SCS-C03 · Question #3
A security engineer receives a notice about suspicious activity from a Linux-based Amazon EC2 instance that uses Amazon Elastic Block Store (Amazon EBS)-based storage. The instance is making…
The correct answer is C. Ensure that the Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the. Explanation Option C is correct because taking a snapshot of the EBS volumes attached to the suspicious instance and then isolating the instance (by modifying its security group to deny all traffic) preserves forensic evidence while immediately stopping malicious outbound…
Question
A security engineer receives a notice about suspicious activity from a Linux-based Amazon EC2 instance that uses Amazon Elastic Block Store (Amazon EBS)-based storage. The instance is making connections to known malicious addresses. The instance is in a development account within a VPC that is in the us-east-1 Region. The VPC contains an internet gateway and has a subnet in us-east-1a and us-east-1b. Each subnet is associated with a route table that uses the internet gateway as a default route. Each subnet also uses the default network ACL. The suspicious EC2 instance runs within the us-east-1b subnet. During an initial investigation, a security engineer discovers that the suspicious instance is the only instance that runs in the subnet. Which response will immediately mitigate the attack and help investigate the root cause?
Options
- ALog in to the suspicious instance and use the netstat command to identify remote connections.
- BUpdate the outbound network ACL for the subnet in us-east-1b to explicitly deny all connections
- CEnsure that the Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the
- DCreate an AWS WAF web ACL that denies traffic to and from the suspicious instance. Attach the
How the community answered
(30 responses)- A13% (4)
- B23% (7)
- C57% (17)
- D7% (2)
Explanation
Explanation
Option C is correct because taking a snapshot of the EBS volumes attached to the suspicious instance and then isolating the instance (by modifying its security group to deny all traffic) preserves forensic evidence while immediately stopping malicious outbound connections - this is the standard AWS incident response playbook of isolate, then investigate. Option A is wrong because logging into a compromised instance risks further contamination, destroying evidence, and does nothing to stop the ongoing attack. Option B is wrong because modifying the network ACL would affect the entire subnet, and while it would block traffic, it disrupts any future legitimate instances placed in that subnet and doesn't preserve forensic data. Option D is wrong because AWS WAF operates at the application layer (Layer 7) for web traffic and cannot be directly attached to an EC2 instance to block all network connections.
Memory Tip: Remember the AWS incident response mantra - "Snapshot, Isolate, Investigate" (SII). Always preserve evidence via EBS snapshot before touching the instance, then isolate using security groups (not NACLs, which are subnet-wide). Think of security groups as the "surgical scalpel" for isolating a single instance.
Topics
Community Discussion
No community discussion yet for this question.