312-49V11: Computer Hacking Forensic InvestigatorDemo

Question

An EC2 instance that stores a company’s critical data became infected with malware. The forensics team took an EBS volume snapshot of the affected instance for further analysis and collected other evidence of forensic value. What should they do next?

A They should terminate all instances connected via the same VPC
B They should pause the running instance
C They should keep the instance running as it stores critical data
D They should terminate the instance after taking necessary backup

Explanation

After forensic artifacts and required backups have been preserved, the malware-infected EC2 instance should be terminated to eliminate the compromised resource. AWS documentation requires retaining needed data in persistent storage before termination; an EBS snapshot provides that preserved copy for analysis.

Learn more

Terminate Amazon EC2 instances

312-49V11: Computer Hacking Forensic InvestigatorDemo

AstroTutor

Notes

Readiness

QuestionQ79

Community Discussion