SCS-C02 Threat Detection and Incident Response Practice Question

During an incident, a security engineer needs to isolate a compromised Amazon EC2 instance without losing the ability to capture forensic data from its EBS volumes. What is the best course of action?

⚠ Common exam trap

Candidates often confuse 'stopping' an instance with 'isolating' it, not realizing that stopping triggers OS shutdown processes that can destroy volatile evidence, whereas modifying the security group to deny all traffic achieves isolation without altering the instance state.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Take a snapshot of the EBS volumes, then detach the instance from the Auto Scaling group and modify the security group to deny all traffic.

Taking a snapshot of the EBS volumes preserves the forensic data before any changes occur, while detaching the instance from the Auto Scaling group prevents automatic replacement, and modifying the security group to deny all traffic isolates the instance without losing the running state or the ability to capture additional volatile data. This approach balances isolation with forensic preservation, ensuring the instance remains available for further analysis if needed.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Terminate the instance immediately and take a snapshot after termination.
Why it's wrong here
Terminating the instance immediately destroys the root EBS volume by default (unless DeleteOnTermination was explicitly disabled), so taking a snapshot 'after termination' is impossible. Even if a volume survived, termination discards memory, running processes, and open network connections, and it triggers Auto Scaling lifecycle actions that can replace the instance and alter the environment before any evidence is preserved.
✓
Take a snapshot of the EBS volumes, then detach the instance from the Auto Scaling group and modify the security group to deny all traffic.
Why this is correct
This is the correct order: first snapshot the EBS volumes to preserve point-in-time disk evidence before any destructive or state-changing action occurs, then detach the instance from the Auto Scaling group so it won't be terminated or replaced by the group, and finally modify the security group by removing all inbound and outbound allow rules to block all network traffic and isolate the host.
✗
Stop the instance, detach the volumes, and attach them to a forensic instance.
Why it's wrong here
Stopping the instance is not a fast enough network isolation method because the shutdown sequence takes time and the instance remains network-reachable during the transition; the guest OS may also run shutdown scripts that alter disk state. While detaching volumes for forensic analysis is a valid later step, doing it before snapshotting and before removing the instance from the Auto Scaling group risks losing evidence and does not immediately isolate the instance from the network.
✗
Change the security group to restrict traffic to only the forensic team's IP addresses.
Why it's wrong here
Changing the security group to allow only forensic-team IPs does not isolate the instance; it still permits network traffic to a potentially compromised host, and because security groups are stateful, existing attacker connections may remain established even after the rules change. Additionally, the instance remains attached to the Auto Scaling group, so the group can still terminate it, and a restrictive allow list does not prevent access if the attacker is using spoofed traffic, a compromised credential, or an already-established tunnel.

Go deeper

SCS-C02 Threat Detection and Incident Response Practice Question

Why each option matters

Option-by-option breakdown

Related to this question