A Security Engineer Noticed an Anomaly Within a Company EC2

question 169

Multiple Choice

A security engineer noticed an anomaly within a company EC2 instance as shown in the image. The engineer must now investigate what is causing the anomaly. What are the MOST effective steps to take to ensure that the instance is not further manipulated, while allowing the engineer to understand what happened?

• A) Remove the instance from the Auto Scaling group. Place the instance within an isolation security group, detach the EBS volume, launch an EC2 instance with a forensic toolkit, and attach the EBS volume to investigate.
• B) Remove the instance from the Auto Scaling group and the Elastic Load Balancer. Place the instance within an isolation security group, launch an EC2 instance with a forensic toolkit, and allow the forensic toolkit image to connect to the suspicious instance to perform the investigation.
• C) Remove the instance from the Auto Scaling group. Place the instance within an isolation security group, launch an EC2 instance with a forensic toolkit, and use the forensic toolkit image to deploy an ENI as a network span port to inspect all traffic coming from the suspicious instance.
• D) Remove the instance from the Auto Scaling group and the Elastic Load Balancer. Place the instance within an isolation security group, make a copy of the EBS volume from a new snapshot, launch an EC2 instance with a forensic toolkit, and attach the copy of the EBS volume to investigate.

---

Definitions:

Computerized Scheduling

The use of computer programs and software to organize appointments, tasks, or events, improving efficiency and accuracy over traditional scheduling methods.

Stream Scheduling

A method used in computing and broadcasting for organizing data processing or transmission according to a predetermined sequence or time.

Time-specified Scheduling

An appointment system where patients are given specific times for their visits, aiming to reduce waiting periods and streamline the process.

Double-booking System

A method used in accounting that records each transaction in two accounts to ensure the balance sheet remains balanced.