Which capability lets a team run a repeatable, auditable process that gathers memory, disk, logs and network state from an instance during an incident?
Show answer and explanation
Answer: C
Automation documents can run a defined sequence of acquisition steps on a target instance through the Systems Manager agent, write artifacts to a case-specific S3 prefix, hash them and record each command in the execution history. Parameters and approvals make the same runbook reusable across incidents while keeping the process auditable.
Incident Manager coordinates the response, but the artifact collection itself comes from the runbook.
Why the other options are wrong
- A. Inspector assesses vulnerabilities and exposure. It does not collect forensic artifacts.
- B. Incident Manager pages responders, manages runbooks and captures a timeline, but it does not execute evidence collection on an instance.
- D. Detective analyzes logs to help explain behavior. It does not gather artifacts from the host.