A company finds that one of its Amazon EC2 instances suddenly has a high CPU usage. The company does not know whether the EC2 instance is compromised or whether the operating system is performing…

Question

Options

• ADisable termination protection for the EC2 instance if termination protection has not been
• BEnable termination protection for the EC2 instance if termination protection has not been enabled.
• CTake snapshots of the Amazon Elastic Block Store (Amazon EBS) data volumes that are
• DRemove all snapshots of the Amazon Elastic Block Store (Amazon EBS) data volumes that are
• ECapture the EC2 instance metadata, and then tag the EC2 instance as under quarantine.
• FImmediately remove any entries in the EC2 instance metadata that contain sensitive information.

• A
  4% (2)
• B
  75% (42)
• D
  7% (4)
• F
  14% (8)

Explanation

Enable termination protection for the EC2 instance if termination protection has not been enabled. Enabling termination protection ensures that the EC2 instance is not accidentally terminated, which helps preserve the instance and its state for investigation. Take snapshots of the Amazon Elastic Block Store (Amazon EBS) data volumes that are attached to the EC2 instance. Taking snapshots of the EBS volumes ensures that the data is preserved in its current state, allowing for forensic analysis without altering the original data. Capture the EC2 instance metadata, and then tag the EC2 instance as under quarantine. Capturing the instance metadata and tagging it as quarantined helps document the instance for further investigation and prevents other operations from being performed on it unintentionally. These steps ensure that data is preserved, the instance is protected from accidental termination, and important metadata is captured for investigation, all of which are crucial before investigating the cause of the high CPU

No community discussion yet for this question.