CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Navigating AWS Security Incident Response: A SCS-C02 Exam Question Walkthrough
Get insights into an AWS SCS-C02 exam question about automated incident response. Understand the correct answer and why others fall short.
Understanding incident response in AWS is crucial for the SCS-C02 exam. Many candidates trip over the details of automation services. This question tests your knowledge of which AWS service effectively manages automated remediation workflows in response to security incidents.
The question
After a recent security incident, your team is developing an incident response plan that includes automated remediation. Which AWS service allows you to create automation workflows that can respond to security incidents across AWS services?
A. AWS Systems Manager
B. AWS Lambda
C. AWS Step Functions
D. Amazon CloudWatch
Think before you scroll
Take a moment to consider the purpose of each option. Which service not only provides automation but is specifically designed for security incident workflows? Look for the service that integrates multiple AWS components for a cohesive response.
The answer
The correct option is A. AWS Systems Manager. It offers a feature called Automation that allows you to create runbooks, enabling automated remediation in response to security incidents. This service is specifically designed for such tasks, making it the best choice for this scenario.
Why the other options lose
B. AWS Lambda: While Lambda can execute code in response to events, it does not manage workflows or provide built-in automation for incident response. It’s more suited for executing discrete tasks rather than handling security incidents comprehensively.
C. AWS Step Functions: Step Functions is excellent for orchestrating workflows but lacks built-in automation capabilities specifically for security incidents. It focuses on coordinating multiple services rather than directly addressing incident response.
D. Amazon CloudWatch: CloudWatch is primarily a monitoring and logging service. While it plays a role in observing security incidents, it does not automate remediation workflows. Its main function is to provide visibility into your AWS environment rather than direct incident response.
The concept behind it
The principle behind this question is understanding the specific roles of AWS services in incident response. AWS Systems Manager stands out for its capability to automate operational tasks, especially in security contexts. Recognizing the distinction between automation, orchestration, and monitoring is crucial for effective incident management.
Exam trap to remember
Remember: Automation is key for incident response. Choose AWS Systems Manager for automated workflows.