SCS-C02 Question 62
Select 3Your organization has detected unauthorized access to an EC2 instance, and sensitive data might have been accessed. Following the AWS Security Incident Response Guide, what steps should you take to mitigate and investigate the incident as part of the response process?
- A
Take a snapshot of the instance and its attached volumes for forensic analysis.
- B
Stop the EC2 instance immediately to prevent further damage.
- C
Isolate the instance by modifying the security group to block all inbound and outbound traffic.
- D
Enable AWS CloudTrail logging for the affected region if not already enabled.
- E
Terminate the compromised instance to ensure it no longer poses a threat.
Show answer and explanation
Correct answers: A, C, D
Explanation
The AWS Security Incident Response Guide emphasizes the importance of evidence preservation, isolation, and logging during an incident. Taking snapshots ensures forensic data is retained, while modifying security groups isolates the instance without destroying evidence. Enabling AWS CloudTrail provides valuable logs for analysis. Avoid stopping or terminating the instance prematurely, as this could hinder the investigation and destroy volatile or persistent evidence.
- A. Correct.
Correct: Taking a snapshot of the instance and its attached volumes is a critical step for preserving evidence and performing forensic analysis later.
- B. Incorrect.
Incorrect: Stopping the instance immediately might result in loss of volatile data (e.g., memory contents) and should be avoided until proper evidence collection is completed.
- C. Correct.
Correct: Isolating the instance by modifying its security group helps prevent further unauthorized access while preserving the state of the instance for investigation.
- D. Correct.
Correct: Enabling AWS CloudTrail logging (if not already enabled) is essential to gather operational and API activity logs that can aid in identifying the source and scope of the breach.
- E. Incorrect.
Incorrect: Terminating the instance should be avoided during the investigation phase, as it destroys evidence that might be critical to understanding and resolving the incident.