SCS-C02 · Question #169
A security engineer receives a notice about suspicious activity from a Linux-based Amazon EC2 instance that uses Amazon Elastic Block Store (Amazon EBS)-based storage. The instance is making…
The correct answer is B. Update the outbound network ACL for the subnet in us-east-1 b to explicitly deny all connections. Updating the outbound network ACL on the us-east-1b subnet immediately stops the malicious outbound connections at the network layer without touching the compromised instance, and since the suspicious instance is the only one in that subnet, there is zero collateral damage…
Question
A security engineer receives a notice about suspicious activity from a Linux-based Amazon EC2 instance that uses Amazon Elastic Block Store (Amazon EBS)-based storage. The instance is making connections to known malicious addresses. The instance is in a development account within a VPC that is in the us-east-1 Region. The VPC contains an internet gateway and has a subnet in us-east-1a and us-east-1b. Each subnet is associate with a route table that uses the internet gateway as a default route. Each subnet also uses the default network ACL. The suspicious EC2 instance runs within the us-east-1b subnet. During an initial investigation, a security engineer discovers that the suspicious instance is the only instance that runs in the subnet. Which response will immediately mitigate the attack and help investigate the root cause?
Options
- ALog in to the suspicious instance and use the netstat command to identify remote connections.
- BUpdate the outbound network ACL for the subnet in us-east-1 b to explicitly deny all connections
- CEnsure that the Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the
- DCreate an AWS WAF web ACL that denies traffic to and from the suspicious instance. Attach the
How the community answered
(52 responses)- A13% (7)
- B58% (30)
- C23% (12)
- D6% (3)
Explanation
Updating the outbound network ACL on the us-east-1b subnet immediately stops the malicious outbound connections at the network layer without touching the compromised instance, and since the suspicious instance is the only one in that subnet, there is zero collateral damage - this satisfies both goals of containment and preserving the instance state for forensic investigation.
Why the distractors fail:
- A - Logging into a compromised instance is dangerous (you risk alerting the attacker or contaminating evidence) and does nothing to stop the active attack.
- C - Taking EBS snapshots is a valid forensic step, but it does not stop ongoing malicious connections; containment must come first.
- D - AWS WAF operates at the HTTP/HTTPS application layer and integrates with CloudFront, ALB, or API Gateway - it cannot be attached to a raw EC2 instance to block arbitrary TCP/IP connections.
Memory tip: When an EC2 instance is the only occupant of a subnet, a Network ACL change is a "surgical isolation" tool - it walls off the entire subnet instantly with no friendly-fire risk. Think: "Lone instance = ACL lockdown, no collateral damage."
Topics
Community Discussion
No community discussion yet for this question.