Question

During an active investigation of a compromised GCE instance, your SOAR playbook is about to execute a containment action that deletes the instance to stop attacker-controlled outbound traffic. The incident may later result in legal action, and your legal team has requested that all evidence be preserved with a defensible chain of custody. Which modification to the playbook best satisfies both the containment need and the legal preservation requirement?

Accepted Answer

Snapshot the instance's persistent disks and export instance metadata to an immutable, access-logged storage bucket before applying network isolation instead of deleting the instance.

Answer

Delete the instance immediately to halt attacker traffic, then reconstruct evidence from Cloud Logging exports after the fact.

Answer

Leave the instance running and only add a firewall rule blocking outbound traffic, deferring all evidence collection to the manual post-incident phase.

Answer

Stop (power off) the instance so volatile memory is cleared, which prevents further attacker activity and simplifies the forensic image.