When configuring automated remediation workflows for AWS findings in Falcon Fusion, which of the following actions demonstrates the best practice for securing cloud resources?

Question

Options

• AManually trigger the remediation workflow after reviewing the findings.
• BIsolate the affected EC2 instance using a workflow action.
• CTerminate all EC2 instances in the same VPC as the flagged instance.
• DGrant Falcon Fusion permissions to modify all AWS configurations.

• A
  10% (5)
• B
  65% (31)
• C
  4% (2)
• D
  21% (10)

Explanation

Option A: Manual intervention slows down the response process, negating the benefits of automation. The workflow should be designed to act automatically based on predefined triggers Option B: Isolating an affected EC2 instance is a best practice for mitigating threats while minimizing disruption. This approach ensures that the issue is contained without impacting unrelated resources. Option C: Terminating all instances in the same VPC is overly aggressive and likely unnecessary. Automated remediation should be precise and targeted to avoid disrupting operations. Option D: Providing excessive permissions violates security best practices. IAM roles should follow the principle of least privilege, granting only the permissions needed for specific remediation actions.

No community discussion yet for this question.