In-Cloud IR in AWS and Event-Driven Response GCFR Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security analyst is investigating a potential data exfiltration from an EC2 instance. The analyst has VPC Flow Logs enabled for the instance's ENI. The logs show traffic to an external IP on port 443, but the analyst needs to determine whether the traffic was actually encrypted HTTPS or plaintext HTTP. Which additional data source would best help the analyst make this determination?

   • AAWS Config configuration history for the security group
   • BPacket capture from the EC2 instance or a network tap
   • CAWS CloudTrail logs for the EC2 instance
   • DAmazon GuardDuty findings
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A forensic investigator is reconstructing the actions of a compromised IAM user in an AWS account. The user's access key was used to launch EC2 instances and modify an S3 bucket policy. The investigator needs to determine the exact sequence of API calls made by that user, including the source IP addresses and the user agent. Which AWS service or feature should be the primary source of this information?

   • AAWS CloudTrail event history in the CloudTrail console
   • BAWS Config configuration history
   • CVPC Flow Logs
   • DAmazon GuardDuty findings
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which S3 feature can automatically move forensic evidence objects from S3 Standard to Glacier after a specified number of days, reducing storage costs while preserving the data?

   • AS3 Object Lock
   • BS3 Lifecycle policy
   • CS3 Versioning
   • DS3 Replication
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In a VPC Flow Log record, which field indicates whether the traffic was accepted or rejected by the security group or network ACL?

   • Aprotocol
   • Baction
   • Cbytes
   • Dsrcaddr
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   During an incident, a security analyst discovers that an IAM user's access key was used to delete an S3 bucket. The analyst needs to determine whether the deletion was performed by the legitimate user or by an attacker who stole the key. The analyst has access to CloudTrail logs. Which additional data source would be most helpful to correlate the API call with the legitimate user's activity?

   • AVPC Flow Logs for the user's workstation IP address
   • BAWS CloudTrail logs from the user's corporate network
   • CThe user's corporate authentication logs and VPN logs
   • DAWS Config configuration history for the S3 bucket
   Reveal Solution Discussion Select an answer first