AWS Incident Response Demonstrated is a hands-on exam lab that validates your AWS skills in the security domain. In this timed assessment, you work in a live, AWS-provisioned environment to respond to a multi-stage cyberattack. You need to contain the threat, eradicate attacker resources, and implement security hardening measures.
After you begin, you have 90 minutes to complete all challenges. The exam lab provides necessary guidance but not step-by-step solutions. To pass, you must demonstrate proficiency in security services, including AWS CloudTrail, AWS Identity and Access Management, Amazon EC2, Amazon S3, Amazon RDS, and AWS Config.
Important: Each exam lab is continuously tested for reliability. If something appears broken during your attempt, revisit the challenge guidance carefully; most issues stem from a missed configuration step rather than a technical fault.
Tip: Participants who carefully read all provided guidance before acting are significantly more likely to pass. Take time to understand each challenge fully, even under time pressure.
Before you begin:
- Challenges are randomized and might not reflect the sequence of real-life scenarios.
- This exam lab cannot be paused or restarted. If you exit, you will need to start again from the beginning.
- If you fail the exam lab, you will need to wait 25 days before attempting it again.
To prepare for this assessment, we recommend practicing with AWS SimuLearn: Incident Response for foundational skills, or AWS SimuLearn: Compliance Enforcement for more advanced troubleshooting scenarios. For an immersive game-based experience try AWS Cloud Quest: Security.
Recommended Previous Knowledge
AWS SimuLearn: Incident Response
AWS SimuLearn: Compliance Enforcement
AWS Cloud Quest: Security
