CCSP Cloud Security Operations Practice Question
A security analyst is investigating a potential compromise of an AWS EC2 instance. Which step should be taken FIRST to contain the incident and prevent further damage?
⚠ Common exam trap
A common misconception is that immediate termination (Option A) is the fastest containment method, but this violates the principle of preserving evidence and may hinder forensic investigation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the EC2 instance by updating the security group to deny all traffic.
The first priority in incident response is containment. Updating the security group to deny all traffic immediately isolates the EC2 instance from network communication, preventing lateral movement or data exfiltration while preserving the instance for further investigation. This aligns with the NIST SP 800-61 incident response framework, which emphasizes containment before eradication or recovery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Terminate the EC2 instance immediately.
Why it's wrong here
Termination may destroy evidence; containment is preferred initially.
- ✗
Take a snapshot of the instance for forensic analysis.
Why it's wrong here
Snapshots are for evidence collection, but containment should come first to stop active threats.
- ✓
Isolate the EC2 instance by updating the security group to deny all traffic.
Why this is correct
Modifying the security group effectively isolates the instance.
- ✗
Disable the IAM role attached to the instance.
Why it's wrong here
While helpful, it doesn't stop network-level access; isolation is more immediate.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.