AWS Cloud Security and Incident Response Automation GASAE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which AWS service uses threat intelligence and anomaly detection to identify potential security threats in an AWS environment?

   • AAWS Config
   • BAWS Security Hub
   • CAWS CloudTrail
   • DAmazon GuardDuty
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What type of information is typically found in a CloudTrail log event?

   • AThe identity of the caller, the API action, and the time of the request
   • BThe contents of all S3 objects stored in the account
   • CThe CPU utilization metrics of EC2 instances
   • DThe network packets transmitted between EC2 instances
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is designing an automated security control for a new application. The control must automatically remediate any EC2 instance that has a security group allowing SSH from 0.0.0.0/0. The company wants to follow the AWS Well-Architected Security Pillar principles. Which design should be used?

   • ADeploy a CloudFormation template that includes an AWS Config rule to detect the open security group and a Lambda function to remediate it by removing the inbound rule.
   • BUse a Lambda function that runs every hour to check all security groups and remove any SSH rule from 0.0.0.0/0.
   • CUse AWS Systems Manager to run a script on each instance to modify its security group.
   • DUse AWS GuardDuty to detect the open security group and automatically remove the rule.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company wants to detect cryptocurrency mining activity on their EC2 instances. They want to automatically respond by isolating the affected instance and notifying the security team. Which AWS service should be used to detect the activity?

   • AAWS Security Hub
   • BAWS Config
   • CAWS CloudTrail
   • DAWS GuardDuty
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company has enabled GuardDuty in their AWS account. They want to automatically isolate an EC2 instance that is flagged for cryptocurrency mining. The security team has set up an EventBridge rule that triggers a Lambda function. The Lambda function must modify the instance's security groups to remove all inbound and outbound traffic. What is the most effective way to isolate the instance?

   • ACreate a new security group that denies all traffic, and replace the instance's existing security groups with this new group using the Lambda function.
   • BUse the Lambda function to delete the instance's security groups, leaving it with no security group association.
   • CUse the Lambda function to modify the instance's route table to remove all routes, thereby cutting off network connectivity.
   • DUse the Lambda function to stop the instance immediately, and then detach its network interfaces.
   Reveal Solution Discussion Select an answer first