nerdexam
Amazon

SCS-C02 · Question #368

Your company hosts a large section of EC2 instances in AWS. There are strict security rules governing the EC2 Instances. During a potential security breach , you need to ensure quick investigation of

The correct answer is B. AWS Cloudformation. The AWS Security best practises mentions the following Unique to AWS, security practitioners can use CloudFormation to quickly create a new, trusted environment in which to conduct deeper investigation. The CloudFormation template can pre-configure instances in an isolated enviro

Submitted by andreas_gr· Mar 6, 2026Incident Response

Question

Your company hosts a large section of EC2 instances in AWS. There are strict security rules governing the EC2 Instances. During a potential security breach , you need to ensure quick investigation of the underlying EC2 Instance. Which of the following service can help you quickly provision a test environment to look into the breached instance?

Options

  • AAWS Cloudwatch
  • BAWS Cloudformation
  • CAWS Cloudtrail
  • DAWS Config

How the community answered

(46 responses)
  • A
    9% (4)
  • B
    85% (39)
  • C
    4% (2)
  • D
    2% (1)

Explanation

The AWS Security best practises mentions the following Unique to AWS, security practitioners can use CloudFormation to quickly create a new, trusted environment in which to conduct deeper investigation. The CloudFormation template can pre-configure instances in an isolated environment that contains all the necessary tools forensic teams need to determine the cause of the incident This cuts down on the time it takes to gather necessary tools, isolates systems under examination, and ensures that the team is operating in a clean room. Option A is incorrect since this is a logging service and cannot be used to provision a test Option C is incorrect since this is an API logging service and cannot be used to provision a test Option D is incorrect since this is a configuration service and cannot be used to provision a test

Topics

#CloudFormation#forensic environment#incident response#EC2

Community Discussion

No community discussion yet for this question.

Full SCS-C02 Practice