An EC2 instance is confirmed compromised and must be isolated NOW while preserving it for forensics. What's the FIRST containment step?
A.Terminate it immediately
Termination destroys forensic evidence.
B.Replace its security group with an isolated/deny-all SG, then snapshot its volumes
Isolate → snapshot = containment without destruction. Correct.
C.Stop the instance
Stopping takes time and still leaves it compromised during shutdown.
D.Enable flow logs on it
Logging is monitoring — not containment.
Why this answer
Standard IR playbook: isolate first (swap to a quarantine SG with no inbound/outbound) — cuts the attacker without destroying evidence. THEN snapshot EBS volumes for forensics. Terminating loses memory/state evidence; stopping takes longer and allows continued activity until stopped.
Correct answer: B · Last reviewed 2026-11-05
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Incident Response practice session.
Practice Incident Response