SCS-C03 · Question #117
A healthcare company stores more than 1 million patient records in an Amazon S3 bucket. The patient records include personally identifiable information (PII). The S3 bucket contains hundreds of…
The correct answer is A. Revoke the temporary session that is associated with the instance profile that is attached to the. Amazon GuardDuty Exfiltration:S3/AnomalousBehavior findings indicate that S3 data access patterns are consistent with data exfiltration. In this scenario, the attacker is using temporary credentials obtained from an EC2 instance profile, which are issued by AWS Security Token…
Question
A healthcare company stores more than 1 million patient records in an Amazon S3 bucket. The patient records include personally identifiable information (PII). The S3 bucket contains hundreds of terabytes of data. A security engineer receives an alert that was triggered by an Amazon GuardDuty Exfiltration:S3/AnomalousBehavior finding. The security engineer confirms that an attacker is using temporary credentials that were obtained from a compromised Amazon EC2 instance that has s3:GetObject permissions for the S3 bucket. The attacker has begun downloading the contents of the bucket. The security engineer contacts a development team. The development team will require 4 hours to implement and deploy a fix. The security engineer must take immediate action to prevent the attacker from downloading more data from the S3 bucket. Which solution will meet this requirement?
Options
- ARevoke the temporary session that is associated with the instance profile that is attached to the
- BQuarantine the EC2 instance by replacing the existing security group with a new security group
- CEnable Amazon Macie on the S3 bucket. Configure the managed data identifiers for personally
- DApply an S3 bucket policy temporarily. Configure the policy to deny read access for all principals
How the community answered
(24 responses)- A83% (20)
- B4% (1)
- C4% (1)
- D8% (2)
Explanation
Amazon GuardDuty Exfiltration:S3/AnomalousBehavior findings indicate that S3 data access patterns are consistent with data exfiltration. In this scenario, the attacker is using temporary credentials obtained from an EC2 instance profile, which are issued by AWS Security Token According to AWS Certified Security - Specialty documentation, the fastest and most targeted remediation is to revoke the temporary session credentials associated with the compromised instance profile. This can be accomplished by removing or modifying the IAM role permissions, detaching the instance profile, or stopping the instance, which immediately invalidates the temporary credentials and prevents further S3 access.
Topics
Community Discussion
No community discussion yet for this question.