SCS-C02 Question 1
Select 3Your company uses Amazon GuardDuty to monitor threats across AWS accounts and resources. Recently, GuardDuty detected an unusual volume of API requests coming from a specific IAM role associated with an EC2 instance. What steps should you take to investigate and mitigate the potential threat?
- A
Review the CloudTrail logs for the IAM role to identify the source of the API requests.
- B
Immediately delete the IAM role to stop unauthorized API calls.
- C
Isolate the EC2 instance by moving it to a security group with no outbound access.
- D
Analyze the GuardDuty findings for details on the suspicious activity, including IP addresses and affected resources.
- E
Revoke all permissions from the IAM role to prevent further API activity.
Show answer and explanation
Correct answers: A, C, D
Explanation
When GuardDuty detects unusual activity, a systematic response is required. Reviewing CloudTrail logs provides insights into the source and scope of the threat. Isolating the EC2 instance prevents further propagation, and analyzing GuardDuty findings gives additional context about the suspicious behavior. Deleting the IAM role or revoking all permissions immediately can lead to disruption and should be avoided unless absolutely necessary.
- A. Correct.
Reviewing CloudTrail logs is essential for understanding the source and scope of the suspicious API activity. It helps identify whether the activity is the result of a compromised resource or misconfiguration.
- B. Incorrect.
Deleting the IAM role immediately is not recommended, as it could disrupt legitimate processes and make it more difficult to investigate the incident thoroughly.
- C. Correct.
Isolating the EC2 instance by restricting its network access is a key step to contain the potential threat while you investigate further.
- D. Correct.
Analyzing the GuardDuty findings provides context about the suspicious activity, such as the IP address, affected resources, and possible intent behind the activity.
- E. Incorrect.
Revoking all permissions from the IAM role is overly disruptive and may impact production processes. A more strategic containment plan, such as isolating the instance and investigating logs, is preferred.