Security World 6 · Incident Command · Stage 1

Before It Happens

Everything the first responder reaches for at 02:14 must already exist: the runbook, the account, the tooling, the protections and the proof the plan works.

Incident response plans
Systems Manager Automation and OpsCenter
Forensic accounts
Blast radius
AWS FIS and Resilience Hub

Domain: Security
World: Security World 6: Incident Command (Specialty)
Game type: Solution board: Drop services into each row's slots, then run records through them.
Time: About 25 minutes on a first attempt (estimated)
Exam guides: SOA-C03Skill 1.2.3
SAP-C02Task 1.2: Prescribe security controls
SCS-C03Skill 2.1.1: Design and implement response plans and runbooks to respond to security incidents (for example, Systems Manager OpsCenter, Amazon SageMaker AI notebooks); Skill 2.1.2: Use AWS service features and capabilities to configure services to be prepared for incidents (for example, by provisioning access, deploying security tools, minimizing the blast radius, configuring AWS Shield Advanced protections); Skill 2.1.3: Recommend procedures to test and validate the effectiveness of an incident response plan (for example, AWS Fault Injection Service, AWS Resilience Hub)