Question

Your security operations team receives a Security Command Center finding indicating a Compute Engine VM in a production project is communicating with a known cryptomining command-and-control endpoint. The incident response runbook requires that you preserve volatile and disk evidence for forensic analysis while immediately stopping the malicious outbound traffic, and you must minimize the risk of the attacker detecting your response. Which sequence of actions best meets these requirements?

Accepted Answer

Apply a deny-all egress firewall rule tagged to the VM (or move it to a quarantine network), take a disk snapshot, capture a memory image, then detach the disk for offline forensic analysis.

Answer

Delete the VM immediately to stop the attack, then restore from the most recent snapshot into an isolated project for analysis.

Answer

Stop the VM instance right away, then create a snapshot of the boot disk and share it with the forensics team.

Answer

Reset the VM's SSH keys and rotate all service account credentials, then continue monitoring the traffic in Cloud Logging to gather more evidence.