SCS-C03 · Question #138
A company runs a web application on a fleet of Amazon EC2 instances that are in an Auto Scaling group. The EC2 instances are in the same VPC subnet as other workloads. A security engineer deploys…
The correct answer is B. Remove the affected instance from the Auto Scaling group and isolate it with a restricted security. AWS incident response best practices emphasize containment with minimal blast radius while preserving business continuity. According to the AWS Certified Security - Specialty Official Study Guide, isolating a compromised resource while allowing the application to continue…
Question
A company runs a web application on a fleet of Amazon EC2 instances that are in an Auto Scaling group. The EC2 instances are in the same VPC subnet as other workloads. A security engineer deploys Amazon GuardDuty and integrates it with AWS Security Hub. The security engineer needs to implement an automated solution to detect and respond to anomalous traffic patterns. The solution must follow AWS best practices for initial incident response and must minimize disruption to the web application. Which solution will meet these requirements?
Options
- ADisable the instance profile access keys by using AWS Lambda.
- BRemove the affected instance from the Auto Scaling group and isolate it with a restricted security
- CUpdate the network ACL to block the detected traffic source.
- DSend GuardDuty findings to Amazon SNS for email notification.
How the community answered
(19 responses)- A5% (1)
- B79% (15)
- D16% (3)
Explanation
AWS incident response best practices emphasize containment with minimal blast radius while preserving business continuity. According to the AWS Certified Security - Specialty Official Study Guide, isolating a compromised resource while allowing the application to continue operating is the recommended initial response. By creating an Amazon EventBridge rule that reacts to GuardDuty anomalous traffic findings and invokes an AWS Lambda function, the security engineer can automatically remove the affected EC2 instance from the Auto Scaling group and attach a restricted security group. This immediately stops malicious activity while allowing Auto Scaling to replace the instance and keep the application available.
Topics
Community Discussion
No community discussion yet for this question.