After a security incident involving a compromised access key, a security engineer needs to collect forensic evidence from the cloud environment. Which of the following actions would be most useful for determining the timeline of the compromise?
Trap 1: Taking a memory dump of the compute instance
Memory dumps capture the state of a running machine, which helps find malware or rootkits but does not establish the timeline of when an access key was used.
Trap 2: Analyzing network flow logs for data exfiltration
Network flow logs show traffic patterns and volumes, useful for detecting data exfiltration, but they do not directly provide the timeline of key usage.
Trap 3: Checking configuration management logs for resource changes
Configuration tracking services record resource configuration changes over time, which is helpful for change management but not for determining when a key was used.
- A
Taking a memory dump of the compute instance
Why wrong: Memory dumps capture the state of a running machine, which helps find malware or rootkits but does not establish the timeline of when an access key was used.
- B
Reviewing cloud audit logs for the compromised key
Cloud API activity logs (like AWS CloudTrail or Azure Monitor) record every API call with timestamps, identities, and source IPs, making them ideal for building a timeline of key usage.
- C
Analyzing network flow logs for data exfiltration
Why wrong: Network flow logs show traffic patterns and volumes, useful for detecting data exfiltration, but they do not directly provide the timeline of key usage.
- D
Checking configuration management logs for resource changes
Why wrong: Configuration tracking services record resource configuration changes over time, which is helpful for change management but not for determining when a key was used.