Q: 4
A security engineer receives a notice about suspicious activity from a Linux-based Amazon EC2
instance that uses Amazon Elastic Block Store (Amazon EBS)-based storage. The instance is making
connections to known malicious addresses.
The instance is in a development account within a VPC that is in the us-east-1 Region. The VPC
contains an internet gateway and has a subnet in us-east-1a and us-east-1b. Each subnet is
associated with a route table that uses the internet gateway as a default route. Each subnet also uses
the default network ACL. The suspicious EC2 instance runs within the us-east-1b subnet. During an
initial investigation, a security engineer discovers that the suspicious instance is the only instance
that runs in the subnet.
Which response will immediately mitigate the attack and help investigate the root cause?
Options
Discussion
Had something like this in a mock, pretty sure C is right. You want to save the EBS volumes by disabling delete on termination, then kill the compromised box so nothing else leaks. Forensics should always happen offline on a new host for clean analysis. Makes sense?
Probably C, since it isolates the compromised instance fast and preserves EBS data for forensics. That's the usual AWS IR pattern I see. Anyone think B could also work in some cases?
Be respectful. No spam.
