A security engineer needs to develop a process to investigate and respond to potential security events on a company's Amazon EC2 instances. All the EC2 instances are backed by Amazon Elastic Block Store (Amazon EBS). The company uses AWS Systems Manager to manage all the EC2 instances and has installed Systems Manager Agent (SSM Agent) on all the EC2 instances.
The process that the security engineer is developing must comply with AWS security best practices and must meet the following requirements:
A compromised EC2 instance's volatile memory and non-volatile memory must be preserved for forensic purposes.
A compromised EC2 instance's metadata must be updated with corresponding incident ticket information.
A compromised EC2 instance must remain online during the investigation but must be isolated to prevent the spread of malware.
Any investigative activity during the collection of volatile data must be captured as part of the process.
Which combination of steps should the security engineer take to meet these requirements with the LEAST operational overhead? (Choose three.)
pupsik
Highly Voted 11 months, 2 weeks agoaguilar404
6 months, 1 week agobukkanni
Most Recent 1 month agoFunkyFresco
1 month, 2 weeks agoRobWilliamsToronto
2 months, 2 weeks agoRaphaello
7 months, 4 weeks agocsG13
9 months, 1 week agoSab31
9 months, 2 weeks agoDaniel76
9 months, 1 week agoDaniel76
9 months, 3 weeks agoRaphaello
9 months, 3 weeks agoawssecuritynewbie
10 months, 2 weeks agolalee2
11 months, 1 week agoKR693
11 months, 2 weeks ago0dd
12 months agokk2000
1 year ago