GuardDuty flags an EC2 instance for crypto-mining. IR must preserve evidence while cutting the instance off from the network immediately. Which first actions isolate it?
A.Terminate the instance and let the ASG replace it
Termination destroys the evidence you need for forensics.
B.Replace its security group with a no-access SG, then snapshot the EBS volumes and capture memory
Correct. SG swap isolates the instance while preserving running state for capture.
C.Stop the instance, then investigate the stopped volume
Stop wipes memory — volatile evidence is lost before you can capture it.
D.Add a NACL deny for its subnet and move on
NACLs are subnet-level — they'd also block your forensic access and affect neighbors.
Why this answer
Swap the instance's SG for a forensics SG (no inbound/outbound except your forensic tools) — quarantine without destroying state — then snapshot EBS and capture memory/disk for analysis. Terminating or stopping destroys volatile evidence.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Incident Response practice session.
Practice Incident Response