Incident Response

During a security incident involving suspected data exfiltration from an S3 bucket, which THREE sources provide the most relevant telemetry to determine what files were accessed?

Your company has a multi-account environment managed by AWS Organizations. A security incident reveals that a member account has been compromised. You must prevent the attacker from disabling CloudTrail or deleting logs in that account while maintaining central visibility. What is the most effective approach?

An incident response team discovers an unauthorized IAM user created an access key in a production environment. The team must identify the exact time of key creation and the IP address used for the call. Which AWS service provides this forensic detail?

Refer to the exhibit. An incident responder needs to access the production-data bucket to investigate a breach. They apply this policy to their IAM user, but get 'Access Denied' when running 'aws s3 ls s3://production-data'. Why?

An organization wants to improve their ability to respond to security incidents. Which TWO of the following services provide centralized visibility and management for security findings?

An organization is preparing for a potential incident and wants to ensure that responders can quickly access logs across multiple accounts. Which architecture is recommended for centralized log management?

An organization's security team detects an active data exfiltration event originating from a compromised Amazon EC2 Linux instance. The instance contains critical forensic evidence that must be preserved. What is the most effective immediate containment action that prevents external communication while retaining the memory state for forensic analysis?

A security incident indicates an EC2 instance is likely compromised and communicating with a C2 server. The security team needs to perform memory forensics and isolate the instance while preserving evidence. Which TWO actions should the team perform?

An organization detects unauthorized access to an Amazon S3 bucket containing sensitive customer data. The Security team needs to immediately isolate the bucket while ensuring logs are preserved for forensic analysis. Which action should the team take first?

A security engineer investigating a security alert discovers that an IAM role in an AWS account has been modified by an unknown external entity. The engineer needs to determine the exact API call that introduced the malicious policy change and identify the associated source IP address. Which AWS service provides the most definitive and historically accurate audit trail for this investigation?

Refer to the exhibit. An incident responder observes that an attacker bypassed this S3 bucket policy and accessed objects from an IP address outside the 192.0.2.0/24 range. What is the most likely reason for this access?

An organization experiences a ransomware attack that encrypts data across several EBS volumes. The team needs to restore operations as quickly as possible. Which strategy minimizes the impact of the incident while ensuring data integrity?