SCS-C02 Question 55
Select 4Your organization has detected unusual activity in an Amazon EC2 instance, indicating it might have been compromised. As the security engineer, you need to respond quickly to isolate the instance while preserving forensic evidence. Which of the following steps should you take to effectively respond to this incident?
- A
Detach the compromised instance from the Auto Scaling group to prevent it from being replaced.
- B
Take a snapshot of the instance's root volume for forensic analysis.
- C
Terminate the instance immediately to eliminate the threat.
- D
Isolate the instance by modifying its security group to block all inbound and outbound traffic.
- E
Create a memory dump of the instance for further investigation.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
When responding to a compromised resource, it is critical to preserve forensic evidence while mitigating the risk of further damage. Detaching the instance from the Auto Scaling group, taking a snapshot of the root volume, isolating the instance by modifying its security group, and creating a memory dump are all standard steps to ensure evidence is preserved and the instance is secured for further investigation. Terminating the instance immediately is not recommended as it destroys evidence that may be crucial for understanding the attack and preventing future incidents.
- A. Correct.
Detaching the instance from the Auto Scaling group ensures it won’t be terminated and replaced, which could result in the loss of forensic evidence. This is a crucial step in incident response.
- B. Correct.
Taking a snapshot of the root volume preserves the state of the compromised instance for further analysis. This is critical for ensuring evidence integrity.
- C. Incorrect.
Terminating the instance immediately may remove the threat but destroys evidence that is needed for investigation and root cause analysis, making this a poor response in this scenario.
- D. Correct.
Isolating the instance by modifying its security group prevents further malicious activity while retaining access for forensic investigation. This is a standard security response step.
- E. Correct.
Creating a memory dump captures in-memory data that may contain critical evidence, such as malware or attacker activity, which is essential for a thorough investigation.