A company wants the ability to cut a suspected instance off from the network within seconds during an incident, without engineering the steps at 3 a.m. What should they prepare in advance?
Show answer and explanation
Answer: B
A pre-built automation document encodes the isolation procedure, typically tagging the instance, attaching a security group with no allow rules, optionally snapshotting volumes for evidence and notifying the on-call analyst. Because the steps were tested beforehand, the responder supplies only an instance ID and the runbook does the rest consistently.
This also produces a record of exactly what was done and by whom.
Why the other options are wrong
- A. NACLs apply at the subnet level, so a deny-all template isolates every workload in that subnet rather than one instance.
- C. Security groups cannot express deny rules. Isolation is achieved by attaching a group that allows nothing, not by writing deny entries.
- D. Endpoint policies govern which requests may pass through a VPC endpoint. They do not control an instance's general network access.
Exam tip. Security groups allow only; isolation means an empty group, not a deny rule.