An e-commerce EC2 fleet in an Auto Scaling group shows ransomware behavior on two instances, with GuardDuty Malware Protection findings and suspicious outbound traffic. The team must stop spread, preserve forensics, and restore service within two hours without losing customer data. Which containment and recovery sequence should the responder execute to handle affected resources?
Select an answer to reveal the explanation.
Short Explanation
You've got to stop the fire before you can rebuild the house, so you'll lock those instances down first. Your quarantine holds the spread while you snapshot evidence, then you can terminate and bring back clean replacements.
Full Explanation
The correct sequence succeeds because it satisfies all three concurrent goals in the proper order: restrictive quarantine security groups immediately cut lateral movement and suspicious outbound command-and-control without destroying state, EBS snapshots preserve disk artifacts for GuardDuty Malware Protection follow-up and chain-of-custody analysis, and terminating tainted nodes with clean Auto Scaling replacements restores e-commerce capacity within the two-hour objective without carrying ransomware persistence or risking customer-data loss. The quarantine-plus-terminate-and-replace workflow without snapshots is a standard rapid-containment playbook that restores service quickly, but it fails the forensics concept by destroying evidence needed to determine initial vector and scope. The isolate-snapshot-then-await-analysis workflow reflects sound thorough forensic practice, yet it fails the time-bound recovery concept because extended offline reverse-engineering keeps capacity degraded beyond the two-hour service requirement. The snapshot-terminate-and-restore workflow without prior network isolation is also widely used for fault recovery and preserves evidence, but it fails the containment concept because unquarantined hosts can continue encrypting peers and exfiltrating during snapshot and replacement. On exams, watch for stems demanding contain, preserve, and restore together under time pressure and eliminate choices satisfying only two pillars; in practice, verify quarantine attachment with revoked egress, confirm snapshot completion and tags before termination, and launch replacements only from validated golden images with customer data reattached from clean backups.