SCS-C02 · Question #199
A company suspects that an attacker has exploited an overly permissive role to export credentials from Amazon EC2 instance metadata. The company uses Amazon GuardDuty and AWS Audit Manager. The…
The correct answer is A. Review GuardDuty findings to find InstanceCredentialExfiltration events. GuardDuty can detect and alert on EC2 instance credential exfiltration events. These events indicate that the credentials obtained from the EC2 instance metadata service are being used from an IP address that is owned by a different AWS account than the one that owns the…
Question
A company suspects that an attacker has exploited an overly permissive role to export credentials from Amazon EC2 instance metadata. The company uses Amazon GuardDuty and AWS Audit Manager. The company has enabled AWS CloudTrail logging and Amazon CloudWatch logging for all of its AWS accounts. A security engineer must determine if the credentials were used to access the company's resources from an external account. Which solution will provide this information?
Options
- AReview GuardDuty findings to find InstanceCredentialExfiltration events.
- BReview assessment reports in the Audit Manager console to find InstanceCredentialExfiltration
- CReview CloudTrail logs for GetSessionToken API calls to AWS Security Token Service (AWS
- DReview CloudWatch logs for GetSessionToken API calls to AWS Security Token Service (AWS
How the community answered
(34 responses)- A85% (29)
- B3% (1)
- C9% (3)
- D3% (1)
Explanation
GuardDuty can detect and alert on EC2 instance credential exfiltration events. These events indicate that the credentials obtained from the EC2 instance metadata service are being used from an IP address that is owned by a different AWS account than the one that owns the instance. GuardDuty can also provide details such as the source and destination IP addresses, the AWS account ID of the attacker, and the API calls made using the exfiltrated credentials. https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types- iam.html#unauthorizedaccess-iam-instancecredentialexfiltrationoutsideaws
Topics
Community Discussion
No community discussion yet for this question.