mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A cloud security team uses AWS and has configured…
A cloud security team uses AWS and has configured a virtual private cloud (VPC) with a public subnet for a web application. The web servers in the public subnet have security groups that allow inbound HTTP/HTTPS from 0.0.0.0/0. The security team receives an alert that an EC2 instance in the public subnet is making outbound connections to an IP address that is listed on a threat intelligence feed as a known mining pool. The instance's security group allows all outbound traffic. The team suspects the instance is compromised and running cryptocurrency mining malware. Which of the following should be the FIRST action to take?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the instance by revoking its security group egress rules temporarily to prevent further communication.
The first action should be to isolate the instance to immediately stop communication with the mining pool. This is achieved by revoking the security group egress rules (Option A), which contains the threat. Option B (running a scan) allows the attack to continue. Option C (terminating after snapshot) loses volatile evidence. Option D (inbound rule) does not block outbound connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Isolate the instance by revoking its security group egress rules temporarily to prevent further communication.
Why this is correct
Immediate containment by blocking outbound traffic stops the malware from phoning home.
- ✗
Start a full antivirus scan on the instance and monitor the network logs.
Why it's wrong here
Scanning is slow and does not stop the ongoing communication.
- ✗
Take a forensic snapshot of the instance and then terminate it.
Why it's wrong here
Termination destroys volatile evidence; containment should precede.
- ✗
Modify the security group inbound rules to block traffic from the miner IP only.
Why it's wrong here
Inbound rules control incoming traffic, not outbound; the compromised instance initiates outbound.
Visual reference
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.