Question

A security engineer is responding to a confirmed compromise of a running Linux EC2 instance that hosts a suspected fileless malware process. Management wants to preserve the maximum amount of forensic evidence for later analysis while following proper forensic order of volatility. The instance must remain running long enough to complete evidence collection before being isolated and terminated. Which sequence of actions best preserves the most volatile evidence first?

Accepted Answer

Capture the contents of instance memory (RAM) using an SSM Run Command that runs a memory-acquisition tool, then create an EBS snapshot of the attached volumes, and finally collect CloudTrail and VPC Flow Logs.

Answer

Create an EBS snapshot of the root volume first, then capture instance memory, then stop the instance to preserve its state, and finally export CloudTrail logs.

Answer

Immediately stop the instance to freeze its state, create an AMI, then attempt to recover memory contents from the stopped instance's EBS snapshot.

Answer

Detach the EBS volumes and attach them to a forensic workstation first, then capture memory, then gather CloudTrail and VPC Flow Logs.