Play free

Security World 6 · Incident Command · Stage 2

Contain the Instance

Acquire and preserve, then contain, then recover; terminate last, if at all.

  • Evidence acquisition
  • Network containment
  • Session revocation
  • Auto Scaling standby
  • Forensic copies
Domain
Security
World
Security World 6: Incident Command (Specialty)
Game type
Runbook: Order the response steps, run the runbook and read the timeline.
Time
About 35 minutes on a first attempt (estimated)
Exam guides
  • SAA-C03Task 1.2: Design secure workloads and applications
  • SOA-C03Skill 4.2.5: Configure reports and remediate findings from AWS services (for example, AWS Security Hub, Amazon GuardDuty, AWS Config, Amazon Inspector, AWS Security Agent)
  • SCS-C03Skill 2.2.1: Capture and store relevant system and application logs as forensic artifacts; Skill 2.2.4: Respond to affected resources by containing and eradicating threats, and recover resources (for example, by implementing network containment controls, restoring backups); Skill 2.1.4: Use AWS services to automatically remediate incidents (for example, Systems Manager, Automated Forensics Orchestrator for Amazon EC2, AWS Step Functions, Amazon Application Recovery Controller, Lambda functions)