SCS-C02 Question 19
Select 2Your organization recently detected unusual activity on an Amazon EC2 instance, and an investigation reveals unauthorized access. As part of the incident response process, you need to isolate the instance while preserving forensic evidence for further investigation. Which of the following actions should you take? (Select TWO)
- A
Detach the root volume of the compromised instance and attach it to a forensic analysis instance.
- B
Stop the instance to prevent further damage and restart it once the issue is resolved.
- C
Enable VPC Flow Logs to capture network traffic for analysis.
- D
Create a snapshot of the compromised instance's volumes for forensic purposes.
- E
Terminate the compromised instance immediately to prevent unauthorized activity.
Show answer and explanation
Correct answers: A, D
Explanation
In the event of a cloud incident, it is critical to preserve forensic evidence while isolating the compromised resource. Detaching the root volume and creating snapshots are effective ways to preserve data without altering the state of the instance. Actions like stopping or terminating the instance should be avoided as they might compromise evidence integrity. Enabling VPC Flow Logs is useful for future monitoring but does not address the immediate need for forensic preservation.
- A. Correct.
Detaching the root volume and attaching it to a forensic analysis instance is a recommended practice to preserve evidence. This allows investigators to analyze the data without altering the original state of the compromised instance.
- B. Incorrect.
Stopping the instance is not recommended during an incident as it can impact evidence integrity. The instance should remain in its current state for forensic analysis.
- C. Incorrect.
While enabling VPC Flow Logs is a useful proactive measure, it will not preserve evidence that already exists on the compromised instance. This action does not directly contribute to isolating or preserving current forensic data.
- D. Correct.
Creating a snapshot of the compromised instance's volumes is a critical step in preserving evidence. It ensures there is a point-in-time copy of the data for further investigation.
- E. Incorrect.
Terminating the instance is not recommended during an incident as it destroys evidence and prevents further forensic analysis.