SCS-C02 Threat Detection and Incident Response Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Apply a new security group that denies all inbound and outbound traffic to the instance.

  Why this is correct

  Applying a new security group that denies all inbound and outbound traffic immediately severs the instance's network path at the hypervisor, cutting off the C2 server connection without killing the process or losing memory artifacts. Because security group changes are applied instantly across the VPC, this containment step is faster than OS-level firewall rules and avoids tipping off the attacker. The instance remains powered on, allowing you to capture a memory dump and disk image for forensic analysis before any restoration or termination.

• ✗

  Remove the security group from the Auto Scaling group to isolate the instance.

  Why it's wrong here

  Removing the security group from the Auto Scaling group only alters the launch template or configuration for instances that are launched in the future; it has no effect on already-running instances. The compromised instance retains its current security group attachments, so the C2 communication continues unabated. To isolate the instance, you would need to modify the instance's own security groups directly, not the Auto Scaling group definition.

• ✗

  Terminate the EC2 instance immediately to stop the communication.

  Why it's wrong here

  Terminating the EC2 instance immediately stops the C2 traffic but permanently destroys volatile evidence that is critical to securing the environment, such as memory-resident malware, active network connections, and encryption keys. It also removes the ability to perform live response or memory forensics, and the instance cannot be recovered. In incident response, containment should be reversible, and you should first isolate and capture evidence before taking a destructive action like termination.

• ✗

  Create an AMI of the instance for forensic analysis and then terminate the instance.

  Why it's wrong here

  Creating an AMI of the instance is a forensic snapshot, but it does not interrupt the active C2 channel while the EBS snapshots and AMI registration are in progress; the attacker can continue to exfiltrate data or delete logs during that time. Additionally, although you can use the 'No Reboot' flag to avoid a reboot, the snapshot process itself takes the disk asynchronously, so the image may include an altered or incomplete state. Only after full isolation would it be safe to create an image and then terminate.

Go deeper

Related to this question