SCS-C03 Domain 2: Incident Response (14%)
Incident Response carries 14% of the SCS-C03 exam. It tests whether you can prepare a response plan, test it, and act when an alert fires: capture evidence, contain the threat, eradicate it and recover the affected resources.
Weight on the exam: 14%. It is one of the six domains of the AWS Certified Security – Specialty SCS-C03 exam. Below is a summary of its tasks and skills according to the official AWS guide.
Tasks and skills tested
Task 2.1: Design and test an incident response plan
- Design and implement response plans and runbooks to respond to security incidents (for example, Systems Manager OpsCenter, Amazon SageMaker AI notebooks).
- Use AWS service features and capabilities to configure services to be prepared for incidents (for example, by provisioning access, deploying security tools, minimizing the blast radius, configuring AWS Shield Advanced protections).
- Recommend procedures to test and validate the effectiveness of an incident response plan (for example, AWS Fault Injection Service, AWS Resilience Hub).
- Use AWS services to automatically remediate incidents (for example, Systems Manager, Automated Forensics Orchestrator for Amazon EC2, AWS Step Functions, Amazon Application Recovery Controller, Lambda functions).
Task 2.2: Respond to security events
- Capture and store relevant system and application logs as forensic artifacts.
- Search and correlate logs for security events across applications and AWS services.
- Validate findings from AWS security services to assess the scope and impact of an event.
- Respond to affected resources by containing and eradicating threats, and recover resources (for example, by implementing network containment controls, restoring backups).
- Describe methods to conduct root cause analysis (for example, Amazon Detective).
Services and tools to master
- AWS Systems Manager
- AWS Step Functions
- AWS Lambda
- AWS Fault Injection Service
- AWS Resilience Hub
- AWS Shield Advanced
- Amazon Detective
- Amazon Application Recovery Controller
- Automated Forensics Orchestrator for Amazon EC2
Key facts for domain 2
Short summaries; each links to the study topic with the full note and its official source.
- Compromised EC2: memory first — Before isolating or shutting down a compromised instance, capture its memory: EBS snapshots only hold what was written to disk, not what is in memory.
- Changing a security group doesn't cut connections — Changing a security group does NOT close connections that are already tracked: it only blocks future traffic.
- Compromised access keys — To contain an access key (prefix AKIA) you can deactivate or delete it: a deactivated key can be reactivated, a deleted one cannot be recovered.
- Compromised temporary credentials — Temporary credentials (prefix ASIA) are not rotated or revoked: they expire.
- Tags to automate quarantine — Prepare the instance before investigating: enable termination protection, disable Delete on Termination on its volumes and tag it.
Practice Domain 2
Answer practice questions, read the explanation and review your mistakes with spaced repetition.