Question

A security team detects that an EC2 instance in a production VPC has been compromised and is actively communicating with an external command-and-control server. The incident-response runbook requires that the instance be contained for forensic analysis without terminating it, and that all subsequent investigative steps be automated and repeatable across future incidents. Which sequence of actions BEST meets these containment and forensics requirements?

Accepted Answer

Trigger a Systems Manager Automation runbook that attaches an isolation security group with no inbound/outbound rules, enables termination protection, captures an EBS snapshot and memory dump, and tags the instance for investigation.

Answer

Terminate the instance immediately to stop the C2 traffic, then restore the most recent AMI backup into a new subnet for analysis.

Answer

Modify the VPC route table to blackhole all traffic from the subnet, then manually SSH into the instance to collect logs before rebooting it.

Answer

Detach the instance's IAM role, stop the instance to halt the C2 process, and copy the root EBS volume to an S3 bucket for offline review.