Incident Response
Free AWS Certified Security – Specialty (SCS-C03) practice — 6 questions on Incident Response, with explanations. No sign-up. Full 12-question mixed test →
A security team discovers that an IAM role's credentials have been exposed in a public GitHub repository for approximately 72 hours. CloudTrail logs show the credentials were used to launch 50 EC2 instances across multiple regions, create several S3 buckets, and modify security group rules. The role has AdministratorAccess policy attached. What is the MOST effective immediate response to contain this incident?
Attaching an explicit Deny policy immediately prevents any further actions using the compromised credentials (including temporary credentials already issued) while maintaining the role for forensic analysis. Rotating credentials invalidates the exposed keys. This approach provides immediate containment while preserving evidence and not disrupting other potential legitimate uses if the role is shared.
During incident response, a security analyst needs to preserve forensic evidence from a potentially compromised EC2 instance running in a production VPC. The instance must remain running for business continuity, but all existing EBS snapshots are over 48 hours old. Compliance requires evidence preservation within 15 minutes of detection and maintaining chain of custody. Which approach BEST satisfies these requirements?
This approach addresses all requirements: termination protection prevents accidental deletion; isolation contains the threat while maintaining business operations via SSM for authorized access; encrypted snapshots preserve evidence; sharing to forensics account maintains chain of custody; documentation provides audit trail. The instance remains running (business continuity) while evidence is secured within 15 minutes.
A company's security team receives an Amazon GuardDuty finding: 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS' indicating that temporary credentials from an EC2 instance profile are being used from an external IP address in a different country. CloudTrail shows API calls to DescribeInstances, DescribeSecurityGroups, and ListBuckets from this external IP. What is the MOST comprehensive containment strategy?
This is the most comprehensive approach: revoking active sessions immediately invalidates compromised temporary credentials (preventing further unauthorized access); modifying trust policy prevents future credential use from external IPs while maintaining functionality from the VPC; requiring IMDSv2 prevents SSRF-based credential theft that likely caused the initial compromise; role rotation ensures any persistent access mechanism is eliminated. This addresses both immediate containment and root cause.
An organization detects unusual AWS API activity in their CloudTrail logs showing AssumeRole calls from a federated identity that successfully assumed an administrative role, but the source IP address is from a known malicious TOR exit node. The federated identity uses SAML 2.0 integration with their on-premises Active Directory. Investigation reveals the SAML assertion appears valid with correct attributes. What is the MOST likely attack vector and appropriate response?
The SAML assertion being valid indicates the attack occurred at the identity provider level, not AWS. An attacker with stolen AD credentials can complete the legitimate SAML authentication flow, generating valid assertions. The TOR exit node IP confirms unauthorized access. The response correctly addresses the compromised credentials at the source (AD), revokes active AWS sessions, and implements location-based controls at the IdP to prevent recurrence. This addresses both the immediate threat and strengthens authentication controls.
A security team is investigating a suspected data exfiltration incident. VPC Flow Logs show 500GB of data transferred from a private subnet to an unknown external IP over port 443 during a 3-hour window. The subnet hosts RDS databases and application servers with no direct internet access (NAT Gateway in public subnet). CloudTrail shows no unauthorized API activity. What is the MOST effective forensic investigation approach to identify the exfiltration source and method?
This approach provides comprehensive forensic analysis: Athena efficiently queries existing VPC Flow Logs to identify the specific source ENI/instance without waiting for new data; cross-referencing with EC2 provides instance identity; CloudWatch Logs may contain application evidence (if logging was enabled); Traffic Mirroring provides ongoing monitoring if the exfiltration continues. This uses existing data first (fastest results) then adds active monitoring. The investigation proceeds from network layer to application layer systematically.
During a security incident, an analyst discovers that an attacker has gained access to an AWS account and created multiple IAM users with programmatic access. The attacker then deleted CloudTrail trails, disabled GuardDuty, and modified Config rules. However, AWS Config recorded configuration changes before being disabled. The company has AWS Organizations with CloudTrail configured at the organization level logging to a separate security account. What is the BEST approach to reconstruct the complete attack timeline and identify all compromised resources?
This is the most complete and technically accurate approach: organization-level CloudTrail logs in the security account remain intact even when account-level trails are deleted (providing complete API event history); Athena efficiently queries this data with specific event filters; AWS Config timeline shows resource state changes; EventBridge event history provides recent events (last 90 days); Cost and Usage Reports validate unexpected resource creation. This uses multiple independent data sources to build a complete timeline and identify all affected resources, even after the attacker attempted to cover their tracks.
Ready for the real thing?
The full course: two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed explanations.
$119.99 $34.99 with code FREETEST33 — valid through August 23.
Get my $34.99 deal →