SCS-C02 Domain 2: Incident Response

A team must automate containment playbooks. Which option meets the requirement?

Multiple choice — select one answer

Answer choices

  1. a. Security Hub severity and workflow status
  2. b. SSM Automation and Security Hub custom actions
  3. c. GuardDuty threat lists and partner integrations
  4. d. Game days and FIS experiments

Architectural breakdown & explanation

Automation speeds containment.

Correct answer(s): b. SSM Automation and Security Hub custom actions

Exam domain: Domain 2: Incident Response (14% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the AWS Certified Security – Specialty bank. Run a full timed practice exam with domain-weighted random questions in your browser.