SCS-C02 Question 380
Single answerAn organization has deployed an application on Amazon EC2 instances in a VPC. The security team has noticed unusual outbound traffic patterns from one of the instances, and they suspect that the instance may be compromised. As a security engineer, what is the most appropriate action to isolate the instance and investigate the issue while minimizing impact on the application?
- A
Stop the instance immediately to prevent further compromise.
- B
Detach the instance from the Auto Scaling group and assign it to a quarantine security group with no outbound access.
- C
Terminate the instance and replace it with a new instance from a known clean AMI.
- D
Enable Amazon GuardDuty and wait for additional findings before taking any action.
Show answer and explanation
Correct answer: B
Explanation
The best course of action is to isolate the instance by detaching it from the Auto Scaling group and assigning it to a quarantine security group with no outbound access. This approach ensures the instance is contained while preserving its state for forensic investigation. Immediate termination or stopping the instance would result in the loss of valuable evidence, and waiting for additional findings could worsen the situation.
- A. Incorrect.
Stopping the instance immediately might prevent further compromise, but it also destroys the current state of the instance, which is critical for forensic investigation.
- B. Correct.
Detaching the instance from the Auto Scaling group and assigning it to a quarantine security group allows you to isolate the instance while preserving its state for further investigation. This is the most appropriate action.
- C. Incorrect.
Terminating the instance would result in the loss of evidence required for investigation, making it difficult to determine the root cause of the issue.
- D. Incorrect.
While enabling Amazon GuardDuty is a good security practice, waiting for additional findings without isolating the instance could allow the compromise to spread or cause further damage.