An organization wants to trigger an automated response whenever a specific IAM user calls the 'ec2:RunInstances' API. The response should create a snapshot of the new instance and tag it with the user's name. Which approach should be used?

Use AWS Config to detect the new instance and trigger a Lambda function via an SNS topic.

Create a CloudWatch Events rule that matches the 'RunInstances' API call and targets a Lambda function that snapshots and tags the instance.

Set up a VPC Flow Log that triggers a Lambda function when traffic is detected from the new instance.

Enable GuardDuty and create a custom finding that triggers the Lambda function.

During an incident, a security analyst notices that a security group was modified to allow inbound RDP from 0.0.0.0/0. The analyst needs to determine when this change occurred, what the previous rules were, and which IAM user made the change. Which combination of AWS services would provide this information?

AWS Trusted Advisor and AWS CloudTrail

Amazon Inspector and AWS Config

AWS Config configuration history and AWS CloudTrail

VPC Flow Logs and Amazon GuardDuty

A security engineer is designing an automated response for GuardDuty findings. The response should collect evidence from the affected EC2 instance and then isolate it. Which combination of services would best achieve this?

Use GuardDuty to directly invoke a Lambda function that snapshots the instance and modifies the security group.

Use an SNS topic to notify a security analyst who manually performs the snapshot and isolation.

Use AWS Config to detect the finding and trigger a Lambda function that isolates the instance.

Use a CloudWatch Events rule to trigger a Step Functions state machine that runs a Lambda function to snapshot the instance and then modify its security group.

A security team wants to automatically respond to a GuardDuty finding of type 'Backdoor:EC2/C&CActivity.Botnet' by isolating the EC2 instance and notifying the incident response team. The team has already created a Lambda function that modifies the instance's security group. What is the most direct way to trigger this Lambda function when the GuardDuty finding occurs?

Create an Amazon SNS topic and subscribe the Lambda function to it, then have GuardDuty publish to the SNS topic

Create an AWS Config rule that checks for the GuardDuty finding and triggers the Lambda function

Create a CloudWatch alarm based on the GuardDuty finding metric and trigger the Lambda function

Create an Amazon EventBridge rule that matches the GuardDuty finding event and targets the Lambda function

GIAC Cloud Forensics Responder

Domain 4Objective 3

In-Cloud IR in AWS and Event-Driven Response GCFR Practice Questions (Page 8)

Part of the Amazon Web Services Forensics domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 4–8 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

12concepts

Questions 36–40

36application · medium
An organization wants to trigger an automated response whenever a specific IAM user calls the 'ec2:RunInstances' API. The response should create a snapshot of the new instance and tag it with the user's name. Which approach should be used?
Select an answer first
37application · medium
During an incident, a security analyst notices that a security group was modified to allow inbound RDP from 0.0.0.0/0. The analyst needs to determine when this change occurred, what the previous rules were, and which IAM user made the change. Which combination of AWS services would provide this information?
Select an answer first
38foundation · easy
Which AWS service aggregates security findings from multiple sources, such as GuardDuty, Inspector, and Macie, into a single dashboard for centralized visibility?
Select an answer first
39application · medium
A security engineer is designing an automated response for GuardDuty findings. The response should collect evidence from the affected EC2 instance and then isolate it. Which combination of services would best achieve this?
Select an answer first
40application · medium
A security team wants to automatically respond to a GuardDuty finding of type 'Backdoor:EC2/C&CActivity.Botnet' by isolating the EC2 instance and notifying the incident response team. The team has already created a Lambda function that modifies the instance's security group. What is the most direct way to trigger this Lambda function when the GuardDuty finding occurs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

In-Cloud IR in AWS and Event-Driven Response GCFR Practice Questions (Page 8)

Questions 36–40

An organization wants to trigger an automated response whenever a specific IAM user calls the 'ec2:RunInstances' API. The response should create a snapshot of the new instance and tag it with the user's name. Which approach should be used?

Which AWS service aggregates security findings from multiple sources, such as GuardDuty, Inspector, and Macie, into a single dashboard for centralized visibility?

A security engineer is designing an automated response for GuardDuty findings. The response should collect evidence from the affected EC2 instance and then isolate it. Which combination of services would best achieve this?

Keep studying — Amazon Web Services Forensics