AWS Certified Security – SpecialtyDomain 1: Incident ResponseHard
A security engineer is investigating a potential compromise of a critical Amazon RDS database instance. They need to collect forensic data from the database, including logs and configuration, without impacting the production workload or altering the original evidence. Which is the MOST appropriate strategy to achieve this?
- ACreate a new RDS read replica from the production instance and perform forensic analysis on the replica.
- BStop the production RDS instance, detach its EBS volumes, and attach them to a forensic EC2 instance for analysis.
- CTake a manual snapshot of the RDS instance, restore it to a new, isolated RDS instance, and perform analysis there.
- DEnable enhanced monitoring and performance insights on the production RDS instance to capture detailed metrics and logs.
Show answer & explanationAnswer & explanation
Correct answer: C. Take a manual snapshot of the RDS instance, restore it to a new, isolated RDS instance, and perform analysis there.
Taking a manual snapshot and restoring it to a new, isolated RDS instance creates a forensic copy of the database at a specific point in time. This allows for in-depth analysis without affecting the production database or modifying the original evidence, which is crucial for forensics.
Why the other options are wrong
- A. Read replicas are continuously updated from the primary, meaning any malicious changes would propagate, making it unsuitable for preserving the compromised state for forensics.
- B. Stopping an RDS instance and manually attaching its EBS volumes to an EC2 instance is not a standard or supported forensic process for RDS, which manages storage internally. It would also cause significant production downtime.
- D. Enhanced monitoring and performance insights collect operational data, not a forensic capture of the database's state, logs, or configuration at the time of compromise. It's for ongoing performance, not incident forensics.
RDS Forensic Snapshot
Creating a manual snapshot of an Amazon RDS instance and restoring it to a new, isolated instance for forensic analysis, preserving the original evidence and avoiding production impact.
- Creates an immutable point-in-time copy.
- Allows analysis in an isolated environment.
- Preserves original evidence without impacting production.
Memory trick: Snapshot and restore: your RDS forensic photocopy.