Exam AWS Certified Security - Specialty topic 1 question 211 discussion

D. You'll want to make a copy of the EBS volume in case anything goes wrong with the original instance.

D is the correct answer.

D. You always want a copy of the EBS volume

To ensure the instance is not further manipulated, the engineer should remove it from the Auto Scaling group and the Elastic Load Balancer. The instance should be placed in an isolation security group. Then, the engineer should create a copy of the EBS volume from a new snapshot, launch an EC2 instance with a forensic toolkit, and attach the copied EBS volume to investigate, thereby preserving the original evidence while conducting a thorough analysis.

The most effective steps to take to ensure that the instance is not further manipulated, while allowing the engineer to understand what happened, would be option D: Remove the instance from the Auto Scaling group and the Elastic Load Balancer. Place the instance within an isolation security group, make a copy of the EBS volume from a new snapshot, launch an EC2 instance with a forensic toolkit, and attach the copy of the EBS volume to investigate. By removing the instance from the Auto Scaling group and the Elastic Load Balancer, you isolate the compromised instance from any further interactions with the environment, reducing the risk of further manipulation or potential impact on other resources.

D. You want to make a copy of the EBS

The EBS snapshot needs to be done to preserve the chain of evidence. The question implies that we will be performing a memory dump from the forensic tool kit. Therefore D would be the best answer.

I would say B as, memory investigation is more critical than disk investigation. Plus, with option B you can do both memory and disk investigation.

B, as the issue is with instance and not EBS (its not shown in anomaly). Also with D you are not doing any forensic on the compromised instance - only on EBS

D is right as per documentation.

Answer is D. Below blog talks about it. Look at page 4 https://pages.awscloud.com/rs/112-TZM-766/images/How%20to%20Perform%20Investigations_SANS_AWS%20Marketplace_whitepaper.pdf

D. In computer forensics there's a concept of a forensic copy. The snapshot of the EBS volume is the forensic copy. When a forensic analyst makes a copy so the original evidence is preserved and can work with the copy instead.

D is the Option (Very Close B & D) --> but EBS Snapshot is the key

D for me

I think it should be B. You'll need the running instance to investigate what's go wrong.

D, easy

D. EBS snapshot is important here