AWS Certified DevOps Engineer – ProfessionalIncident and Event ResponseMedium
A DevOps team needs to implement a solution for collecting forensic data from Amazon EC2 instances immediately after a security incident is detected. The solution must be automated, non-intrusive, and capable of collecting memory dumps, disk images, and process lists without manual login to the compromised instance. The collected data should be stored securely for later analysis. Which AWS service or feature is best suited for this task?
- AAWS Security Hub to aggregate security findings and trigger alerts.
- BAWS Systems Manager Automation with pre-defined runbooks for forensic data collection.
- CAWS CloudTrail logs to identify API activity related to the incident.
- DAmazon GuardDuty to detect threats and initiate automated containment actions.
Show answer & explanationAnswer & explanation
Correct answer: B. AWS Systems Manager Automation with pre-defined runbooks for forensic data collection.
AWS Systems Manager Automation allows defining runbooks (automation documents) to execute a series of steps on EC2 instances, including collecting forensic data like memory dumps and disk images, without direct SSH/RDP access. This is ideal for automated, non-intrusive incident response.
Why the other options are wrong
- A. Security Hub aggregates findings but does not perform forensic data collection itself.
- C. CloudTrail logs provide audit trails of API calls but do not collect forensic data from within an instance.
- D. GuardDuty detects threats but focuses on network and account activity, not direct forensic data collection from within an instance like memory dumps.
SSM Automation for Forensics
AWS Systems Manager Automation can be used to automatically collect forensic data (e.g., memory, disk) from EC2 instances after a security incident, without manual access.
- Executes predefined runbooks on instances.
- Non-intrusive, no direct login required.
- Can collect various types of forensic artifacts.
Memory trick: SSM automates the evidence collection.