In-Cloud IR in AWS and Event-Driven Response GCFR Practice Questions (Page 7)

Questions 31–35

1. 31expert · medium

   A security analyst is investigating a potential account compromise. The analyst suspects that an IAM user's credentials were used to perform unauthorized actions. The analyst needs to determine the exact time and source IP of the unauthorized API calls. Which data source should the analyst use?

   • AAWS Config configuration history, which records resource changes.
   • BVPC Flow Logs, which capture network traffic to and from EC2 instances.
   • CCloudTrail event history, which includes the user, source IP, and timestamp for each API call.
   • DGuardDuty findings, which provide threat detection alerts.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   To ensure CloudTrail logs are available for forensic analysis after an incident, which of the following is a best practice?

   • AEnable CloudTrail in a single region only to reduce log volume
   • BDisable CloudTrail after an incident to stop further logging
   • CEnable CloudTrail for all regions and store logs in an S3 bucket with versioning enabled
   • DStore CloudTrail logs in the same S3 bucket as the compromised instance's data
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A forensic investigator has created an EBS snapshot of a compromised EC2 instance. To preserve the evidence for potential legal proceedings, the investigator needs to ensure the snapshot is not accidentally deleted and that its integrity can be verified later. Which combination of actions best meets these requirements?

   • AMove the snapshot to a different AWS Region and enable deletion protection
   • BCopy the snapshot to an S3 bucket and enable versioning
   • CApply a legal hold tag, enable IAM policies that prevent deletion, and record the SHA-256 hash of the snapshot's data
   • DStore the snapshot in an S3 bucket with a lifecycle policy that transitions it to Glacier after 30 days
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   When preserving an EBS snapshot as forensic evidence, which of the following actions helps establish the integrity of the evidence?

   • AStore the snapshot in a public AMI
   • BRename the snapshot to a generic name to avoid attention
   • CDelete the original volume immediately after taking the snapshot
   • DRecord the snapshot ID and the SHA-256 hash of the snapshot data
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security team is building an automated response to a GuardDuty finding that indicates a compromised EC2 instance. The response must: 1) isolate the instance by removing its public IP, 2) create a forensic snapshot, and 3) notify the incident response team. The team wants to ensure that the isolation step completes before the snapshot is taken, and that the notification is sent only after both steps succeed. Which AWS service should be used to orchestrate this sequence?

   • AAWS Step Functions
   • BA single AWS Lambda function that performs all steps
   • CAWS Systems Manager Automation document
   • DMultiple CloudWatch Events rules that trigger separate Lambda functions
   Reveal Solution Discussion Select an answer first