GCFA Enterprise Environment Incident Response Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Delete the IAM role immediately.

  Why it's wrong here

  Deleting the IAM role is a destructive action that can cause immediate, widespread service outages for any legitimate resource currently using that role. This is an excessive containment measure that disrupts business operations and removes forensic evidence that may be needed to determine what the attacker actually accessed.

• ✓

  Attach an inline policy to deny all actions for the compromised role.

  Why this is correct

  Attaching a 'Deny All' policy is the most effective way to neutralize the compromised role instantly. Because explicit denies always override allows in IAM, the attacker loses the ability to execute any commands, while the role itself remains in the cloud configuration for forensic investigation and audit purposes.

• ✗

  Change the password for the root user account.

  Why it's wrong here

  The incident involves a compromised IAM role, not the root account. Changing the root password does not affect the permissions or active sessions of an IAM role. This action is irrelevant to the containment of the specific threat vector identified and fails to stop the attacker's unauthorized activity.

• ✗

  Disable the entire cloud subscription or account.

  Why it's wrong here

  Disabling the entire account is a 'scorched earth' approach that stops all services, including production systems and customer-facing applications. This is rarely the right choice for an incident responder unless the threat is so severe that it threatens the entire infrastructure. It is inefficient and causes unnecessary business damage.