Forensic evidence capture and preservation: SCS-C03 study notes and practice questions
What to know about Forensic evidence capture and preservation for the SCS-C03 exam, from the Incident Response domain (14% of the exam guide), then 1 free question to test it. Part of the SCS-C03 study guide.
These questions describe a compromised instance or account and a team that must both stop the damage and prove what happened. You choose the capture method that keeps evidence intact, and you avoid the common reflex of terminating the machine, which destroys what the investigation needs.
Capture before you change
Take EBS snapshots of every attached volume before you patch, rebuild or terminate. A snapshot is a point-in-time copy of the disk, including data volumes, not only the root volume.
Copy the snapshots to a forensics account and encrypt the copy with a KMS key that the forensic team controls. Share the key with that account in its key policy, and do not make snapshots public.
Preserve logs. Copy CloudTrail, flow logs and application logs to a bucket with S3 Object Lock, so the attacker cannot delete them and retention cannot be shortened.
Record chain of custody: what was captured, when, by whom and with what identifier.
Isolate without destroying
Isolate rather than stop. A quarantine security group, with a network ACL deny when tracked sessions must end, keeps the instance running so its memory survives. The containment topic covers these options.
Stopping an instance halts running processes and loses memory. It keeps EBS data. Terminating deletes the root volume by default and loses instance store data in every case.
Collect live state through Session Manager or Run Command rather than SSH keys, and log the session.
How to choose
Scenario wording
Pick
Keep the disk contents of a compromised instance for analysis
Snapshot every attached EBS volume before any change
Give the forensic team copies without production access
Encrypted snapshots shared to a forensics account with the KMS key shared too
Preserve logs under legal hold
Copy to an S3 bucket with Object Lock
Capture data on an instance store volume
Copy it before any stop, because stopping erases it
Collect OS state from an instance without opening SSH
Session Manager or Run Command
Common traps
Terminating the instance to clean up before snapshots exist.
Assuming termination keeps the root volume. The root volume is deleted on termination by default unless the setting is changed.
Stopping an instance and expecting memory to survive. It does not.
Snapshotting only the root volume and missing data volumes that hold the stolen records.
Sharing a snapshot publicly to make analysis easier.
Using the compromised role to copy evidence, which the attacker could also alter.
A healthcare SaaS company gets a GuardDuty finding that a production EC2 instance is contacting a known command-and-control server. The instance runs a patient-scheduling service. It must not be stopped or rebooted, because malware that exists only in memory must be preserved for analysis.
The responder can reach the instance only through AWS Systems Manager Run Command, which needs outbound access to the Systems Manager endpoints. The isolation security group that the team plans to use blocks all outbound traffic. The responder must also preserve the EBS volumes and record the case number on the instance.
Which sequence of steps should the responder follow?
Choose one answer.
AA. Stop the instance to freeze its state, snapshot the EBS volumes, capture a memory image from the stopped disk, and then tag the instance with the case number.
BB. Swap the instance to the isolation security group, capture memory with Run Command, snapshot the EBS volumes, and then tag the instance with the case number.
CC. Tag the instance with the case number, capture memory with Run Command, then swap to the isolation security group and snapshot the EBS volumes.
DD. Snapshot the EBS volumes and tag the case first, then swap to the isolation group, and skip the memory capture because the disks hold the evidence.
Show the answer and explanation
Answer: C
A. Wrong: Stopping the instance breaks the rule that it must not be stopped, and it clears the memory that must be preserved. A disk snapshot cannot recover the process state that existed in memory.
B. Wrong: Once the isolation group blocks all outbound traffic, Systems Manager Run Command cannot reach its endpoints, so the memory capture would fail. The capture has to run before the swap.
C. Right: Correct. Tagging records the case, and the memory capture runs while Run Command can still reach the instance. The swap then cuts the command-and-control traffic, and the snapshots preserve the disks without stopping the service. Learn more: Run Command in Systems Manager (opens in a new tab)
D. Wrong: Disk snapshots miss malware that exists only in memory, and they do not hold the running process state. Skipping the memory capture breaks the requirement to preserve it.
Explanation
Memory is volatile, so it is captured first while the responder can still reach the instance. Isolation then stops the traffic, and snapshots preserve the disks without stopping the service. Stopping the instance, isolating before the capture and skipping memory each break a stated constraint.
Want more on Forensic evidence capture and preservation? The 5 full-length practice sets have 8 more Forensic evidence capture and preservation questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →