path, one account or public data, and it keeps logs and evidence available for the investigation that follows.
Options by scope
Credentials. Disable an access key rather than deleting it, so its CloudTrail history stays linked to the key. To invalidate temporary sessions that a role already issued, attach an inline deny policy that denies everything for sessions issued before a chosen time, using the aws:TokenIssueTime condition. Rotate any secret the attacker may have read in Secrets Manager.
Instances. Move the instance to a quarantine security group. Add a network ACL deny when existing connections must end, because network ACLs are stateless and apply to traffic on established flows.
Network paths. Block a malicious address in a network ACL or Network Firewall rule. Block web traffic with an AWS WAF rule and malicious DNS names with a DNS Firewall block list.
Data exposure. Turn on S3 Block Public Access at the account level to stop public reads at once, then review what was exposed.
Accounts. Move the affected account into a quarantine OU with a restrictive SCP. Keep the SCP’s exceptions for logging and security services, so the investigation can continue.
Stop instances carefully
Stopping an instance ends the attacker’s processes, but it also loses memory and instance store data. Take snapshots first, as described in the forensics topic. Terminating is almost never the right containment step, because it destroys evidence and removes the instance from the investigation.
How to choose
Scenario wording
Pick
Stop a leaked access key from working now
Disable the key, then review its use in CloudTrail
End sessions that a role issued before a point in time
Deny policy with aws:TokenIssueTime
Isolate one instance and keep it running
Quarantine security group, with a network ACL deny if sessions persist
Block one malicious address at the subnet level
Network ACL deny rule
Stop a compromised member account from acting
Move the account to a quarantine OU with a restrictive SCP
Stop public exposure of S3 data immediately
S3 Block Public Access at the account level
The compromised account is the management account
SCPs do not apply there; secure root access and credentials instead
Common traps
Deleting the access key or the user, which removes the record the investigation needs.
Terminating a compromised instance as the first step.
Changing a security group and expecting all connections to end. Existing tracked connections can continue, and a network ACL deny ends them.
Using an SCP to contain the management account. SCPs do not restrict the management account.
Stopping an instance before taking snapshots.
Blocking at WAF when the threat is outbound traffic from an instance, which WAF never sees.
A fintech company's GuardDuty alert shows an EC2 instance in a shared application subnet, 10.20.4.0/24, sending traffic to a known malicious IP address. The subnet also holds 30 other instances that must stay online, and the instance must keep running for forensics.
The team's runbook applies the instance-level control first, then uses the subnet network ACL only to cut connections that the instance-level change leaves open. The engineer must be able to restore the original settings later, and must confirm the result in the logs.
Put these steps in the order the team should do them, first step first.
Put these 4 steps in order.
AA. Add a network ACL deny rule for the instance's private IP address, as a /32 rule with a number lower than the subnet allow rules, to cut off connections that are already open.
BB. Record the instance ID, its network interface ID and the IDs of its current security groups in the case file.
CC. Create an isolation security group with no inbound or outbound rules, and attach it to the instance's network interface in place of the existing groups.
DD. Check the VPC flow logs for rejected traffic from the instance address, and confirm that no new connections from it are accepted.
Show the answer and explanation
Correct order: B, C, A, D
B. Record the instance ID, its network interface ID and the IDs of its current security groups in the case file. First: the team records the original settings before it changes anything, so the isolation can be reversed later. The identifiers also go into the evidence record for the case.
C. Create an isolation security group with no inbound or outbound rules, and attach it to the instance's network interface in place of the existing groups. Second: the runbook applies the instance-level control first, and the swap stops new traffic from the instance. It does not end connections that are already tracked, so a network ACL step is still needed.
A. Add a network ACL deny rule for the instance's private IP address, as a /32 rule with a number lower than the subnet allow rules, to cut off connections that are already open. Third: changing a security group does not end connections that are already tracked, so the runbook uses the network ACL next. A /32 rule removes only this instance from the subnet traffic, so the other 30 instances keep working.
D. Check the VPC flow logs for rejected traffic from the instance address, and confirm that no new connections from it are accepted. Fourth: the flow logs confirm the result only after the isolation is in place. Checking earlier would show traffic that is still being allowed.
Explanation
Isolation starts by recording the original settings so they can be restored. The security group swap blocks new traffic, and a targeted /32 network ACL deny then cuts the tracked connections that the swap leaves open. Flow logs confirm that the traffic is rejected.
Want more on Containing, eradicating and recovering from security events? The 5 full-length practice sets have 8 more Containing, eradicating and recovering from security events questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Containing, eradicating and recovering from security events