Incident response
Practise only this domain. 35 questions with explanations, 20 at a time.
Start incident responseSample questions
- Responders need a playbook for a compromised workload. It must pause for an analyst's approval before revoking the instance role's active sessions and isolating the host, and it must record each step for audit. Which combination best models this?Hard
- A SOC lead must brief the team on the sequence of phases to follow when a confirmed compromise of an EC2 instance is under investigation. Which listing gives the correct order?Easy
- A company needs pages to reach the right on-call engineer based on incident severity, with escalation when nobody acknowledges. Which service should they configure?Medium
- A company wants the ability to cut a suspected instance off from the network within seconds during an incident, without engineering the steps at 3 a.m. What should they prepare in advance?Medium
- Which capability lets a team run a repeatable, auditable process that gathers memory, disk, logs and network state from an instance during an incident?Medium
- An attacker with stolen credentials encrypted objects in an S3 bucket. Which recovery path is most reliable if the right safeguards were in place beforehand?Hard
- Several EC2 instances were compromised, and the team must determine where the attacker first entered and how the activity spread. Which service gives the most useful timeline?Medium