SCS-C02 Domain 2: Incident Response

An audit found gaps: the organization must test IR with simulations. Which option addresses this? test IR with simulations.

Multiple choice — select one answer

Answer choices

  1. a. Isolate instance and snapshot volumes
  2. b. First real attack is test
  3. c. Game days and FIS experiments
  4. d. GuardDuty delegated admin and Organizations

Architectural breakdown & explanation

Exercises validate runbooks.

Correct answer(s): c. Game days and FIS experiments

Exam domain: Domain 2: Incident Response (14% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the AWS Certified Security – Specialty bank. Run a full timed practice exam with domain-weighted random questions in your browser.