SCS-C03 · Question #101
A company runs workloads that are spread across hundreds of Amazon EC2 instances. During a recent security incident, an EC2 instance was compromised and ran malware code until the company manually ter
The correct answer is C. Create an AWS Lambda function that runs when a GuardDuty scan determines that an instance. Explanation Option C is correct because it uses AWS Lambda triggered by GuardDuty findings to automatically isolate the compromised EC2 instance - typically by modifying its security group to block all traffic and/or taking a forensic snapshot - which aligns with the AWS Well-Arc
Question
A company runs workloads that are spread across hundreds of Amazon EC2 instances. During a recent security incident, an EC2 instance was compromised and ran malware code until the company manually terminated the instance. The company is now using Amazon GuardDuty to detect malware on EC2 instances. A security engineer needs to implement a solution that automates a response when GuardDuty determines that an instance is infected. The solution must mitigate the incident and must comply with the AWS Well-Architected Framework guidance for incident response. Which solution will meet these requirements?
Options
- AConfigure AWS Systems Manager Run Command to run when a GuardDuty scan determines that
- BCreate an AWS Lambda function that runs when a GuardDuty scan determines that an instance
- CCreate an AWS Lambda function that runs when a GuardDuty scan determines that an instance
- DDefine a separate VPC to isolate EC2 instances. Define a security group that does not allow any
How the community answered
(35 responses)- A9% (3)
- B3% (1)
- C71% (25)
- D17% (6)
Explanation
Explanation
Option C is correct because it uses AWS Lambda triggered by GuardDuty findings to automatically isolate the compromised EC2 instance - typically by modifying its security group to block all traffic and/or taking a forensic snapshot - which aligns with the AWS Well-Architected Framework's incident response pillar that emphasizes automated containment, preservation of evidence, and minimal manual intervention.
Why the distractors are wrong:
- Option A (Systems Manager Run Command): Running commands directly on a potentially compromised instance is risky - malware could interfere with the commands, and this approach doesn't properly isolate the instance from the network first.
- Option B (Another Lambda variation): While similar in structure to C, option B likely terminates the instance immediately, which destroys forensic evidence - violating Well-Architected guidance that recommends preserving compromised instances for investigation before termination.
- Option D (Separate VPC/security group): Pre-defining a VPC for isolation is a manual, reactive architectural approach rather than an automated response, and it doesn't scale efficiently across hundreds of instances.
Memory Tip: Think "GuardDuty → EventBridge → Lambda → Isolate" as your automated incident response chain. The Well-Architected Framework favors automate → isolate → preserve evidence - never destroy evidence first!
Topics
Community Discussion
No community discussion yet for this question.