AWS Certified Security - Specialty SCS-C02 — Topic 1 Question 197

Question

A company has an application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are in an Amazon EC2 Auto Scaling group and are attached to Amazon Elastic Block Store (Amazon EBS) volumes. A security engineer needs to preserve all forensic evidence from one of the instances. Which order of steps should the security engineer use to meet this requirement?

Accepted Answer

Correct answer: C. The correct answer is C. Option C: Detach the instance from the Auto Scaling group. Deregister the instance from the ALB. Take an EBS volume snapshot of the instance and store the snapshot in an Amazon S3 bucket. Take a memory snapshot of the instance... Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon S3 provides durable, scalable object storage that is fully managed. Amazon EBS provides block storage attached to a single EC2 instance.

AWS Certified Security - Specialty SCS-C02 — Question 197