CCSP Cloud Security Operations Practice Question
During a cloud incident response, a security team needs to isolate a compromised EC2 instance to prevent further communication with an external command-and-control server. Which step should be taken first?
⚠ Common exam trap
In cloud incident response, it's important to distinguish between containment (blocking network traffic) and preservation (snapshotting or stopping). A common trap is that candidates mistakenly choose 'Stop the EC2 instance' thinking it is the most definitive containment action, not realizing it destroys volatile evidence and is slower to implement than a security group change.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the security group to deny all outbound traffic
Modifying the security group to deny all outbound traffic is the fastest way to cut communication between the compromised EC2 instance and the external C2 server without destroying volatile data. Security groups act as a stateful virtual firewall at the instance level, and changing the outbound rule to deny all traffic immediately blocks any existing or new connections to the C2 IP. This preserves the instance's runtime state for later forensic analysis while containing the threat.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Take a forensic snapshot of the instance’s EBS volume
Why it's wrong here
Snapshot should be taken after isolation to preserve evidence, but isolation is the priority.
- ✗
Revoke the IAM credentials associated with the instance’s role
Why it's wrong here
This prevents API calls but does not stop network traffic.
- ✗
Stop the EC2 instance
Why it's wrong here
Stopping the instance disrupts operations and may lose volatile data; isolation via security group is less disruptive.
- ✓
Modify the security group to deny all outbound traffic
Why this is correct
This immediately stops all network communication from the instance.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.