SCS-C02 Threat Detection and Incident Response Practice Question

During a security incident, a security engineer needs to capture network traffic from an EC2 instance for forensic analysis. The instance is part of an Auto Scaling group and may be terminated. What is the MOST efficient way to capture the traffic without affecting the instance's performance?

⚠ Common exam trap

Many exam-takers confuse VPC Flow Logs (metadata only) with full packet capture, or assume that running tcpdump on the instance is acceptable despite the performance impact and risk of data loss upon termination.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use VPC Traffic Mirroring to mirror the instance's network traffic.

VPC Traffic Mirroring captures all network traffic at the hypervisor level without installing agents or consuming instance CPU/memory, making it ideal for forensic analysis of an EC2 instance that may be terminated. It works by copying packets from the source ENI to a target (e.g., a Network Load Balancer or another ENI) for inspection, ensuring zero performance impact on the production instance. This approach preserves traffic even if the instance is later terminated, as the mirror session is tied to the ENI, not the instance lifecycle.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Use VPC Traffic Mirroring to mirror the instance's network traffic.
Why this is correct
VPC Traffic Mirroring copies the full packet payload from the instance's elastic network interface to a target such as a Network Load Balancer or another ENI, operating at the hypervisor level without installing agents or consuming the instance's CPU and memory. Because the capture is passive and out-of-band, it preserves the forensic integrity of the evidence and enables thorough inspection of both inbound and outbound traffic.
✗
Enable VPC Flow Logs for the subnet.
Why it's wrong here
VPC Flow Logs record only connection metadata—source and destination IP addresses, ports, protocol, and the ACCEPT or REJECT action—but they completely omit application payload and raw packet contents. While flow logs help identify which connections occurred and at what volume, they cannot reveal the actual data exchanged, such as malware payloads, command-and-control instructions, or exfiltrated files during an incident.
✗
SSH into the instance and run tcpdump to capture packets.
Why it's wrong here
SSHing into the compromised instance and running tcpdump is high-risk because it modifies the system's operational state, consumes critical CPU and I/O during the investigation, and relies on potentially untrusted binaries that an attacker may have tampered with. Moreover, tcpdump can drop packets when the capture buffer overflows or under heavy traffic, so it does not guarantee a complete, forensically sound record of the network activity.
✗
Attach a Network Load Balancer in front of the instance.
Why it's wrong here
Attaching a Network Load Balancer in front of the instance would reroute new traffic through the balancer, but an NLB provides no native packet-capture or forensic payload logging—it only distributes connections to healthy targets. Additionally, changing the network path mid-incident can disrupt established sessions and alter the traffic flow, making this approach ineffective and potentially destructive for evidence collection.

Go deeper

SCS-C02 Threat Detection and Incident Response Practice Question

Why each option matters

Option-by-option breakdown

Related to this question