Question 1 of 14
An approved, event-driven Automation runbook can apply consistent containment actions and preserve evidence without immediately destroying the compromised resource. Systems Manager Automation is designed for repeatable operational runbooks, and current AWS incident-response guidance favors targeted, reversible containment when practical.
Strong Interview Answer
This approach aligns with the principle of least-surprise, minimizing disruption while maximizing forensic value. The automation's repeatability ensures consistent responses across similar incidents, reducing human error and speeding up the response process.
What to Listen For
- Automation
- event-driven
- containment
- evidence
- repeatable
Caution
The question tests the ability to apply automation to incident response.