SCS-C02 Domain 2: Incident Response

A regulated workload requires the organization to perform organization-wide IR. Which solution is BEST? perform organization-wide IR.

Multiple choice — select one answer

Answer choices

  1. a. SSM Automation and Security Hub custom actions
  2. b. GuardDuty threat lists and partner integrations
  3. c. GuardDuty delegated admin and Organizations
  4. d. EventBridge to Jira/ServiceNow via Lambda

Architectural breakdown & explanation

Delegated admin centralizes security services.

Correct answer(s): c. GuardDuty delegated admin and Organizations

Exam domain: Domain 2: Incident Response (14% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the AWS Certified Security – Specialty bank. Run a full timed practice exam with domain-weighted random questions in your browser.