A fintech company's GuardDuty alert shows an EC2 instance in a shared application subnet, 10.20.4.0/24, sending traffic to a known malicious IP address. The subnet also holds 30 other instances that must stay online, and the instance must keep running for forensics.
The team's runbook applies the instance-level control first, then uses the subnet network ACL only to cut connections that the instance-level change leaves open. The engineer must be able to restore the original settings later, and must confirm the result in the logs.
Put these steps in the order the team should do them, first step first.
Put these 4 steps in order.
AA. Add a network ACL deny rule for the instance's private IP address, as a /32 rule with a number lower than the subnet allow rules, to cut off connections that are already open.
BB. Record the instance ID, its network interface ID and the IDs of its current security groups in the case file.
CC. Create an isolation security group with no inbound or outbound rules, and attach it to the instance's network interface in place of the existing groups.
DD. Check the VPC flow logs for rejected traffic from the instance address, and confirm that no new connections from it are accepted.
Show the answer and explanation
Correct order: B, C, A, D
B. Record the instance ID, its network interface ID and the IDs of its current security groups in the case file. First: the team records the original settings before it changes anything, so the isolation can be reversed later. The identifiers also go into the evidence record for the case.
C. Create an isolation security group with no inbound or outbound rules, and attach it to the instance's network interface in place of the existing groups. Second: the runbook applies the instance-level control first, and the swap stops new traffic from the instance. It does not end connections that are already tracked, so a network ACL step is still needed.
A. Add a network ACL deny rule for the instance's private IP address, as a /32 rule with a number lower than the subnet allow rules, to cut off connections that are already open. Third: changing a security group does not end connections that are already tracked, so the runbook uses the network ACL next. A /32 rule removes only this instance from the subnet traffic, so the other 30 instances keep working.
D. Check the VPC flow logs for rejected traffic from the instance address, and confirm that no new connections from it are accepted. Fourth: the flow logs confirm the result only after the isolation is in place. Checking earlier would show traffic that is still being allowed.
Explanation
Isolation starts by recording the original settings so they can be restored. The security group swap blocks new traffic, and a targeted /32 network ACL deny then cuts the tracked connections that the swap leaves open. Flow logs confirm that the traffic is rejected.
Want more on Containing, eradicating and recovering from security events? The 5 full-length practice sets have 8 more Containing, eradicating and recovering from security events questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →