DOP-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a snapshot of the instance's root volume

  Why it's wrong here

  Creating a snapshot of the instance's root volume does not isolate the instance from incoming traffic or from the Auto Scaling group. The instance remains fully operational and continues to serve requests, so an ongoing security incident or resource exhaustion is not mitigated. Snapshots only provide a point-in-time copy for backup or offline forensic analysis later, and the act of snapshotting does not stop processes, network connections, or lifecycle actions.

• ✓

  Detach the instance from the Auto Scaling group and remove it from the load balancer

  Why this is correct

  Detaching the instance from the Auto Scaling group and removing it from the load balancer is the correct first step because it immediately stops new traffic from reaching the instance while also preventing the ASG from automatically replacing or terminating it. This preserves the running state for forensic collection, including memory and volatile data, and allows you to investigate safely without the instance being scaled away or continuing to affect production traffic. The instance stays alive but is decoupled from both the horizontal scaling and the request path.

• ✗

  Create an AMI of the instance for analysis

  Why it's wrong here

  Creating an AMI of the instance for analysis is not an immediate isolation measure. AMI creation takes time and does not prevent the instance from receiving traffic or being managed by the Auto Scaling group, so the instance could be modified or terminated during the capture process. Additionally, an AMI only captures the root volume and some attached volumes at a certain point, but it does not preserve memory, network connections, or other ephemeral evidence, and it does not stop the instance from continuing its malicious or affected behavior.

• ✗

  Terminate the instance immediately

  Why it's wrong here

  Terminating the instance immediately destroys critical forensic evidence, including the root volume, instance store volumes, and any in-memory data that might be needed to determine the root cause of the alert. It also causes the Auto Scaling group to launch a replacement instance, which can spread the issue or lead to data loss. In incident response, termination is a last resort after evidence collection, not a first step, because without the instance you lose visibility into what actually happened.

Go deeper

Related to this question