SCS-C02 Question 54
Select 2An organization has detected unusual behavior in an EC2 instance, indicating it may have been compromised. The security team wants to isolate the compromised instance while preserving evidence for further investigation. What steps should the team take to respond to the compromised resource effectively?
- A
Create a snapshot of the instance's EBS volumes and stop the instance immediately to prevent further damage.
- B
Detach the instance's root EBS volume and attach it to a forensic analysis instance in a separate, isolated environment.
- C
Add a security group to the instance that denies all inbound and outbound traffic to prevent further communication.
- D
Terminate the instance to ensure all malicious activities are immediately stopped.
- E
Enable Amazon GuardDuty and AWS Config to monitor suspicious activity and gather additional logs for investigation.
Show answer and explanation
Correct answers: B, C
Explanation
To effectively respond to a compromised resource, the primary goals are to isolate the instance to prevent further damage and preserve evidence for forensic analysis. Detaching the root EBS volume and attaching it to a forensic instance allows for detailed investigation without impacting the original data. Additionally, applying a security group that denies all traffic ensures that the compromised instance cannot communicate with other resources, effectively isolating it. Stopping or terminating the instance prematurely could lead to data loss, while enabling monitoring tools like GuardDuty is useful but does not address immediate remediation actions.
- A. Incorrect.
This option is partially correct because creating a snapshot is essential for preserving evidence. However, stopping the instance immediately without further precautions might lead to data loss or hinder forensic investigation.
- B. Correct.
This is correct because detaching the root EBS volume and attaching it to a forensic instance allows for safe analysis of the compromised data without affecting the original instance.
- C. Correct.
This is correct because applying a security group that blocks all traffic effectively isolates the compromised instance while preserving its state for investigation.
- D. Incorrect.
This is incorrect because terminating the instance would destroy evidence that could be critical for forensic analysis and determining the root cause of the compromise.
- E. Incorrect.
This is incorrect because enabling GuardDuty and AWS Config is useful for proactive monitoring but does not directly address isolating or analyzing the compromised instance.