SCS-C02 Threat Detection and Incident Response Practice Question

A company has an incident response (IR) process that includes isolating compromised EC2 instances. During a security incident, the IR team needs to block all traffic to and from a compromised instance while preserving the instance for forensic analysis. Which approach should the team take?

⚠ Common exam trap

It's easy for candidates to confuse security groups (stateful, instance-level) with network ACLs (stateless, subnet-level) and incorrectly assume that updating the NACL is the correct way to isolate a single instance without affecting other instances in the subnet.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Modify the security group associated with the instance to remove all inbound and outbound rules.

Modifying the security group to remove all inbound and outbound rules effectively blocks all traffic to and from the EC2 instance because security groups act as a stateful virtual firewall at the instance level. This approach preserves the instance in its current running state, allowing the IR team to perform forensic analysis without the risk of the instance being tampered with or communicating with external systems.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Detach the instance from the Auto Scaling group and stop it.
Why it's wrong here
Detaching the instance from the Auto Scaling group and stopping it halts the OS and powers down the hardware, which destroys volatile memory (RAM) and can alter on-disk artifacts through shutdown processes. A proper incident response workflow requires capturing memory and disk state before any power transition, so this action irreversibly loses live forensic evidence. It also fails to provide network containment while the instance is still running before the stop completes.
✓
Modify the security group associated with the instance to remove all inbound and outbound rules.
Why this is correct
Modifying the instance's security group to remove all inbound and outbound rules is the correct containment step because security groups are instance-level stateful firewalls, and deleting every rule immediately terminates existing and new connections while leaving the instance powered on. This preserves volatile memory and running processes for live forensics, and because the change applies only to that security group, other instances and the overall subnet remain unaffected. It is preferable to a NACL change, which would block traffic to the entire subnet.
✗
Update the network ACL for the subnet to deny all traffic.
Why it's wrong here
Updating a Network ACL (NACL) fails because it operates at the subnet level, denying all traffic for *every* instance within that subnet, not just the compromised one. This would cause an unnecessary wider service disruption, contrary to the requirement for instance-specific isolation. NACLs are tempting as they provide stateless, coarse-grained filtering, and would be the correct choice if the entire subnet required isolation or if broad traffic denial for a whole subnet was the objective.
✗
Terminate the instance immediately.
Why it's wrong here
Terminating the instance immediately destroys the primary source of forensic evidence: the root EBS volume is deleted by default, and any memory-resident artifacts are lost forever, making root-cause analysis impossible. Unlike stopping, termination also sends a hard destroy signal that may trigger cleanup routines and is not reversible, even if a snapshot was later restored. The IR process should preserve the instance and its data, not delete it, to allow deep investigation.

Go deeper

SCS-C02 Threat Detection and Incident Response Practice Question

Why each option matters

Option-by-option breakdown

Related to this question