AWS Cloud Security and Incident Response Automation GASAE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security engineer needs to be alerted when an IAM user attempts to perform an action that they are not authorized to perform, such as an unauthorized attempt to delete an S3 bucket. The engineer wants to automate a response that revokes the user's temporary credentials and notifies the security team. Which combination of services should be used?

   • AAWS GuardDuty detects the unauthorized attempt and automatically revokes the user's credentials.
   • BCloudTrail logs the denied API call, an EventBridge rule matches the event, and a Lambda function revokes the user's temporary credentials and sends an SNS notification.
   • CAWS CloudWatch Logs captures the denied API call and triggers a Lambda function to revoke the user's credentials.
   • DAWS Config detects the unauthorized attempt and triggers a Lambda function to revoke the user's permissions.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a method to control access to an S3 bucket?

   • ABucket policies
   • BIAM roles only
   • CSecurity groups
   • DNetwork ACLs
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company wants to automate the response to a security incident detected by GuardDuty. The response should include: 1) paging the on-call engineer, 2) creating a ticket in the ticketing system, and 3) executing a runbook that isolates the affected instance. The company also wants to ensure that the on-call engineer is not paged if the incident is a false positive. Which approach should be used?

   • AUse AWS Lambda to page the on-call engineer and create a ticket, and use AWS Config to execute the runbook.
   • BUse AWS Systems Manager Incident Manager to create a response plan that includes the runbook and on-call engagement. Use an EventBridge rule to trigger the response plan only for findings that have a high confidence score.
   • CUse AWS EventBridge to directly page the on-call engineer and create a ticket, and use AWS Systems Manager to execute the runbook.
   • DUse AWS Security Hub to page the on-call engineer and create a ticket, and use AWS Lambda to execute the runbook.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company is implementing an automated incident response workflow for a suspected compromised EC2 instance. The workflow must: 1) isolate the instance, 2) take a forensic snapshot, 3) notify the security team, and 4) if the instance is in a production environment, automatically roll back to a known good state using a CloudFormation stack update. The workflow must also handle failures at any step by sending an alert to a separate on-call channel. Which approach should be used?

   • AUse a single Lambda function that performs all steps sequentially, with custom error handling and branching logic.
   • BUse AWS Step Functions to orchestrate the steps, with Lambda functions for each action, and use a Choice state to branch based on the environment tag. Use Catch blocks to send alerts on failure.
   • CUse AWS EventBridge to orchestrate the steps by chaining multiple rules and Lambda functions.
   • DUse AWS Systems Manager Incident Manager to orchestrate the steps, with Lambda functions for each action.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which AWS service is commonly used to run code in response to security events for automated remediation?

   • AAWS CloudFormation
   • BAmazon EC2
   • CAWS Step Functions
   • DAWS Lambda
   Reveal Solution Discussion Select an answer first