CHFI Application, Email and Cloud Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Review the IAM policies attached to the user to determine if the action was authorized

  Why this is correct

  In an AWS environment, CloudTrail's AccessDenied record indicates the request was evaluated and explicitly rejected by IAM, but it does not reveal why. Reviewing the IAM policies attached to the user — including group and any applicable SCPs — determines whether the action was within authorized scope or whether a policy misconfiguration caused the denial. This also provides context for the user's intent, distinguishing a legitimate attempt from a potential unauthorized access probe, making it the correct first forensic step.

• ✗

  Immediately disable the IAM user account

  Why it's wrong here

  Disabling the IAM user immediately is a hasty and potentially destructive response to a single CloudTrail AccessDenied event, which occurs routinely even during normal operations. It can disrupt active workflows and may invalidate active sessions, destroying transient evidence and alerting the user before the investigation with proper collection of logs and artifacts. Only after analyzing the event in context, correlating with IAM policies and the user's baseline activity, should the examiner consider disabling the account as a containment measure.

• ✗

  Escalate the issue to law enforcement

  Why it's wrong here

  Escalating an AccessDenied event to law enforcement is premature because such denials are common and often result from misconfigured policies, expired credentials, or simple user error, not criminal activity. Law enforcement involvement requires a confirmed, significant security incident or evidence of a crime, and a false report can harm trust and waste resources. The appropriate initial response is internal forensic analysis of the CloudTrail logs and IAM configuration to establish whether the event is malicious before any external escalation.

• ✗

  Check the S3 bucket's access logs for the same IP address

  Why it's wrong here

  Checking S3 bucket access logs for the same IP address is redundant and less probative here because the CloudTrail event already provides the source IP, the principal identity, and the exact API call, whereas S3 server access logs offer only HTTP request details that are not needed to assess authorization. Additionally, S3 access logging is an opt-in feature and may be inactive, meaning you could spend time on logs that don't exist. The immediate focus should be on the IAM policies and authorization context, not on redundant network-level evidence.

Go deeper

Related to this question