SCS-C02 · Question #468
A company runs workloads that are spread across hundreds of Amazon EC2 instances. During a recent security incident, an EC2 instance was compromised and ran malware code until the company manually…
The correct answer is C. Create an AWS Lambda function that runs when a GuardDuty scan determines that an instance. Option C is correct because the AWS Well-Architected Framework's incident response guidance emphasizes automated isolation over immediate termination - a Lambda function triggered via Amazon EventBridge on a GuardDuty finding can isolate the compromised instance by swapping its…
Question
A company runs workloads that are spread across hundreds of Amazon EC2 instances. During a recent security incident, an EC2 instance was compromised and ran malware code until the company manually terminated the instance. The company is now using Amazon GuardDuty to detect malware on EC2 instances. A security engineer needs to implement a solution that automates a response when GuardDuty determines that an instance is infected. The solution must mitigate the incident and must comply with the AWS Well- Architected Framework guidance for incident response. Which solution will meet these requirements?
Options
- AConfigure AWS Systems Manager Run Command to run when a GuardDuty scan determines that
- BCreate an AWS Lambda function that runs when a GuardDuty scan determines that an instance
- CCreate an AWS Lambda function that runs when a GuardDuty scan determines that an instance
- DDefine a separate VPC to isolate EC2 instances. Define a security group that does not allow any
How the community answered
(32 responses)- A3% (1)
- B3% (1)
- C81% (26)
- D13% (4)
Explanation
Option C is correct because the AWS Well-Architected Framework's incident response guidance emphasizes automated isolation over immediate termination - a Lambda function triggered via Amazon EventBridge on a GuardDuty finding can isolate the compromised instance by swapping its security group to one that blocks all traffic, while preserving the instance for forensic analysis (e.g., EBS snapshot).
Why the distractors fail:
- A (Systems Manager Run Command): SSM Run Command executes commands on the instance itself - executing code on a known-compromised host is unsafe and unreliable if the instance's agent is affected by malware.
- B (Lambda variant): This option likely terminates the instance immediately, which destroys forensic evidence and violates Well-Architected guidance that says to preserve compromised resources for investigation before disposal.
- D (Separate VPC/security group): This is a preventive control set up in advance, not an automated response to an active GuardDuty finding - it doesn't satisfy the "automates a response" requirement.
Memory tip: Think "Detect → Bridge → Isolate, Don't Terminate" - GuardDuty detects, EventBridge bridges the finding to Lambda, and Lambda isolates (not kills) the instance. The Well-Architected Framework always favors preserving evidence over destroying it.
Topics
Community Discussion
No community discussion yet for this question.