SCS-C02 Question 6
Select 3Your organization runs critical workloads on AWS and wants to ensure a robust incident response plan is in place. As part of the plan, you need to automate the detection of unauthorized changes to IAM policies and immediately isolate compromised instances. Which combination of AWS services and features should you use to meet this requirement effectively?
- A
AWS CloudTrail with Amazon CloudWatch Alarms
- B
AWS Config with AWS Config Rules
- C
Amazon GuardDuty with AWS Lambda
- D
AWS Systems Manager Session Manager
- E
AWS Shield Advanced
Show answer and explanation
Correct answers: A, B, C
Explanation
To design and implement an effective incident response plan, you need a combination of services that can detect unauthorized changes and automate responses. AWS CloudTrail and CloudWatch enable tracking and alerting on API activity. AWS Config with Config Rules helps monitor and enforce compliance with IAM policy changes. Amazon GuardDuty can detect threats and, when integrated with AWS Lambda, can automate actions like isolating compromised instances. These tools together address both detection and response requirements effectively.
- A. Correct.
AWS CloudTrail with Amazon CloudWatch Alarms can help track API activity and trigger alarms for unauthorized changes, making it a crucial component for detecting incidents.
- B. Correct.
AWS Config with AWS Config Rules is vital for assessing compliance and detecting unauthorized changes to IAM policies in real-time.
- C. Correct.
Amazon GuardDuty with AWS Lambda is effective for threat detection and automated responses, such as isolating compromised instances.
- D. Incorrect.
AWS Systems Manager Session Manager is used for secure instance management but does not directly help with incident detection or automation of responses.
- E. Incorrect.
AWS Shield Advanced is used for DDoS protection and is not relevant for detecting IAM policy changes or isolating compromised instances.