A company's security engineer receives an abuse notification from AWS indicating that malware is being hosted from the company's AWS account. The security engineer discovers that an IAM user created…

Question

Options

• AEncrypt all AWS CloudTrail logs.
• BTurn on Amazon GuardDuty.
• CChange the password for all IAM users.
• DRotate or delete all AWS access keys.
• ETake snapshots of all Amazon Elastic Block Store (Amazon EBS) volumes.
• FDelete any resources that are unrecognized or unauthorized.

• A
  10% (4)
• B
  71% (30)
• C
  5% (2)
• E
  14% (6)

Explanation

Explanation

Turning on GuardDuty (B) provides continuous threat detection to identify further malicious activity and prevent the compromise from spreading. Rotating or deleting all access keys (D) directly neutralizes the attacker's method of access, since the IAM user's credentials were likely stolen or leaked - simply changing passwords doesn't address programmatic access via access keys. Deleting unauthorized resources (F) removes the malware hosting infrastructure, directly addressing the abuse notification and stopping the harm.

Why the distractors are wrong:

• (A) Encrypting CloudTrail logs is a good security practice but does nothing to stop an active compromise - it's a preventive/audit measure, not a response action.
• (C) Changing passwords for all IAM users is insufficient because AWS services (like S3) are accessed via access keys, not console passwords - rotating keys (D) is the critical step.
• (E) Taking EBS snapshots is a preservation step for forensics, not a containment action, and the scenario doesn't indicate EBS is involved.

Memory Tip

Think "Detect, Disable, Destroy" - GuardDuty detects ongoing threats, rotating keys disables the attacker's access, and deleting unauthorized resources destroys the attack infrastructure. Incident response prioritizes stopping the bleeding before preserving evidence.

No community discussion yet for this question.