CS0-003 Security Operations Practice Question
A cloud security analyst is investigating an alert from AWS GuardDuty that indicates an EC2 instance is communicating with a known malicious IP address. The instance is part of an auto-scaling group. What is the best immediate action?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the instance by modifying its security group to deny all traffic.
Isolating the instance by removing it from the security group or using a quarantine VPC prevents further communication while preserving forensic data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Isolate the instance by modifying its security group to deny all traffic.
Why this is correct
Modifying the instance's security group to deny all inbound and outbound traffic effectively isolates it from the network. This containment strategy immediately stops any ongoing malicious activity from spreading or exfiltrating data, while crucially preserving the instance's current state, memory, and disk for subsequent forensic analysis. This allows security analysts to investigate the root cause, understand the attack vector, and gather evidence without destroying critical information.
- ✗
Terminate the instance immediately to stop the threat.
Why it's wrong here
Terminating the instance immediately, while seemingly stopping the threat, irrevocably destroys valuable forensic evidence. This includes volatile memory contents, active process information, temporary files, and potentially unlogged network connections, which are crucial for understanding the attack's scope and methodology. Without this evidence, a thorough root cause analysis becomes impossible, hindering efforts to prevent similar future incidents.
- ✗
Ignore the alert because auto-scaling groups are ephemeral.
Why it's wrong here
Ignoring an alert, even for an instance within an auto-scaling group, is a critical misstep in incident response. While auto-scaling instances can be ephemeral, the underlying vulnerability, misconfiguration, or malicious artifact (e.g., a compromised AMI or container image) that led to the alert might persist and propagate to newly launched instances. This approach fails to address the root cause and leaves the environment vulnerable to continued compromise.
- ✗
Update the GuardDuty threat list to ignore that IP.
Why it's wrong here
Updating a security service like GuardDuty to ignore a specific IP address identified as malicious is counterproductive and severely degrades the security posture. GuardDuty's threat lists are designed to identify and alert on known bad actors; whitelisting a malicious IP creates a dangerous blind spot, allowing continued communication with a known threat actor without triggering further alerts. This action actively undermines the security controls in place.
Go deeper
Related to this question
Learn chapter
Cloud Vulnerability Management
Key term
GuardDuty
AWS GuardDuty is a managed threat detection service that continuously monitors for malicious activity and unauthorized behavior in an AWS environment.
Key term
Alert
An alert is a notification that something unusual or potentially harmful has happened in a computer system or network.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.