GCIH Securing Credentials and Data in Cloud Practice Question
An incident responder discovers an EC2 instance in AWS has been compromised via a web application vulnerability. The instance profile attached to the instance has broad administrative permissions. What is the immediate priority to contain credential compromise in this scenario?
⚠ Common exam trap
Candidates often assume that simply terminating the EC2 instance or applying a security group to block outbound traffic is sufficient, forgetting that temporary credentials generated prior to isolation may still be active externally.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Revoke active sessions using IAM boundary conditions and rotate or restrict the attached IAM instance profile role permissions.
Revoking existing session tokens and updating the IAM role trust and permission policies immediately restricts the attacker from leveraging active temporary security credentials. Incident handlers must remember that compromising an instance profile yields immediate access to STS tokens which persist even if the application vulnerability is patched or the instance is stopped without credential invalidation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Terminate the compromised EC2 instance immediately to destroy any running malicious processes and volatile memory artifacts.
Why it's wrong here
Terminating the instance prevents further exploitation but fails to address active temporary security credentials already stolen by the attacker, leaving AWS resources vulnerable to ongoing unauthorized API calls from external IP addresses. Cyber defenders must explicitly invalidate session tokens.
- ✗
Attach a restrictive Network ACL to the subnet to block all inbound and outbound traffic originating from the compromised instance's private IP address.
Why it's wrong here
Blocking network traffic prevents the attacker from issuing further API calls from inside the instance, but it does not protect against exfiltrated STS credentials that can be utilized from any external location globally via the AWS public API endpoints.
- ✓
Revoke active sessions using IAM boundary conditions and rotate or restrict the attached IAM instance profile role permissions.
Why this is correct
Invalidating active temporary credentials and modifying the role policies stops ongoing unauthorized API access. This directly mitigates the risk of lateral movement across the cloud environment by cutting off the compromised instance profile's valid session tokens.
- ✗
Modify the VPC route table to remove the internet gateway route, isolating the entire virtual private cloud from external communication.
Why it's wrong here
Isolating the entire VPC disrupts business operations for all other workloads running within that network segment. Incident response procedures demand surgical containment steps rather than broad network outages that impact unaffected production systems.
About these practice questions
Courseiva writes every GCIH question from scratch — 322 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCIH practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCIH exam.