A sophisticated cyber-attack has targeted an organization, and the forensic team is called upon for incident response. Their assets are largely hosted on AWS, particularly using S3 and EC2 instances. As a forensic investigator, your first step to retaining valuable evidence in the EC2 instances is:

A. Retrieve and analyze log data from the affected EC2 instances

B. Encrypt all the data present in the EC2 instances to avoid further unauthorized access

C. Immediately isolate the affected EC2 instances from the network to avoid data corruption

D. Create a snapshot of the EBS volume in the affected EC2 instance and share it with the forensic team for analysis








 

Suggested Answer: D

Community Answer: D



This question is in 312-49V10 EC-Council Computer Hacking Forensic Investigator (CHFI) v10 Exam
For getting EC-Council Computer Hacking Forensic Investigator (CHFI) Certificate







Disclaimers:
The website is not related to, affiliated with, endorsed or authorized by EC-Council. 
Trademarks, certification & product names are used for reference only and belong to EC-Council.
The website does not contain actual questions and answers from EC-Council's Certification Exams.