A Security Engineer received an AWS Abuse Notice listing EC2 instance IDs that are reportedly abusing other hosts.
Which action should the Engineer take based on this situation? (Choose three.)

A. Use AWS Artifact to capture an exact image of the state of each instance.

B. Create EBS Snapshots of each of the volumes attached to the compromised instances.

C. Capture a memory dump.

D. Log in to each instance with administrative credentials to restart the instance.

E. Revoke all network ingress and egress except for to/from a forensics workstation.

F. Run Auto Recovery for Amazon EC2.




 

Suggested Answer: BCE

Community Answer: BCE




This question is in SCS-C01 AWS Certified Security – Specialty Exam
For getting AWS Certified Security – Specialty Certificate


Disclaimers:
The website is not related to, affiliated with, endorsed or authorized by Amazon.
Trademarks, certification & product names are used for reference only and belong to Amazon.
The website does not contain actual questions and answers from Amazon's Certification Exam.