Immediate Containment of Compromised EC2 — Stopping Exfiltration While Preserving Evidence
A security engineer notices that an EC2 instance is sending outbound traffic to a known malicious IP address. The instance is part of an Auto Scaling group behind an Application Load Balancer. The engineer needs to immediately stop the exfiltration while preserving forensic evidence. What is the BEST course of action?
Quick Answer
The answer is to remove the instance from the target group and apply a security group that denies all traffic. This approach immediately stops exfiltration by cutting off new connections from the Application Load Balancer and halting any ongoing outbound traffic, all while preserving the EC2 instance and its attached EBS volumes for forensic analysis. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding of incident response containment strategies that prioritize evidence preservation over brute-force actions like termination or shutdown, which would destroy volatile memory and logs. A common trap is choosing to detach the instance or modify the Auto Scaling group, but those actions either lose data or fail to stop traffic instantly. Memory tip: think “isolate, don’t obliterate”—the goal is to quarantine the instance without deleting it, keeping the disk and memory intact for later investigation.
⚠ Common exam trap
Candidates often choose 'Terminate the EC2 instance immediately' (Option B) thinking it stops the exfiltration fastest, but they overlook the need to preserve forensic evidence and the fact that termination destroys the instance and its associated data, making post-incident analysis impossible.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove the instance from the target group and apply a security group that denies all traffic.
Removing the instance from the target group immediately stops new traffic from the Application Load Balancer to the instance, while applying a security group that denies all outbound traffic (e.g., a custom security group with no outbound rules) halts any ongoing exfiltration without destroying the instance or its attached EBS volumes. This preserves the forensic evidence (memory, disk, logs) for later analysis, unlike termination or shutdown which could lose volatile data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Detach the EBS volume from the instance.
Why it's wrong here
Does not stop network traffic.
- ✗
Terminate the EC2 instance immediately.
Why it's wrong here
Terminating destroys evidence.
- ✗
Shut down the instance from within the OS.
Why it's wrong here
May lose volatile data and does not isolate network immediately.
- ✓
Remove the instance from the target group and apply a security group that denies all traffic.
Why this is correct
Stops traffic and preserves the instance for investigation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer notices that an EC2 instance is sending outbound traffic to a known malicious IP address. The engineer needs to quickly block all traffic to that IP while preserving the instance for forensic analysis. Which approach is the most effective?
hard- A.Stop the instance immediately.
- B.Modify the instance's security group to deny outbound traffic to the malicious IP.
- ✓ C.Add a network ACL rule to deny outbound traffic from the instance's subnet to the malicious IP.
- D.Modify the route table to route traffic to the malicious IP to a blackhole.
Why C: Modifying the network ACL to deny outbound traffic to the malicious IP is the most effective approach. Network ACLs are stateless and can explicitly deny traffic, applying at the subnet level. This blocks the traffic immediately while preserving the instance for forensic analysis, as it does not require stopping the instance or affecting its state.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.