DOP-C02 Domain 5: Incident and Event Response

While troubleshooting latency, engineers determine they must capture forensics disk/memory. Which action is appropriate?

Multiple choice — select one answer

Answer choices

  1. a. Security group isolation runbook or NACL deny
  2. b. SSM Automation snapshot volumes with preservation
  3. c. Systems Manager Incident Manager
  4. d. SSM Automation documents triggered by Config

Architectural breakdown & explanation

Preserve evidence before remediation.

Correct answer(s): b. SSM Automation snapshot volumes with preservation

Exam domain: Domain 5: Incident and Event Response (14% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the AWS Certified DevOps Engineer – Professional bank. Run a full timed practice exam with domain-weighted random questions in your browser.