Câu 16: 312-40: Certified Cloud Security Engineer

TetraSoft Pvt. Ltd. is an IT company that provides software and application services to numerous customers across the globe. In 2015, the organization migrated its applications and data from on-premises to the AWS cloud environment. The cloud security team of TetraSoft Pvt. Ltd. suspected that the EC2 instance that launched the core application of the organization is compromised. Given below are randomly arranged steps involved in the forensic acquisition of an EC2 instance. In this scenario, when should the investigators ensure that a forensic instance is in the terminated state?

1. A. After attaching evidence volume to the forensic instance
2. B. Before taking a snapshot of the EC2 instance
3. C. After creating evidence volume from the snapshot — đáp án hiện tại
4. D. Before attaching evidence volume to the forensic instance