Question

A security engineer must perform forensic analysis on a compromised EC2 instance after a GuardDuty finding. The incident-response plan requires that all evidence be preserved in a legally defensible manner and that analysis occur without altering the original volumes. The compromised instance runs in a production account. Which approach best preserves forensic integrity while enabling investigation?

Accepted Answer

Create EBS snapshots of the instance's volumes, copy the snapshots into a dedicated isolated forensics account, create volumes from the copies, and attach them to a hardened analysis instance for examination.

Answer

Stop the compromised instance, detach its volumes, and reattach them directly to a forensics instance running in the same production account.

Answer

Enable termination protection on the instance and run analysis tools directly on the live compromised instance to capture volatile data before shutting it down.

Answer

Terminate the compromised instance immediately and rely on the most recent AWS Backup recovery point to reconstruct the volumes for later analysis.