A cloud workload has been confirmed compromised. A junior analyst wants to terminate the instance immediately to stop the attack. What should the incident lead direct instead?
Select an answer to reveal the explanation.
Short Explanation
Terminating a compromised instance is like bulldozing the crime scene to stop the burglar. You lock the doors instead: cut its network access so the attacker's stuck, and keep everything inside intact for the investigators. The trap is treating speed of deletion as containment.
Full Explanation
In cloud environments, termination is often irreversible: the instance's memory, ephemeral storage, and in some cases attached volumes and metadata are deleted, destroying evidence needed to understand how the attacker entered, what they accessed and whether other systems are affected. Containment can instead be achieved by isolation, applying a restrictive security group or moving the instance to a quarantine network that allows only forensic access, revoking its workload credentials, and protecting it from termination. This stops the attacker while preserving state for memory capture and snapshots. Terminating and rebuilding restores service, but ephemeral storage and memory frequently hold the most relevant artifacts, and a rebuild from the same image may reintroduce the same weakness without the investigation that would reveal it. Rebooting clears volatile memory and running processes, eliminating evidence while leaving persistence and network access in place. Leaving the instance fully connected to production allows continued damage, lateral movement and exfiltration; any decision to observe an attacker must be deliberate, contained and approved, not an alternative to containment. Exam caveat: the usual answer is to isolate and preserve first, then rebuild a clean replacement in parallel. Operational check: confirm the quarantine security group blocks all inbound and outbound traffic except approved forensic access, and that termination protection is enabled.