SCS-C02 Question 53
Select 3Your organization has detected unusual activity originating from an Amazon EC2 instance. Upon investigation, it appears that the instance has been compromised and is being used to send unauthorized outbound traffic. What steps should you take to respond to the compromised resource while minimizing further damage and maintaining forensic evidence?
- A
Isolate the instance by modifying its security group to deny all inbound and outbound traffic.
- B
Terminate the compromised instance immediately to prevent further misuse.
- C
Take a snapshot of the instance and its attached volumes for forensic analysis.
- D
Enable detailed monitoring on the instance to assess its current activity.
- E
Create a new security group with restricted rules and attach it to the instance.
Show answer and explanation
Correct answers: A, C, E
Explanation
When responding to a compromised instance, the primary goals are to stop the malicious activity, preserve evidence for investigation, and minimize the impact on the environment. Isolating the instance prevents further misuse, taking snapshots ensures forensic data is preserved, and attaching a restricted security group provides another layer of isolation without terminating the instance prematurely.
- A. Correct.
Correct: Isolating the instance by modifying its security group to deny all traffic prevents further damage while preserving the instance for forensic purposes.
- B. Incorrect.
Incorrect: Terminating the instance immediately would destroy critical forensic evidence, making it harder to investigate the extent of the compromise.
- C. Correct.
Correct: Taking a snapshot of the instance and attached volumes preserves forensic evidence for detailed investigation and root cause analysis.
- D. Incorrect.
Incorrect: Enabling detailed monitoring on the instance does not address the immediate need to stop further damage or preserve evidence.
- E. Correct.
Correct: Creating a new security group with restricted rules and attaching it to the instance is another effective way to isolate the compromised resource without terminating it.