ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

A security group functions as a stateful virtual firewall; with no inbound or outbound rules it blocks all traffic by default. Attaching such a deny-all security group immediately severs the instance's network connectivity while it keeps running, so its memory and disks remain intact for later forensic collection. Stopping the instance flushes RAM and alters disks, destroying volatile evidence. Patching software or rotating credentials changes system state and can overwrite artifacts before they are captured. Terminating and rebuilding the instance eradicates any remaining evidence entirely. Therefore, network isolation via a restrictive security group (or an equivalent deny-all network ACL) is the correct first step.