SCS-C02 Question 3
Select 3Your organization has implemented Amazon GuardDuty to monitor and detect potential security threats in your AWS environment. You receive an alert indicating that an EC2 instance is communicating with a known Command and Control (C2) server. What actions should you take to respond to this threat while minimizing the impact on other operations?
- A
Isolate the EC2 instance by modifying its security group to deny all outbound traffic.
- B
Stop the EC2 instance immediately to prevent further malicious activity.
- C
Investigate the GuardDuty finding to gather additional details, such as the instance ID and the malicious IP address.
- D
Take a memory snapshot of the EC2 instance to preserve forensic evidence before taking further action.
- E
Reinstate the EC2 instance after deleting the finding from GuardDuty to resolve the alert.
Show answer and explanation
Correct answers: A, C, D
Explanation
When dealing with a potential compromise, the focus should be on containment, investigation, evidence preservation, and remediation. Isolating the instance ensures it cannot continue communicating with malicious actors, while gathering information and taking a memory snapshot allow for a thorough investigation. Immediate actions like stopping the instance or reinstating it without analysis may lead to data loss or further compromise.
- A. Correct.
Isolating the EC2 instance by modifying its security group to deny all outbound traffic is a valid initial containment step to prevent further communication with malicious actors.
- B. Incorrect.
Stopping the EC2 instance immediately could disrupt forensic analysis and evidence collection, so it is not recommended as the first action.
- C. Correct.
Investigating the GuardDuty finding is crucial to understanding the scope of the threat and collecting necessary details for a proper response.
- D. Correct.
Taking a memory snapshot of the EC2 instance preserves evidence that can be used for forensic analysis and incident investigation.
- E. Incorrect.
Reinstating the EC2 instance without proper investigation or remediation could expose your environment to further risks, making this a poor response.