Eccouncil Exam 312-49 Topic 1 Question 7 Discussion

Actual exam question for Eccouncil's 312-49 exam

Question #: 7
Topic #: 1

An EC2 instance storing critical data of a company got infected with malware. The forensics team took the EBS volume snapshot of the affected Instance to perform further analysis and collected other data of evidentiary value. What should be their next step?

AThey should pause the running instance

BThey should keep the instance running as it stores critical data

CThey should terminate all instances connected via the same VPC

DThey should terminate the instance after taking necessary backup

Show Suggested Answer

Suggested Answer: B

by Levi at May 05, 2022, 08:02 AM

Limited Time Offer

25%

Off

Get Premium 312-49 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Sanjuana

17 days ago

I'd say D is the winner here. Terminating the instance is the smart move, but make sure you've got that backup ready to go. Don't want to end up like those poor dinosaurs, you know?

upvoted 0 times

...

Asha

21 days ago

Option D seems like the most logical step. Keeping the instance running (option B) is just asking for trouble, and terminating all instances (option C) is overkill.

upvoted 0 times

...

Sylvia

22 days ago

I'd go with option D as well. Better safe than sorry when it comes to critical data security. Gotta love a good ol' fashioned 'terminate and backup' plan!

upvoted 0 times

...

Beckie

28 days ago

Pausing the instance (option A) might not be enough, as the malware could still be active. Terminating it after backup is the most prudent choice.

upvoted 0 times

Artie

10 days ago

A) They should terminate the instance after taking necessary backup

upvoted 0 times

...

2 months ago

I think they should pause the running instance.

upvoted 0 times

...