A security engineer has received an alert in the CrowdStrike Falcon console indicating a misconfigured Amazon S3 bucket that is publicly accessible. To mitigate this issue and prevent unauthorized acc

Question

Options

• AEnable AWS Shield Advanced to protect against Distributed Denial-of-Service (DDoS) attacks.
• BDeploy a Falcon Sensor on the S3 bucket to monitor access attempts.
• CCreate a new IAM role with administrator privileges and attach it to all cloud instances.
• DModify the S3 bucket permissions to restrict public access and enforce least privilege.

• A
  4% (1)
• B
  14% (4)
• C
  7% (2)
• D
  75% (21)

Explanation

Option A: AWS Shield Advanced protects against DDoS attacks, but it does not resolve misconfigured permissions on an S3 bucket. The root cause of the issue is excessive access permissions, not a network-based attack. Option B: CrowdStrike Falcon sensors are deployed on cloud workloads (e.g., EC2 instances, containers) but cannot be installed on S3 buckets. Falcon Cloud Security provides visibility into misconfigurations, but the solution to this problem lies in correcting bucket policies. Option C: Granting administrator privileges to all instances violates the principle of least privilege and increases the attack surface. Instead, access should be granted only to necessary users and services with minimal permissions. Option D: The first step in remediating a publicly accessible S3 bucket is to modify its permissions. This includes disabling public access, reviewing and restricting IAM policies, and ensuring that only authorized users or services can access the data. CrowdStrike Falcon Cloud Security helps detect such misconfigurations, but remediation requires direct action in AWS.

No community discussion yet for this question.