Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 246 discussion

Changing security groups associated with a running instance does not interrupt existing connections.

Create a new security group that has no inbound rules or outbound rules. Attach the new security group to the EC2 instance. This method: Is fast, reversible, and non-destructive. Immediately isolates the instance from the network. Complies with the requirement to keep the EC2 instance running.

I go with A, why? - It not break another instance in same subnet, just only the instance. - Immediatly stopping the connection.

Modifying Security Group Rule NEVER disrupts its tracked connections • Existing connections are kept until they time out • Use NACLs to interrupt/block connections immediately!!

sorry I meant C is the better option

while a new SG with no rules would immediately isolate an instance, the old security group would still provide connections, the question did not mention removing or replacing it. D seems to be the better option here

Creating a new security group with no inbound or outbound rules and attaching it to the EC2 instance will effectively isolate the instance from any network traffic, both incoming and outgoing. This method is quick and ensures that the instance remains running while being contained. It avoids the need to modify existing security groups or network ACLs, which could affect other resources. This approach provides immediate containment, allowing you to maintain the instance's state for further investigation and remediation.

Given that there are no other resources in the subnet apart from the EC2 instance, the most immediate and effective way to contain the instance while keeping it running is: C. Create a new network ACL that has a single Deny rule for inbound traffic and outbound traffic. Associate the new network ACL with the subnet that contains the EC2 instance. This approach will instantly isolate the EC2 instance from the network by denying all inbound and outbound traffic at the subnet level, ensuring no accidental connections can be made.

When you need to immediately contain an EC2 instance while keeping it running, applying a security group with no inbound or outbound rules is the fastest and most effective way to isolate the instance.

nacl is stateless and will have immediate isolation effect while sgs will continue to let connections be until they end, we dont care about other ec2s in the subnet because there arent any