GuardDuty flags an EC2 instance communicating with a known botnet C2 server. The IR playbook requires isolating the instance while preserving it for forensics. What's the correct containment step?
A.Terminate the instance immediately
Termination destroys forensic evidence permanently.
B.Swap its security group for a deny-all 'quarantine' SG (and snapshot EBS if needed)
Correct. SG swap isolates live while keeping state for forensics.
C.Stop the instance
Stopping loses memory-resident evidence.
D.Remove its IAM role and nothing else
Removing the role stops API abuse but the instance keeps talking to C2.
Why this answer
Quarantining via an empty security group cuts all network traffic while keeping the instance running — preserving memory and disk state for forensic capture (and EBS snapshots). Terminating destroys evidence; stopping loses volatile memory.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Incident Response practice session.
Practice Incident Response