Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 197 discussion

Option B

Option D

Option B does not detach the instance from the Auto Scaling group or deregister it from the ALB before stopping it, which can lead to unexpected instance termination or further data changes from incoming traffic. This makes it unsuitable for preserving forensic evidence effectively. Option C follows the correct sequence to ensure that the instance is properly isolated and that both memory and disk snapshots are taken in a way that preserves the integrity of forensic evidence. For these reasons, Option C is the correct approach to ensure the proper preservation of forensic evidence, while Option B may lead to potential data loss or contamination due to improper ordering of steps.

Correct answer is A. 1. Acquire Evidence 2. Isolation 3. Stop the Instance

This order ensures that the volatile memory is captured before the instance is stopped, preserving all necessary forensic evidence.

Correct answer is D. Instance should not be stopped