SCS-C02 Question 61
Single answerYour organization uses AWS and has implemented CloudTrail for logging API activity. During a routine security review, your team identifies suspicious activity suggesting unauthorized access to an EC2 instance. According to the AWS Security Incident Response Guide, what is the NEXT step you should take to contain the incident?
- A
Revoke all IAM user credentials immediately to prevent further unauthorized access.
- B
Isolate the compromised EC2 instance by modifying its associated security group to deny all inbound and outbound traffic.
- C
Terminate the EC2 instance to stop any malicious activity and remove the compromised resource.
- D
Analyze the CloudTrail logs to determine the root cause of the unauthorized access before taking any containment actions.
Show answer and explanation
Correct answer: B
Explanation
The AWS Security Incident Response Guide emphasizes containing the incident as a priority to prevent further unauthorized activity while preserving evidence for investigation. Isolating the EC2 instance by modifying its security group ensures no additional harm is done while allowing for further analysis.
- A. Incorrect.
Revoking all IAM user credentials immediately is not the best next step as it could disrupt legitimate users and doesn't directly address the compromised resource.
- B. Correct.
Isolating the compromised EC2 instance by modifying its security group is the correct next step as it helps contain the incident while preserving the instance for forensic analysis.
- C. Incorrect.
Terminating the EC2 instance might stop the malicious activity, but it would also destroy evidence that could be critical for root cause analysis and incident investigation.
- D. Incorrect.
Analyzing CloudTrail logs is important, but it should be done after the compromised resource is contained to prevent further unauthorized actions.