SCS-C02 Question 15
Select 4Your organization recently detected suspicious activity in its AWS environment, potentially indicating a compromised IAM user account. As part of the incident response process, which AWS best practices should you follow to mitigate the issue and ensure proper investigation?
- A
Rotate and revoke all long-term access keys associated with the compromised IAM user account.
- B
Enable AWS CloudTrail logging in all regions to monitor historical and future activities.
- C
Immediately delete the IAM user account that is suspected to be compromised.
- D
Apply a deny-all permissions policy to the IAM user account to prevent further access.
- E
Analyze the AWS CloudTrail logs for the compromised user's activity to determine the scope of the incident.
- F
Set up an Amazon SNS notification for unauthorized API calls to improve future monitoring.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
When responding to a potential IAM user compromise, AWS best practices include revoking access keys to mitigate risks, enabling CloudTrail logging to ensure proper monitoring and forensic analysis, and applying a deny-all permissions policy to isolate the account. Analyzing logs is an essential step to determine the scope and impact of the incident. Deleting the account prematurely or implementing future-oriented monitoring without addressing the immediate issue is not recommended during active incident response.
- A. Correct.
This is correct. Rotating and revoking long-term access keys ensures that any compromised keys are rendered useless, mitigating the risk of unauthorized access.
- B. Correct.
This is correct. AWS CloudTrail logging across all regions ensures that you can monitor both past activities and any new suspicious actions during the investigation.
- C. Incorrect.
This is incorrect. Deleting the IAM user account prematurely could destroy evidence needed for the investigation and may not prevent ongoing unauthorized access.
- D. Correct.
This is correct. Applying a deny-all permissions policy is a safer way to prevent further access without deleting the account, preserving evidence for forensic analysis.
- E. Correct.
This is correct. Analyzing AWS CloudTrail logs is critical to understanding the scope and nature of the compromise, which helps in identifying the root cause and potential impacts.
- F. Incorrect.
This is incorrect. While setting up an Amazon SNS notification for unauthorized API calls is a good practice for future monitoring, it does not directly mitigate the current incident.