A Security Engineer received an AWS Abuse Notice listing EC2 instance IDs that are reportedly abusing other hosts. Which action should the Engineer take based on this situation? (Choose three.)
A.
Use AWS Artifact to capture an exact image of the state of each instance.
B.
Create EBS Snapshots of each of the volumes attached to the compromised instances.
C.
Capture a memory dump.
D.
Log in to each instance with administrative credentials to restart the instance.
E.
Revoke all network ingress and egress except for to/from a forensics workstation.
B. Create EBS Snapshots of each of the volumes attached to the compromised instances.
C. Capture a memory dump.
E. Revoke all network ingress and egress except for to/from a forensics workstation.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
sensor
Highly Voted 3 years, 7 months agodpvnme
Highly Voted 3 years, 7 months agoRaphaello
Most Recent 1 year, 1 month agosapien45
2 years, 9 months agoMoreOps
3 years agoRadhaghosh
3 years, 3 months agohk436
3 years, 5 months agosanjaym
3 years, 5 months agoNANDY666
3 years, 5 months agonasreenazad57
3 years, 6 months agodevjava
3 years, 6 months agoAfricanCloudGuru
3 years, 6 months agoMichaelHoang
3 years, 6 months agosatbim
3 years, 6 months agoavinasht
3 years, 6 months agohozefa
3 years, 6 months agoADVIT
3 years, 6 months agoRaySmith
3 years, 6 months ago