Question

During an incident, a security engineer discovers that a fleet of 40 EC2 instances running a web application were compromised through an unpatched vulnerability. After containment, the incident-response plan requires the recovery phase to restore the instances to a known-good, fully patched state with minimal manual intervention, and the process must be repeatable and auditable for future incidents. Which approach best meets these recovery requirements?

Accepted Answer

Create a Systems Manager Automation runbook that snapshots each instance, applies the latest approved patch baseline via Patch Manager, and validates the patch state, then invoke it across the fleet using rate control and error thresholds.

Answer

Manually connect to each instance using Session Manager and run the OS package manager update commands, documenting each step in a ticket for auditability.

Answer

Enable AWS Config to detect the noncompliant instances and rely on its automatic remediation to reinstall the operating system on affected hosts.

Answer

Terminate all 40 instances immediately and rely on Auto Scaling to launch replacements from the existing AMI while the investigation continues.