AWS Certified Security – Specialty — Question 127

After multiple compromises of its Amazon EC2 instances, a company's Security Officer is mandating that memory dumps of compromised instances be captured for further analysis. A Security Engineer just received an EC2 abuse notification report from AWS stating that an EC2 instance running the most recent Windows
Server 2019 Base AMI is compromised.
How should the Security Engineer collect a memory dump of the EC2 instance for forensic analysis?

Answer options

• A. Give consent to the AWS Security team to dump the memory core on the compromised instance and provide it to AWS Support for analysis.
• B. Review memory dump data that the AWS Systems Manager Agent sent to Amazon CloudWatch Logs.
• C. Download and run the EC2Rescue for Windows Server utility from AWS.
• D. Reboot the EC2 Windows Server, enter safe mode, and select memory dump.

Correct answer: C

Explanation

The correct answer is C because EC2Rescue for Windows Server is specifically designed to capture memory dumps from EC2 instances effectively. Option A is incorrect as AWS does not typically handle memory dumps directly; Option B does not provide a direct way to capture a memory dump, and Option D may not ensure a complete and accurate memory dump in a compromised state.