Practice questions: AWS Certified Security - Specialty exam objectives

During an active incident, a responder needs to isolate a compromised EC2 instance from the network immediately while preserving its memory and disk state for forensic analysis, without terminating it. Which combination of actions best achieves this?

• AImmediately terminate the instance to stop the attacker
• BDetach the instance from its current security group and attach an isolation security group with no inbound or outbound rules, snapshot the EBS volume(s), and capture a memory dump before any further action
• CChange the instance's IAM role only
• DEnable termination protection and take no further action

Keyboard shortcuts: Off