A Security Engineer Has Noticed That VPC Flow Logs Are

question 192

Multiple Choice

A security engineer has noticed that VPC Flow Logs are getting a lot of REJECT traffic originating from a single Amazon EC2 instance in an Auto Scaling group. The security engineer is concerned that this EC2 instance may be compromised. What immediate action should the security engineer take?

• A) Remove the instance from the Auto Scaling group. Close the security group with ingress only from a single forensic IP address to perform an analysis.
• B) Remove the instance from the Auto Scaling group. Change the network ACL rules to allow traffic only from a single forensic IP address to perform an analysis. Add a rule to deny all other traffic.
• C) Remove the instance from the Auto Scaling group. Enable Amazon GuardDuty in that AWS account. Install the Amazon Inspector agent on the suspicious EC2 instance to perform a scan.
• D) Take a snapshot of the suspicious EC2 instance. Create a new EC2 instance from the snapshot in a closed security group with ingress only from a single forensic IP address to perform an analysis.

---

Definitions:

Interaction-Transaction Process

A communication theory model that emphasizes the reciprocal nature of interactions, where each party in the communication process affects and is affected by the other.

Reaction

In a general context, it refers to the act of responding to a stimulus or situation.

Perception

The process by which individuals organize and interpret their sensory impressions to give meaning to their environment.

Conceptual Models of Nursing

Theoretical frameworks that guide the practice of nursing by providing a specific worldview and a set of concepts for patient assessment and care.