SCS-C02 · Question #371
One of the EC2 Instances in your company has been compromised. What steps would you take to ensure that you could apply digital forensics on the Instance. Select 2 answers from the options given below
The correct answer is B. Create a separate forensic instance C. Ensure that the security groups only allow communication to this forensic instance. Option A is invalid because removing the role will not help completely in such a situation Option D is invalid because terminating the instance means that you cannot conduct forensic analysis on the instance One way to isolate an affected EC2 instance for investigation is to plac
Question
One of the EC2 Instances in your company has been compromised. What steps would you take to ensure that you could apply digital forensics on the Instance. Select 2 answers from the options given below
Options
- ARemove the role applied to the Ec2 Instance
- BCreate a separate forensic instance
- CEnsure that the security groups only allow communication to this forensic instance
- DTerminate the instance
How the community answered
(28 responses)- A7% (2)
- B79% (22)
- D14% (4)
Explanation
Option A is invalid because removing the role will not help completely in such a situation Option D is invalid because terminating the instance means that you cannot conduct forensic analysis on the instance One way to isolate an affected EC2 instance for investigation is to place it in a Security Group that only the forensic investigators can access. Close all ports except to receive inbound SSH or RDP traffic from one single IP address from which the investigators can safely examine the
Topics
Community Discussion
No community discussion yet for this question.