AWS Certified Security - Specialty SCS-C02 — Topic 1 Question 239

Question

A company finds that one of its Amazon EC2 instances suddenly has a high CPU usage. The company does not know whether the EC2 instance is compromised or whether the operating system is performing background cleanup. Which combination of steps should a security engineer take before investigating the issue? (Choose three.)

Accepted Answer

Correct answer: B, C, E. The correct answer is B, C, E. Option B: Enable termination protection for the EC2 instance if termination protection has not been enabled. Option C: Take snapshots of the Amazon Elastic Block Store (Amazon EBS) data volumes that are attached to the EC2 instance. Option E: Capture the EC2 instance metadata, and then tag the EC2 instance as under quarantine. Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon EBS provides block storage attached to a single EC2 instance.

AWS Certified Security - Specialty SCS-C02 — Question 239