SCS-C03 · Question #149
A company's security engineer receives an abuse notification from AWS. The notification indicates that someone is hosting malware from the company's AWS account. After investigation, the security…
The correct answer is B. Turn on Amazon GuardDuty. D. Rotate or delete all AWS access keys. F. Delete any resources that are unrecognized or unauthorized. AWS incident response best practices emphasize rapid containment, credential revocation, and threat detection to minimize the blast radius of a compromise. According to the AWS Certified Security - Specialty Official Study Guide, when unauthorized resources such as an Amazon S3…
Question
A company's security engineer receives an abuse notification from AWS. The notification indicates that someone is hosting malware from the company's AWS account. After investigation, the security engineer finds a new Amazon S3 bucket that an IAM user created without authorization. Which combination of steps should the security engineer take to MINIMIZE the consequences of this compromise? (Select THREE.)
Options
- AEncrypt all AWS CloudTrail logs.
- BTurn on Amazon GuardDuty.
- CChange the password for all IAM users.
- DRotate or delete all AWS access keys.
- ETake snapshots of all Amazon Elastic Block Store (Amazon EBS) volumes.
- FDelete any resources that are unrecognized or unauthorized.
How the community answered
(37 responses)- A3% (1)
- B84% (31)
- C8% (3)
- E5% (2)
Explanation
AWS incident response best practices emphasize rapid containment, credential revocation, and threat detection to minimize the blast radius of a compromise. According to the AWS Certified Security - Specialty Official Study Guide, when unauthorized resources such as an Amazon S3 bucket hosting malware are discovered, immediate action must be taken to stop further misuse of the account and to prevent recurrence. Rotating or deleting all AWS access keys (Option D) is a critical containment step. If an IAM user has been compromised, any long-term credentials associated with that user must be revoked immediately to prevent continued unauthorized access. AWS guidance explicitly lists access key rotation or deletion as a first-response action for suspected credential compromise. Deleting unrecognized or unauthorized resources (Option F) directly removes the malicious infrastructure that is being abused. In this case, deleting the unauthorized S3 bucket immediately stops malware distribution and reduces reputational and compliance impact. Turning on Amazon GuardDuty (Option B) enables continuous threat detection by analyzing CloudTrail events, VPC Flow Logs, and DNS logs. GuardDuty can identify additional malicious activity, compromised credentials, or persistence mechanisms that the attacker may have established. AWS documentation recommends enabling GuardDuty during or immediately after an incident to detect ongoing or future threats.
Topics
Community Discussion
No community discussion yet for this question.