A retailer finds an EC2 web server mining cryptocurrency, still connected to an RDS database with customer orders. The team must stop lateral movement, preserve evidence, eradicate the miner, and restore service quickly. Which containment, eradication, and recovery sequence meets all goals?
Select an answer to reveal the explanation.
Short Explanation
You’re thinking like a responder who contains first and cleans second. Quarantine and credential revocation cut off lateral movement, while a snapshot preserves evidence for later analysis.
Full Explanation
Isolating the instance with a restrictive quarantine security group limits network paths, and revoking its instance-role credentials prevents stolen tokens or active sessions from being used against RDS. Taking a forensic snapshot before rebuilding helps preserve evidence and its chain of custody; rebuilding from a known-good AMI then removes the compromised host from service and provides a trusted recovery path. Rebooting the instance and blocking the mining-pool domain fails because persistence and stolen credentials can survive a restart, while alternate paths remain open, so lateral movement is not contained. Copying logs to S3 and patching in place cannot guarantee removal of rootkits or credential theft; rotating only the EC2 key pair also leaves database passwords and role sessions available for attacker reuse. Detaching the instance from the load balancer and vertically scaling it may change traffic distribution or performance, but does not cut VPC east-west paths or invalidate credentials, and an antivirus scan does not establish eradication or safe recovery. Exam caveat: follow the sequence contain, preserve evidence, eradicate, then recover from a trusted source. In practice, verify that the quarantine security group blocks egress, credentials are revoked, and the restored AMI is verified.