Exam Therapy: Incident Response on AWS (SCS-C03) — Contain vs Eradicate, and Other Lies We Tell Ourselves

Andrew and Ava break down the AWS incident response lifecycle, the difference between containment and eradication, and why your “just check CloudTrail” plan is how breaches become biographies. Plus: playbooks vs runbooks, evidence preservation, and exam-trap keywords.