AWS Certified Security – Specialty — Question 191

A security engineer has noticed that VPC Flow Logs are getting a lot of REJECT traffic originating from a single Amazon EC2 instance in an Auto Scaling group.
The security engineer is concerned that this EC2 instance may be compromised.
What immediate action should the security engineer take?

Answer options

• A. Remove the instance from the Auto Scaling group. Close the security group with ingress only from a single forensic IP address to perform an analysis.
• B. Remove the instance from the Auto Scaling group. Change the network ACL rules to allow traffic only from a single forensic IP address to perform an analysis. Add a rule to deny all other traffic.
• C. Remove the instance from the Auto Scaling group. Enable Amazon GuardDuty in that AWS account. Install the Amazon Inspector agent on the suspicious EC2 instance to perform a scan.
• D. Take a snapshot of the suspicious EC2 instance. Create a new EC2 instance from the snapshot in a closed security group with ingress only from a single forensic IP address to perform an analysis.

Correct answer: A

Explanation

The correct action is to remove the instance from the Auto Scaling group and restrict access to it for forensic analysis, which is what option A recommends. Options B and C suggest modifying network access or enabling security services, which do not provide immediate isolation of the suspected instance. Option D involves taking a snapshot but does not isolate the original instance in a timely manner.