SCS-C02 Question 17
Select 3Your organization has recently identified unusual activity in an Amazon S3 bucket that contains sensitive customer data. Upon investigation, you discover that an IAM user's credentials were compromised, and the attacker exfiltrated data from the bucket. As part of your incident response process, what steps should you take to mitigate the incident and secure your environment?
- A
Revoke the compromised IAM user's credentials immediately.
- B
Enable Amazon Macie to monitor the S3 bucket for sensitive data.
- C
Create a new IAM user with the same permissions as the compromised user to ensure continuity.
- D
Analyze AWS CloudTrail logs to identify the scope of the breach.
- E
Apply an S3 bucket policy to deny all access until the investigation is complete.
- F
Rotate all access keys and passwords across the environment as a precaution.
Show answer and explanation
Correct answers: A, D, E
Explanation
During a cloud security incident involving compromised credentials, it is critical to respond quickly to mitigate the impact. Revoking the compromised user's credentials (1) stops any ongoing unauthorized access. Analyzing logs with AWS CloudTrail (4) helps identify the extent of the attack, which aids in remediation and future prevention. Applying a restrictive S3 bucket policy (5) ensures that sensitive data is not further exposed while the investigation continues. Other steps, such as enabling Amazon Macie or rotating all credentials, may be useful for long-term security but do not directly address the immediate incident.
- A. Correct.
Revoke the compromised IAM user's credentials immediately to stop any ongoing unauthorized access. This is a critical step in any incident response process.
- B. Incorrect.
Although Amazon Macie is a useful tool for identifying sensitive data, enabling it at this point does not directly mitigate or secure the environment during the incident response.
- C. Incorrect.
Creating a new IAM user with the same permissions as the compromised user could reintroduce the same level of risk and is not recommended during an active incident.
- D. Correct.
Analyzing AWS CloudTrail logs can help determine the extent of the breach, including what actions the attacker performed and which resources were affected. This is essential for understanding the scope of the incident.
- E. Correct.
Applying an S3 bucket policy to deny all access temporarily can prevent further damage or data exfiltration while the investigation is ongoing. This is a critical containment step.
- F. Incorrect.
Rotating all access keys and passwords across the environment is not necessary unless there is evidence of broader compromise beyond the affected IAM user.