A company has a multi-account AWS environment. A GuardDuty finding in the production account indicates a compromised EC2 instance. The incident response team wants to automatically isolate the instance and collect evidence, but the team must ensure that the response does not affect other instances in the same security group. The team also wants to maintain a record of all actions taken. Which approach best meets these requirements?

Use AWS Systems Manager to run a script on the instance that disables the network interface.

Use a Step Functions state machine in the production account that invokes a Lambda function to create a new security group with no inbound rules, move the instance to that group, and then snapshot the instance. Log all actions to CloudTrail.

Modify the existing security group to remove all inbound rules, which isolates the instance and all others in the group.

Terminate the instance immediately and then create a snapshot from the root volume.

A forensic investigator is writing a Lambda function to automatically create an EBS snapshot of an EC2 instance and tag it with the incident ID. The Lambda function will be triggered by an EventBridge rule. Which IAM permissions must the Lambda function's execution role have?

ec2:CreateSnapshot and ec2:CreateTags on the specific instance and snapshot resources

s3:PutObject and s3:GetObject on the forensics bucket

lambda:InvokeFunction and events:PutRule

ec2:DescribeInstances and ec2:DescribeSnapshots

GIAC Cloud Forensics Responder

Domain 4Objective 3

In-Cloud IR in AWS and Event-Driven Response GCFR Practice Questions (Page 2)

Part of the Amazon Web Services Forensics domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

12concepts

Questions 6–10

6foundation · easy
To trigger an automated forensic response when a high-severity finding appears in AWS Security Hub, which service can be used to route the finding to a Lambda function?
Select an answer first
7foundation · easy
Which AWS feature allows you to create a point-in-time backup of an EC2 instance's EBS volume for forensic preservation?
Select an answer first
8foundation · easy
Which AWS service allows you to run code in response to events without provisioning or managing servers, making it suitable for automated incident response actions?
Select an answer first
9expert · hard
A company has a multi-account AWS environment. A GuardDuty finding in the production account indicates a compromised EC2 instance. The incident response team wants to automatically isolate the instance and collect evidence, but the team must ensure that the response does not affect other instances in the same security group. The team also wants to maintain a record of all actions taken. Which approach best meets these requirements?
Select an answer first
10application · medium
A forensic investigator is writing a Lambda function to automatically create an EBS snapshot of an EC2 instance and tag it with the incident ID. The Lambda function will be triggered by an EventBridge rule. Which IAM permissions must the Lambda function's execution role have?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

In-Cloud IR in AWS and Event-Driven Response GCFR Practice Questions (Page 2)

Questions 6–10

To trigger an automated forensic response when a high-severity finding appears in AWS Security Hub, which service can be used to route the finding to a Lambda function?

Which AWS feature allows you to create a point-in-time backup of an EC2 instance's EBS volume for forensic preservation?

Which AWS service allows you to run code in response to events without provisioning or managing servers, making it suitable for automated incident response actions?

A forensic investigator is writing a Lambda function to automatically create an EBS snapshot of an EC2 instance and tag it with the incident ID. The Lambda function will be triggered by an EventBridge rule. Which IAM permissions must the Lambda function's execution role have?

Keep studying — Amazon Web Services Forensics