AWS Certified Security - Specialty SCS-C02 — Topic 1 Question 280

Question

A company runs workloads that are spread across hundreds of Amazon EC2 instances. During a recent security incident, an EC2 instance was compromised and ran malware code until the company manually terminated the instance. The company is now using Amazon GuardDuty to detect malware on EC2 instances. A security engineer needs to implement a solution that automates a response when GuardDuty determines that an instance is infected. The solution must mitigate the incident and must comply with the AWS Well-Architected Framework guidance for incident response. Which solution will meet these requirements?

Accepted Answer

Correct answer: C. The correct answer is C. Option C: Create an AWS Lambda function that runs when a GuardDuty scan determines that an instance is infected. Program the Lambda function to detach all Amazon Elastic Block Store (Amazon EBS) volumes from the instance. Progr... AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon EBS provides block storage attached to a single EC2 instance. Amazon GuardDuty continuously monitors for threats and malicious activity.

AWS Certified Security - Specialty SCS-C02 — Question 280