AWS Cloud Security and Incident Response Automation GASAE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company requires that all S3 buckets use server-side encryption with AWS KMS (SSE-KMS). They want to automate the rotation of the KMS keys used for S3 encryption. What is the most appropriate way to achieve this?

   • ACreate a new KMS key every 30 days and update the S3 bucket policy to use the new key.
   • BEnable automatic rotation of the KMS key, which rotates the backing key annually while keeping the same KMS key ID.
   • CUse AWS Config to detect when a KMS key is older than 90 days and automatically replace it with a new key.
   • DUse AWS Systems Manager Automation to run a script that rotates the KMS key and re-encrypts all S3 objects.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company uses AWS Systems Manager Incident Manager to manage their incident response. They have integrated Security Hub with Incident Manager so that critical findings automatically create incidents. The on-call engineer wants to receive a notification and be able to see the details of the finding in the incident. What should the engineer configure to ensure this happens?

   • AUse AWS Config to evaluate the Security Hub findings and trigger a Systems Manager Automation document to notify the engineer.
   • BEnable CloudTrail to log all Security Hub findings and configure an S3 bucket to store them, then have the engineer manually check the bucket.
   • CCreate an EventBridge rule that triggers a Lambda function to send an email to the on-call engineer whenever a Security Hub finding is created.
   • DCreate a response plan in Incident Manager that includes an Amazon SNS topic for notifications and a chat channel for collaboration, and ensure the Security Hub integration is enabled.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security team wants to detect suspicious network traffic from an EC2 instance, such as communication with a known malicious IP address. They want to automate a response that blocks the traffic by updating the instance's security group to deny all outbound traffic. The detection should be based on VPC Flow Logs. Which approach should be used?

   • AUse AWS Network Firewall to block the traffic and automatically update security groups.
   • BUse AWS GuardDuty to analyze VPC Flow Logs and automatically update security groups when a threat is detected.
   • CUse AWS Config to monitor VPC Flow Logs and trigger a Lambda function to modify security groups.
   • DUse an EventBridge rule that matches on VPC Flow Log entries sent to CloudWatch Logs, and trigger a Lambda function that modifies the security group to remove outbound rules.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company uses AWS Organizations and has GuardDuty enabled in the management account. They want to automate the response to GuardDuty findings across all member accounts. The security team plans to use a Lambda function in the management account that assumes a role in each member account to perform remediation. What is the correct way to grant the Lambda function the necessary permissions?

   • ACreate a single IAM role in the management account and share its credentials with the Lambda function to use in member accounts.
   • BAttach a policy to the Lambda execution role that grants access to all resources in all member accounts by using a wildcard in the resource ARN.
   • CUse the Lambda function to call the GuardDuty API in each member account by specifying the member account ID, without needing any additional permissions.
   • DCreate an IAM role in each member account with a trust policy that allows the Lambda execution role to assume it, and attach a permissions policy that allows the required remediation actions.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security engineer is automating incident response for a multi-account AWS environment. When GuardDuty detects a compromised IAM role, an EventBridge rule triggers a Lambda function that must revoke the role's permissions and notify the security team. The Lambda function needs to assume a role in each member account to perform the remediation. What is the most secure way to grant the Lambda function the necessary cross-account permissions?

   • AAttach an AWS-managed AdministratorAccess policy to the Lambda execution role in the central account, and use the Security Token Service to assume the root user of each member account.
   • BCreate a single IAM user in the central account with programmatic access keys, and store the keys in the Lambda environment variables for use in the member accounts.
   • CUse the Lambda function's execution role to directly modify resources in member accounts by adding the member account IDs to the role's trust policy.
   • DCreate an IAM role in each member account with a trust policy allowing the Lambda execution role to assume it, and attach a permissions policy that allows the Lambda to detach and delete the compromised role's policies.
   Reveal Solution Discussion Select an answer first