SCS-C02 · Question #324
You have just received an email from AWS Support stating that your AWS account might have been compromised. Which of the following steps would you look to carry out immediately. Choose 3 answers from
The correct answer is A. Change the root account password. B. Rotate all IAM access keys D. Change the password for all IAM users.. One of the articles from AWS mentions what should be done in such a scenario If you suspect that your account has been compromised, or if you have received a notification from AWS that the account has been compromised, perform the following tasks: Change your AWS root account pas
Question
You have just received an email from AWS Support stating that your AWS account might have been compromised. Which of the following steps would you look to carry out immediately. Choose 3 answers from the options below.
Options
- AChange the root account password.
- BRotate all IAM access keys
- CKeep all resources running to avoid disruption
- DChange the password for all IAM users.
How the community answered
(45 responses)- A80% (36)
- C20% (9)
Explanation
One of the articles from AWS mentions what should be done in such a scenario If you suspect that your account has been compromised, or if you have received a notification from AWS that the account has been compromised, perform the following tasks: Change your AWS root account password and the passwords of any IAM users. Delete or rotate all root and AWS Identity and Access Management (IAM) access keys. Delete any resources on your account you didn't create, especially running EC2 instances, EC2 spot bids, or IAM users. Respond to any notifications you received from AWS Support through the AWS Support Center. Option C is invalid because there could be compromised instances or resources running on your environment. They should be shutdown or stopped immediately. https://aws.amazon.com/premiumsupport/knowledee-center/potential-account- compromise
Topics
Community Discussion
No community discussion yet for this question.