Incident response plans, runbooks and preparation: SCS-C03 study notes and practice questions
What to know about Incident response plans, runbooks and preparation for the SCS-C03 exam, from the Incident Response domain (14% of the exam guide), then 2 free questions to test it. Part of the SCS-C03 study guide.
These questions describe a team that must respond to a security event and find that something essential is missing, such as logs, a contact or a way in that the attacker has not locked. You choose the preparation that closes the gap before the next event, and you avoid services that cannot be chosen for new work.
What to prepare
A response plan names roles, decision rights, escalation paths and communication channels. Runbooks turn each likely scenario, such as a leaked access key or a public bucket, into steps that someone can follow under pressure.
Logging before the event. An organization trail, GuardDuty, Security Hub and flow logs should already be running and writing to a log archive account. Logs turned on after an incident cannot show what happened before it.
A separate place to investigate. A forensics account or an isolated OU lets responders examine copies of evidence without the attacker’s credentials or your production roles. Prebuilt tooling, such as a hardened forensic image, saves time.
Break-glass access. An emergency role with MFA, usage alerts and a documented procedure lets responders act even when a federated identity or an admin role is compromised. Test it.
Contacts. Set the alternate security contact on every account so AWS can reach your team.
AWS Security Incident Response
AWS Security Incident Response is a managed service for security cases. You set up contacts and runbooks, and you can engage AWS incident responders for an active case. Choose it when the question wants managed case handling and access to AWS responders.
The AWS Security Incident Response Guide describes the phases: preparation, detection and analysis, containment, eradication and recovery, and post-incident activity.
How to choose
Scenario wording
Pick
Managed case handling with access to AWS incident responders
AWS Security Incident Response
A step-by-step procedure for each likely scenario
Written runbooks, or Systems Manager Automation documents
Keep investigation work away from production
A forensics account or isolated OU with a restrictive SCP
Logs available when an event starts
Organization trail and GuardDuty enabled before the event
Emergency access the compromise cannot lock out
Break-glass role with MFA and monitored use
Rehearse the plan before a real event
Tabletop exercise, then game days
Common traps
Writing the plan without enabling logging, so there is nothing to investigate.
One shared admin role for responders, which hides who did what.
Keeping the only break-glass credential in the account that is being compromised.
Choosing Systems Manager Incident Manager for a new build. It is closed to new customers. Use AWS Security Incident Response, or OpsCenter and Automation runbooks, instead.
Runbooks that terminate instances first, which destroys the memory and instance store evidence you need.
Leaving the security contact blank, so AWS cannot reach your team about a compromise.
A federal agency runs 25 AWS accounts. When a security incident occurs, responders must get administrator access to an affected account within 15 minutes. Responders may not hold long-term credentials, and every session must be traceable to one person.
The agency also keeps a forensic account for investigators. Some investigations run up to two hours, so a session must last that long without being renewed mid-task. Responders sign in through an external identity provider that requires multi-factor authentication.
Which solution meets these requirements?
Choose one answer.
AA. Create an IAM user with administrator access for each responder in each account, and store the users' long-term access keys in a secrets vault that responders open during an incident.
BB. Create a break-glass role in the forensic account that trusts the identity provider, and have responders chain from it into an administrator role in each affected account.
CC. Create one shared break-glass IAM user in each account, with its password and a hardware MFA token kept in the security office safe for responders to sign out.
DD. Pre-create a break-glass role in each account that trusts the agency SAML provider and allows two-hour sessions. Responders assume it through federated sign-in.
Show the answer and explanation
Answer: D
A. Wrong: Each key is tied to one responder, but access keys are long-term credentials, which the agency forbids for responders. Keys for 25 accounts would also have to be stored, rotated and protected between incidents.
B. Wrong: Role chaining caps the session at one hour, so a two-hour investigation would lose access mid-task. The chain also adds a hop before every account, which slows the first minutes of a response.
C. Wrong: A shared user cannot show which responder ran each session, so the traceability rule fails. Its password is also a long-term credential that responders would hold during an incident.
D. Right: Correct. The role exists before any incident, so access takes minutes, and each session carries the federated user's identity. The two-hour maximum session duration fits the longest investigation, and the identity provider enforces MFA at sign-in. Learn more: IAM roles (opens in a new tab)
Explanation
A break-glass role that is ready before any incident gives fast access, and federated sign-in ties each session to one person without long-term credentials. A two-hour maximum session duration matches the longest investigation, and the identity provider enforces MFA. Role chaining is capped at one hour, and per-responder keys or a shared user break the credential or traceability rules.
A bank's incident responders repeat the same log-analysis steps in every investigation. The security team wants those steps packaged as approved Jupyter notebooks that analysts run in a controlled environment. The notebooks read CloudTrail and VPC flow log archives from the log archive account, and no investigation data may leave AWS.
Analysts must run the approved notebooks without administrator rights, and the environment must be built the same way for every investigation. Any change to a notebook must be reviewed before analysts can use it.
Which approach should the security team use?
Choose one answer.
AA. Give each analyst an administrator role in the log archive account, and let analysts write notebooks on their laptops with whatever libraries and tools they choose, outside any shared review.
BB. Copy the log archives to each analyst workstation every morning, so that analysts can run the notebooks offline in their own tools without needing to reach AWS at all during the work.
CC. Run reviewed notebooks from a version-controlled repository on a SageMaker AI notebook instance in a private subnet, with VPC endpoints, internet access off and a read-only role.
DD. Run the notebooks on a notebook instance with direct internet access turned on, so that the team can install new libraries and tools whenever it needs them during an investigation.
Show the answer and explanation
Answer: C
A. Wrong: Administrator rights break the least-privilege rule, and laptop setups cannot be built the same way each time. Notebooks written on laptops would also skip the review that the team requires before use.
B. Wrong: Copying the archives moves sensitive data out of the controlled account, which the requirements forbid. Each workstation would also drift from the others over time, so the investigations would not share one environment.
C. Right: Correct. Version control and review keep only approved notebooks in use, and the instance can be rebuilt the same way each time. With internet access off and VPC endpoints in place, the data stays inside AWS, and the read-only role limits what analysts can do. Learn more: Amazon SageMaker AI notebook instances (opens in a new tab)
D. Wrong: Direct internet access lets investigation data leave the environment, which the requirements rule out. Installing libraries from the internet also makes each environment different from the last.
Explanation
A controlled notebook environment keeps data inside AWS, uses a read-only role, and is rebuilt from code and reviewed notebooks. Administrator laptops, copied archives and open internet access each break one of the stated requirements.
Want more on Incident response plans, runbooks and preparation? The 5 full-length practice sets have 7 more Incident response plans, runbooks and preparation questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Incident response plans, runbooks and preparation