In-Cloud IR in AWS and Event-Driven Response GCFR Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security team wants to automatically isolate an EC2 instance as soon as Amazon GuardDuty reports a finding of type 'UnauthorizedAccess:EC2/SSHBruteForce'. The isolation should modify the instance's security group to remove all inbound rules. Which AWS service should be used to trigger the Lambda function that performs the security group modification?

   • AAmazon Simple Notification Service (SNS) topic directly invoking Lambda
   • BAWS Config rule that checks security group rules
   • CAmazon CloudWatch Events (EventBridge) rule that matches GuardDuty findings
   • DAWS Step Functions state machine with a scheduled trigger
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which AWS storage service is designed for long-term archival of forensic evidence that is rarely accessed, offering low storage costs?

   • AAmazon S3 Glacier
   • BAmazon EFS
   • CAmazon EBS
   • DAmazon S3 Standard
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security analyst discovers that an IAM user's access key was used to launch several EC2 instances in a region where the company does not operate. The analyst needs to determine the full scope of API actions performed with that key. Which combination of steps will provide the most complete forensic picture?

   • ACheck the IAM user's last used access key report to see the last time the key was used.
   • BReview the EC2 instance launch logs in the AWS Management Console to see which instances were created by that user.
   • CUse AWS Config to list all EC2 instances and compare their launch times to the user's login history.
   • DQuery CloudTrail for all events where the user's access key ID appears, including read-only events, and correlate with the instance IDs returned.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which AWS service provides network traffic logs that include source and destination IP addresses, ports, and protocol for traffic within a VPC?

   • AAmazon GuardDuty
   • BAWS CloudTrail
   • CVPC Flow Logs
   • DAWS Config
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security team wants to automatically isolate an EC2 instance when GuardDuty reports a finding of type 'UnauthorizedAccess:EC2/SSHBruteForce'. The team has created a Lambda function that modifies the instance's security group to remove all inbound rules. Which configuration is necessary to trigger the Lambda function automatically?

   • AConfigure the Lambda function to poll GuardDuty for new findings every minute.
   • BCreate a CloudWatch Events rule that matches GuardDuty findings and targets the Lambda function.
   • CSet up an S3 bucket notification that triggers the Lambda function when a new object is uploaded.
   • DUse AWS Config rules to detect the security group change and invoke the Lambda function.
   Reveal Solution Discussion Select an answer first