SCS-C03 · Domain 2 of 6

SCS-C03 Domain 2: Incident Response

Domain 2 covers what happens after a finding: preparing and testing a response plan, automating remediation, preserving forensic evidence, containing and recovering affected resources and finding the root cause.

Exam weight
14%
Official task statements
2
Estimated questions estimate
~7
Suggested study time estimate
10–14 hrs

About 11 min read Reviewed October 2026

Overview

Incident Response has two task statements. Task 2.1 is about preparation: writing response plans and runbooks (for example in Systems Manager OpsCenter or SageMaker AI notebooks), preparing services before anything happens by provisioning access, deploying security tools, limiting blast radius and configuring Shield Advanced, testing the plan with AWS Fault Injection Service and AWS Resilience Hub, and automating remediation with Systems Manager, Step Functions, Lambda, Application Recovery Controller and the Automated Forensics Orchestrator for Amazon EC2.

Task 2.2 is about the live event: capturing logs as forensic artifacts, searching and correlating logs across services, validating findings to judge scope and impact, containing and eradicating the threat, restoring from backups, and using Amazon Detective for root cause analysis. Validating findings is new in SCS-C03; in SCS-C02, response shared a domain with threat detection.

How it's tested

Domain 2 questions usually open with a finding, an alert or a suspicious event and ask for the next action, the best automation or the right preparation. Sequence and evidence handling decide the answer more often than service knowledge alone.

  • Next best action

    A compromise is confirmed and you choose the first or next step, weighing evidence preservation against speed of containment.

  • Automate the runbook

    A repeated manual response is described, and you choose EventBridge with Lambda, Step Functions or Systems Manager Automation to run it.

  • Be ready in advance

    Before any incident, you pick the preparation that shortens response, such as pre-provisioned access, forensic accounts or Shield Advanced.

Reasoning it through

GuardDuty reports an EC2 instance contacting a known command-and-control server. Terminating it ends the threat but loses memory and disk evidence. The stronger sequence is to tag the instance, replace its security group with one that allows no traffic, detach it from the Auto Scaling group, snapshot its EBS volumes and capture memory, and then investigate copies in an isolated forensic account.

Task statements 2

Official task statements from the Amazon Web Services outline, in outline order.

2.1 Design and test an incident response planRunbooks, incident readiness, plan testing and automated remediation.
What it means
This task statement covers designing response plans and runbooks, configuring services so they are ready before an incident (access provisioning, security tooling, blast-radius limits, Shield Advanced protections), recommending ways to test a plan with Fault Injection Service and Resilience Hub, and remediating automatically with Systems Manager, Automated Forensics Orchestrator for Amazon EC2, Step Functions, Application Recovery Controller and Lambda.
What to understand
Preparation is concrete work: a dedicated forensic account, pre-approved break-glass or responder roles, IAM Identity Center permission sets for responders, isolation security groups created in advance and a separate account structure that limits blast radius. Systems Manager Automation runbooks and Step Functions workflows turn written procedures into repeatable actions triggered by EventBridge rules on findings. Fault Injection Service runs controlled experiments to see whether detection and response actually work, and Resilience Hub assesses recovery targets. Shield Advanced adds DDoS response team access and cost protection.
How it shows up
Watch for words like repeatable, consistent or least manual effort; they point to automation runbooks rather than a person following a document.
Common confusion
Thinking a written plan is enough; SCS-C03 expects the plan to be tested through simulations or fault injection.
2.2 Respond to security eventsForensic capture, log correlation, finding validation, containment, recovery and root cause.
What it means
This task statement covers capturing system and application logs as forensic artifacts, searching and correlating logs across applications and AWS services, validating findings from AWS security services to judge scope and impact, containing and eradicating threats and recovering resources through network containment and backup restores, and describing root cause analysis methods such as Amazon Detective.
What to understand
Evidence first: snapshot EBS volumes, capture memory if required, copy logs to a write-protected bucket and record hashes. Containment for EC2 means swapping to an isolation security group, removing it from load balancers and Auto Scaling, and revoking active role sessions; for IAM it means deactivating keys and adding a deny policy that revokes older sessions. Validate a finding against CloudTrail, Flow Logs and Detective before widening the response. Detective builds behavior graphs from CloudTrail, Flow Logs and GuardDuty to show related entities over time.
How it shows up
Expect a choice between fast but destructive actions and slightly slower ones that keep evidence; keep the evidence unless the scenario says otherwise.
Common confusion
Assuming a security group change instantly drops tracked connections; established flows can persist, so plan isolation with that in mind.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Isolation security group

    A group with no inbound or outbound rules applied to a suspect instance.

    Remember
    Established tracked connections can outlive a rule change.
    Tested as
    EC2 containment questions.
    Trap
    Relying on a network ACL alone without considering subnet-wide impact.

  • EBS snapshot for forensics

    Point-in-time copy of a volume taken before changes.

    Remember
    Share or copy to a forensic account for analysis.
    Tested as
    Evidence preservation.
    Trap
    Terminating the instance first.

  • Memory capture

    Collecting volatile memory before shutdown.

    Remember
    Lost on stop or terminate.
    Tested as
    Advanced forensics scenarios.
    Trap
    Stopping the instance to save money.

  • Revoke active sessions

    IAM option that denies credentials issued before a time.

    Remember
    Needed because deleting a key does not end assumed-role sessions.
    Tested as
    Credential compromise response.
    Trap
    Only rotating the access key.

  • Amazon Detective

    Builds behavior graphs from CloudTrail, Flow Logs and GuardDuty findings.

    Remember
    Used for investigation and root cause.
    Tested as
    Root cause analysis.
    Trap
    Expecting it to block or remediate.

  • Systems Manager Automation runbooks

    Predefined or custom documents that execute response steps.

    Remember
    Can be triggered by EventBridge.
    Tested as
    Automated remediation.
    Trap
    Writing a new Lambda when a runbook exists.

  • Step Functions for response

    Orchestrates multi-step workflows with branching and approvals.

    Remember
    Good for evidence capture then containment sequences.
    Tested as
    Complex automation.
    Trap
    Using one long Lambda instead.

  • AWS Fault Injection Service

    Runs controlled fault experiments against workloads.

    Remember
    Tests whether detection and response work.
    Tested as
    Plan testing questions.
    Trap
    Confusing it with a penetration test tool.

  • Forensic account

    Separate isolated account where evidence is analyzed.

    Remember
    Limits contamination and blast radius.
    Tested as
    Preparation questions.
    Trap
    Analyzing evidence in the compromised account.

  • Shield Advanced

    Enhanced DDoS protection with response team access and cost protection.

    Remember
    Configure before an attack.
    Tested as
    DDoS readiness.
    Trap
    Assuming Shield Standard includes the response team.

  • Validate the finding

    Confirm scope and impact using other logs before escalation.

    Remember
    New SCS-C03 skill 2.2.3.
    Tested as
    Triage scenarios.
    Trap
    Acting on a single finding as complete truth.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Response actions for a compromised EC2 instance

ConceptMeaningKey differenceCommon trap
Isolation security group Blocks all traffic to and from the instance Keeps the instance and evidence intact Editing the existing group instead
Snapshot and memory capture Preserves disk and volatile state Must happen before stop or terminate Doing it after rebooting
Terminate Removes the instance Destroys evidence Choosing it as the first step

Investigation and automation tools

ConceptMeaningKey differenceCommon trap
Amazon Detective Visual investigation over related activity Root cause and scope Using it for remediation
Systems Manager Automation Runs scripted response steps Acts on resources Expecting analysis from it
Step Functions Orchestrates multiple steps Sequencing with error handling Using it for simple one-step tasks
Fault Injection Service Runs controlled failures Tests readiness Running it during a live incident

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Terminate first

    What candidates pick
    Terminate the instance immediately to stop the attack.
    Why it looks right
    It ends the threat quickly.
    Why it's wrong
    Termination destroys memory and possibly disk evidence needed to find the root cause and other affected resources.

    Clue to watch for The scenario mentions investigation, forensics or legal requirements.

  2. Delete key only

    What candidates pick
    Delete the exposed access key and close the incident.
    Why it looks right
    The leaked secret is gone.
    Why it's wrong
    Temporary credentials already obtained by the attacker stay valid until expiry unless sessions are revoked and activity is reviewed.

    Clue to watch for Signs of role assumption or STS calls after the leak.

  3. Edit the existing security group

    What candidates pick
    Remove the inbound rules from the instance's current group.
    Why it looks right
    It seems like the smallest change.
    Why it's wrong
    The group may be shared with healthy instances, so editing it disrupts them too, while a dedicated isolation group touches only the suspect instance.

    Clue to watch for Containment of one instance in a shared group.

  4. Investigate in place

    What candidates pick
    Log in to the compromised instance to look around.
    Why it looks right
    It is the fastest way to see what happened.
    Why it's wrong
    Logging in changes evidence and may alert the attacker; analysis belongs on snapshot copies in a forensic account.

    Clue to watch for Chain-of-custody or evidence integrity wording.

  5. Detective as a fix

    What candidates pick
    Use Amazon Detective to remediate the compromised role.
    Why it looks right
    It is part of the security suite.
    Why it's wrong
    Detective investigates and visualizes; containment and remediation need IAM changes, Systems Manager or Lambda.

    Clue to watch for The task is to stop activity, not understand it.

  6. Plan without testing

    What candidates pick
    Document the runbook in a wiki and consider readiness complete.
    Why it looks right
    Documentation is a familiar control.
    Why it's wrong
    SCS-C03 expects plans to be exercised, for example with Fault Injection Service experiments or game days.

    Clue to watch for The requirement is to validate effectiveness.

Answer framework

Use these steps for Domain 2 scenarios that start with a finding, alert or suspected compromise.

  1. Confirm the finding and its scope by checking related CloudTrail, Flow Logs and Detective data before taking wide action across accounts or Regions.
  2. Preserve evidence: snapshot volumes, capture memory if needed and copy logs to a protected location in a forensic account.
  3. Contain with the least destructive option, such as an isolation security group, revoked sessions or a deny policy, without terminating resources.
  4. Eradicate and recover by removing the cause, patching or rebuilding from known good images, and restoring data from backups.
  5. Automate and improve by turning the steps into Systems Manager or Step Functions runbooks and testing them with planned experiments.

Practice question

GuardDuty reports that an IAM user's access key is calling APIs from an unfamiliar country. The key has been used to assume a role several times in the last hour. Which action best contains the incident while preserving evidence?

Want more like this? The SCS-C03 practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Learn the response order before the services. Write a one-line rule for each phase: prepare, detect and validate, preserve, contain, eradicate, recover, review. Then attach two AWS actions to each phase. Most Domain 2 questions test whether you put the right action in the right phase.

Practice containment for the three most common targets: an EC2 instance, an IAM credential and an S3 bucket exposed to the public. For each, note the least destructive action that stops further harm and the evidence you must collect first. Do the EC2 case by hand once: create an isolation security group, snapshot the volume and share the snapshot to another account.

Next, automate one case end to end. Use GuardDuty sample findings, an EventBridge rule and a Systems Manager Automation runbook or Step Functions workflow that tags and isolates an instance. Open Detective on the same finding to see the behavior graph. Finally, read the AWS documentation for Fault Injection Service and Resilience Hub so you can explain how a plan is tested, then finish with scenario practice that asks for the next best step.

FAQ

How much of SCS-C03 is Domain 2?

Incident Response is 14% of scored content, about seven of the fifty scored questions, across two task statements: designing and testing a plan, and responding to events.

Is incident response still combined with threat detection?

No. SCS-C02 grouped them in one domain. SCS-C03 places detection in Domain 1 and incident response in Domain 2.

Should I ever terminate a compromised instance first?

Rarely. Exam scenarios usually expect isolation and evidence capture before termination, unless the question states that evidence is not needed and speed alone matters.

What is Amazon Detective used for?

Detective investigates activity using behavior graphs built from CloudTrail, VPC Flow Logs, EKS audit logs and GuardDuty findings. It supports root cause analysis but does not remediate.

Do I need to memorize the AWS Security Incident Response Guide?

The comparison appendix removed that guide as a named item. Know its ideas, such as preparation and isolation, without memorizing its structure.

How is an incident response plan tested on AWS?

Through game days, tabletop exercises and controlled experiments with AWS Fault Injection Service, with AWS Resilience Hub assessing whether recovery objectives are met.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 2 knowledge

You have covered response planning, readiness, automation, forensic capture, containment and root cause analysis. See whether you pick the right next step in timed scenarios.

Take the SCS-C03 practice test Check your SCS-C03 readiness

Keep going