A Security Engineer Noticed an Anomaly Within a Company EC2

question 169

Multiple Choice

A security engineer noticed an anomaly within a company EC2 instance as shown in the image. The engineer must now investigate what is causing the anomaly. What are the MOST effective steps to take to ensure that the instance is not further manipulated, while allowing the engineer to understand what happened?

• A) Remove the instance from the Auto Scaling group. Place the instance within an isolation security group, detach the EBS volume, launch an EC2 instance with a forensic toolkit, and attach the EBS volume to investigate.
• B) Remove the instance from the Auto Scaling group and the Elastic Load Balancer. Place the instance within an isolation security group, launch an EC2 instance with a forensic toolkit, and allow the forensic toolkit image to connect to the suspicious instance to perform the investigation.
• C) Remove the instance from the Auto Scaling group. Place the instance within an isolation security group, launch an EC2 instance with a forensic toolkit, and use the forensic toolkit image to deploy an ENI as a network span port to inspect all traffic coming from the suspicious instance.
• D) Remove the instance from the Auto Scaling group and the Elastic Load Balancer. Place the instance within an isolation security group, make a copy of the EBS volume from a new snapshot, launch an EC2 instance with a forensic toolkit, and attach the copy of the EBS volume to investigate.

---

Definitions:

Stack

A method of layering objects or data in a specified sequence, often used in programming and design.

Right-aligned

Text or content that is aligned to the right margin of a page or text container.

Left-aligned

Text formatting where all lines of text start at the left margin of the document, creating a straight line on the left side.

Slide Sorter

A view within presentation software that displays thumbnails of slides, allowing users to reorder and organize slides easily.