SCS-C02 Question 21
Select 2An organization using AWS has developed an incident response plan to handle security breaches involving its cloud infrastructure. During a simulated incident response exercise, it was noted that certain roles and responsibilities were unclear, leading to delays in mitigating the incident. Which of the following roles and responsibilities should be clearly defined in the incident response plan to ensure an effective response? (Select TWO)
- A
Identifying who is responsible for isolating affected resources in AWS.
- B
Documenting the root cause analysis after the incident has been resolved.
- C
Determining the AWS IAM roles that should be assigned to third-party auditors during the incident.
- D
Establishing who is responsible for communication with stakeholders and regulatory bodies.
- E
Defining the timeline for upgrading instances to the latest version after the incident.
Show answer and explanation
Correct answers: A, D
Explanation
An effective incident response plan must define clear roles and responsibilities to minimize delays in mitigating an incident. Key responsibilities include isolating affected resources to contain the breach and ensuring clear communication with stakeholders and regulatory bodies. These tasks are critical for immediate response and maintaining compliance during security incidents.
- A. Correct.
Correct. The incident response plan should clearly define who is responsible for isolating affected resources, such as using AWS security tools to quarantine compromised instances or resources, to prevent the spread of the breach.
- B. Incorrect.
Incorrect. While documenting the root cause analysis is important, it is typically a post-incident activity and not directly relevant to immediate incident response roles and responsibilities.
- C. Incorrect.
Incorrect. Determining AWS IAM roles for third-party auditors is not typically part of the immediate incident response process; it is more relevant to post-incident audits or compliance reviews.
- D. Correct.
Correct. Clear communication responsibilities, including who will inform stakeholders and regulatory bodies, are crucial during an incident to ensure accurate and timely information dissemination.
- E. Incorrect.
Incorrect. Upgrading instances is a post-incident remediation step and does not fall under the immediate roles and responsibilities for incident response.