SCS-C02 Question 56
Select 3Your organization has identified suspicious activity on an EC2 instance running in a VPC. It appears that unauthorized access was gained, and the instance is being used to execute malicious scripts. What is the MOST appropriate set of actions to take in response to this incident?
- A
Isolate the compromised instance by removing its security group and associating a security group that blocks all inbound and outbound traffic.
- B
Take a snapshot of the compromised instance's volumes for forensic analysis and evidence preservation.
- C
Manually terminate the compromised instance immediately to stop the malicious activity.
- D
Use AWS Systems Manager to run a script on the compromised instance to identify and stop the malicious process.
- E
Inspect CloudTrail logs to identify any unauthorized API calls made from the compromised instance.
Show answer and explanation
Correct answers: A, B, E
Explanation
When responding to a compromised EC2 instance, the priority is to isolate the instance to prevent further harm, preserve evidence for investigation, and analyze logs to understand the attack. Terminating the instance prematurely or executing scripts on it can hinder the incident response process. Combining isolation, evidence preservation, and log analysis ensures a comprehensive and secure response.
- A. Correct.
Isolating the compromised instance is critical to prevent further damage or lateral movement within the network. Removing its current security group and associating one that blocks all traffic ensures the instance is fully isolated.
- B. Correct.
Taking a snapshot of the instance's volumes preserves evidence for forensic analysis, which is necessary to understand the scope of the breach and comply with incident response best practices.
- C. Incorrect.
Terminating the instance immediately could result in the loss of evidence that is vital for forensic investigation and understanding the attack vector.
- D. Incorrect.
Running a script on the compromised instance can be risky, as the instance is already compromised, and further actions on it may worsen the situation or trigger additional malicious activity.
- E. Correct.
Inspecting CloudTrail logs helps identify unauthorized API activity and gain insights into the attacker's actions and potential lateral movements.