AWS Security Specialty (SCS-C03) Practice Questions - AWS Certified Security - Specialty (SCS-C03) Exam

Access More Questions

GuardDuty has produced a high-severity finding for a compromised EC2 instance generating cryptocurrency-mining traffic. Which sequence best preserves forensic evidence while stopping the threat?

Terminate the instance immediately so the threat cannot spread Snapshot the EBS volumes, isolate the instance with a quarantine security group, then capture a memory dump before stopping it Reboot the instance and detach its IAM role Change the SSH key pair and leave the instance running for monitoring

Correct Answer:

Snapshot the EBS volumes, isolate the instance with a quarantine security group, then capture a memory dump before stopping it

Access more questions from this quiz

Continue to AWS Security Specialty (SCS-C03) Practice Questions - AWS Certified Security - Specialty (SCS-C03) Exam for more practice questions and the full quiz experience.

Access More Questions