Question

A security engineer receives a GuardDuty finding of type CryptoCurrency:EC2/BitcoinTool.B!DNS for a production EC2 instance in an Auto Scaling group. Forensic analysis confirms the instance was compromised through an unpatched application vulnerability that allowed remote code execution. The instance has already been isolated for forensics. The engineer must now perform eradication and recovery so that the Auto Scaling group returns to healthy capacity without reintroducing the same weakness. Which combination of actions BEST accomplishes eradication and recovery?

Accepted Answer

Patch the application vulnerability in the AMI/launch template used by the Auto Scaling group, then terminate the compromised instance so a replacement launches from the remediated configuration.

Answer

Terminate the compromised instance from the Auto Scaling group and rely on the default launch template so a fresh instance is created automatically.

Answer

Restore the compromised instance from its most recent EBS snapshot and reattach it to the Auto Scaling group to restore capacity quickly.

Answer

Stop and start the compromised instance to clear the running crypto-mining processes, then place it back into service in the Auto Scaling group.