In-Cloud IR in AWS and Event-Driven Response GCFR Practice Questions (Page 9)

Questions 41–44

1. 41expert · hard

   A security engineer is designing an automated response for a GuardDuty finding that indicates a compromised EC2 instance. The response must: 1) preserve the instance's memory, 2) create an EBS snapshot, 3) isolate the instance, and 4) store the evidence in a separate forensics account. The engineer wants to minimize the time between detection and isolation while ensuring evidence is collected. Which approach best balances these requirements?

   • AUse an SNS notification to alert an analyst who manually performs the steps.
   • BUse AWS Config to detect the finding and trigger a Lambda function that only snapshots the instance.
   • CUse a Step Functions state machine triggered by CloudWatch Events that invokes Lambda functions to capture memory, snapshot the instance, isolate it, and copy the snapshot to the forensics account.
   • DUse a single Lambda function triggered by GuardDuty that isolates the instance immediately and then snapshots it.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   During an incident, a security engineer needs to establish a baseline of the configuration of a compromised EC2 instance and its associated security group. The instance is still running and the engineer wants to capture the configuration state without altering the instance. Which approach best achieves this?

   • ARun a script on the instance to collect system configuration and network settings.
   • BUse AWS Config to record the configuration history of the instance and security group, then review the configuration items and changes over time.
   • CTake an EBS snapshot of the instance's root volume and analyze the snapshot offline.
   • DReview CloudTrail logs for any API calls that modified the instance or security group.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   In the AWS shared responsibility model, which of the following is the customer's responsibility during a forensic investigation of an EC2 instance?

   • AReplacing failed hardware that supports the EC2 instance
   • BSecuring the physical data center that houses the EC2 instance
   • CPreserving and analyzing data within the guest operating system and applications
   • DPatching the hypervisor that hosts the EC2 instance
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   When using AWS Lambda for automated incident response, which of the following is a typical action a Lambda function can perform?

   • ADirectly access the memory of an EC2 instance
   • BChange the AWS account's root password
   • CModify security group rules to isolate a compromised EC2 instance
   • DReboot the physical host of an EC2 instance
   Reveal Solution Discussion Select an answer first