SCS-C02 Question 13
Select 3Your organization has detected unauthorized activity in an Amazon S3 bucket containing sensitive data. As part of your incident response plan, what actions should you take to minimize impact and gather information according to AWS best practices?
- A
Enable Amazon S3 server-side logging immediately to monitor activity.
- B
Take a snapshot of the S3 bucket metadata and object versions for forensic analysis.
- C
Use AWS IAM to revoke all user access to the S3 bucket immediately.
- D
Review AWS CloudTrail logs to identify the source of unauthorized activity.
- E
Use Amazon Macie to classify and assess the sensitivity of the data in the bucket.
- F
Apply an S3 bucket policy to block all public access to the bucket.
Show answer and explanation
Correct answers: B, D, F
Explanation
AWS best practices for incident response emphasize containing the threat, preserving evidence, and gathering information for further investigation. Capturing S3 bucket metadata and reviewing CloudTrail logs are crucial steps for forensic analysis. Applying a bucket policy to block public access minimizes further exposure of sensitive data. These steps align with AWS's guidance on incident response and security operations.
- A. Incorrect.
Not correct: Enabling server-side logging won't provide retroactive information about the unauthorized activity. AWS CloudTrail and S3 versioning are better tools for gathering forensic data.
- B. Correct.
Correct: Capturing metadata and object versions is essential for forensic analysis and preserving evidence of the unauthorized activity.
- C. Incorrect.
Not correct: Revoking all user access might disrupt legitimate workflows. Instead, security teams should focus on targeted containment and investigation.
- D. Correct.
Correct: Reviewing CloudTrail logs helps identify the source of unauthorized access and provides a timeline of events for investigation.
- E. Incorrect.
Not correct: While Amazon Macie can help classify sensitive data, it does not directly mitigate the impact of unauthorized access or assist in incident response.
- F. Correct.
Correct: Applying a bucket policy to block public access prevents further unauthorized activity while maintaining legitimate access for internal users.