A SOC lead must brief the team on the sequence of phases to follow when a confirmed compromise of an EC2 instance is under investigation. Which listing gives the correct order?
Show answer and explanation
Answer: B
The phases follow the NIST-style lifecycle that AWS guidance uses: preparation, detection and analysis, containment, eradication, recovery, and then lessons learned. Evidence should be preserved during containment, before any termination, so that analysis remains possible. Reversing or skipping phases, such as terminating before investigating, loses information and can leave the attacker in place.
Why the other options are wrong
- A. Shutting down first destroys volatile memory and running-process evidence before anyone analyzes it. Leadership briefing and root-cause work should follow containment, not replace it.
- C. Starting with recovery brings systems back before the threat is contained, so the attacker can re-enter. Preparation has to come first, not last.
- D. Accepting the risk and postponing patches leaves the compromise active and ignores containment entirely. This sequence is not an incident response method.