AWS Certified Security - Specialty SCS-C03

By Amazon · Question Mode

QuestionQ14

Detection

A company discovers that one of its Amazon EC2 instances suddenly has high CPU utilization. The company does not know whether the EC2 instance has been compromised or whether the operating system is conducting background cleanup.

Which combination of steps should a security engineer take before investigating the issue?

Choose three
Explanation

AWS incident-response guidance for Amazon EC2 calls for acquiring relevant instance metadata, enabling instance protections such as termination protection and applying appropriate quarantine tags, and acquiring disk evidence by taking EBS snapshots of attached volumes. These actions preserve configuration and disk evidence while preventing accidental termination before investigation.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!