In an IaaS platform, which of the following actions would a systems administrator take FIRST to identify the scope of an incident?

The correct answer is B. Snapshot all volumes attached to an instance.. When an incident occurs in an IaaS platform, the first step is to identify the scope of the incident. This can be done by taking a snapshot of all volumes attached to the instance that was affected by the incident. This will allow the systems administrator to restore the instance

Security

Question

Options

AConduct a memory acquisition.
BSnapshot all volumes attached to an instance.
CRetrieve data from a backup.
DPerform a traffic capture.

How the community answered

(50 responses)

A
16% (8)
B
72% (36)
C
8% (4)
D
4% (2)

Explanation

When an incident occurs in an IaaS platform, the first step is to identify the scope of the incident. This can be done by taking a snapshot of all volumes attached to the instance that was affected by the incident. This will allow the systems administrator to restore the instance to a known good state and to investigate the incident further.

Topics

#incident scoping#volume snapshots#IaaS forensics#incident response

Community Discussion

No community discussion yet for this question.

Full CV0-003 Practice