SCS-C02 Question 63
Single answerYour organization uses AWS CloudTrail to monitor API activity across its AWS accounts. You receive an alert indicating suspicious activity: an IAM user accessed the 'TerminateInstances' API for a critical production instance. As the security engineer, what is the most appropriate first step to respond to this security incident according to the AWS Security Incident Response Guide?
- A
Revoke all permissions from the IAM user immediately.
- B
Isolate the compromised resources by applying a restrictive security group.
- C
Perform an initial triage by reviewing the CloudTrail logs associated with the user's activity.
- D
Delete the IAM user to prevent further unauthorized actions.
Show answer and explanation
Correct answer: C
Explanation
According to the AWS Security Incident Response Guide, the first step in responding to a security incident is to perform an initial triage to gather information about the incident. Reviewing CloudTrail logs enables you to determine the extent of the compromise, understand the actions taken by the IAM user, and decide on appropriate containment and eradication measures. Jumping to actions like revoking permissions or deleting the user too early can hinder the investigation or disrupt legitimate processes.
- A. Incorrect.
Revoking all permissions immediately might seem like a quick solution but can disrupt ongoing legitimate activities. Incident response best practices recommend gathering more information before taking such drastic action.
- B. Incorrect.
Isolating resources may be necessary later in the process but is not the first step. The initial step should involve understanding the nature of the incident.
- C. Correct.
Performing an initial triage by reviewing CloudTrail logs is the correct first step as it allows you to understand the scope and impact of the incident before taking further action.
- D. Incorrect.
Deleting the IAM user might stop further action but makes it difficult to investigate the incident properly. It is not the recommended first step.