Incident Response

40. An organization must guarantee that incident responders can reach every member account even if a local administrator revokes their permissions. Which solution meets these requirements?

1. A Publish an escalation procedure that account owners agree to follow during an incident.
2. B Deploy a break-glass role to every account with StackSets and apply a service control policy that prevents its modification.
3. C Store the root user credentials for each account in a sealed physical envelope.
4. D Create an IAM user with a long-lived access key in each account and store the keys centrally.

41. An incident response plan must be validated by deliberately impairing a component while a guardrail halts the test if the blast radius grows. Which solution meets these requirements?

1. A Run an AWS Fault Injection Service experiment with a stop condition bound to a CloudWatch alarm.
2. B Restore the component from a backup and measure how long the restore takes.
3. C Review the runbook with the response team and record the expected outcome.
4. D Terminate the component manually during a maintenance window and observe the result.

42. A response plan must confirm that a standby environment in a second Region is ready to take traffic before an incident requires it. Which solution meets these requirements?

1. A Configure AWS Config rules that verify the standby Region resources exist.
2. B Configure Amazon Application Recovery Controller readiness checks and routing controls for the two Regions.
3. C Configure Amazon CloudWatch Synthetics canaries against the standby Region endpoint.
4. D Configure AWS Backup to copy recovery points to the standby Region on a schedule.

43. A forensic analysis capability must be prepared in advance so that evidence from a compromised instance can be examined without risking production. Which solution meets these requirements?

1. A Prepare a procedure for restoring the compromised instance from its most recent AMI.
2. B Prepare a procedure for attaching the compromised instance's original volume to an investigator workstation.
3. C Prepare an isolated forensic VPC and a hardened analysis instance, and attach volumes created from evidence snapshots read-only.
4. D Prepare a shared Amazon S3 bucket where snapshots can be published for third-party analysis.

44. An Amazon EC2 instance is confirmed compromised and must be contained while volatile and persistent evidence is preserved. (Place the steps in the correct order.)

1. A Create snapshots of the attached Amazon EBS volumes.
2. B Detach the instance from its Auto Scaling group so it is not terminated.
3. C Attach an isolation security group that denies all inbound and outbound traffic.
4. D Capture a memory image from the running instance.

45. An IAM access key has been published in a public code repository. Which action should be taken first?

1. A Apply a service control policy that denies all actions in the account.
2. B Delete the IAM user that owns the key before investigating.
3. C Deactivate the access key so it cannot be used, then review CloudTrail for actions taken with it.
4. D Rotate the access key to a new value and continue monitoring the account.

46. After a suspected compromise, all temporary sessions issued by an IAM role must be invalidated while the role remains usable for new sessions. Which solution meets these requirements?

1. A Attach an inline policy denying all actions when aws:TokenIssueTime is earlier than the current moment, then remove it once outstanding sessions expire.
2. B Delete the role and recreate it with the same name and trust policy.
3. C Rotate the access keys belonging to the account's root user.
4. D Detach every policy from the role until the investigation is complete.

47. An AWS KMS key is suspected of being used by an unauthorized principal, and existing data encrypted under it must remain decryptable by legitimate users. Which action should be taken?

1. A Rotate the key material so the unauthorized principal's access no longer applies.
2. B Remove the unauthorized principal from the key policy and revoke any grants that reference it.
3. C Schedule the key for deletion so the unauthorized principal cannot use it.
4. D Disable the key until the investigation is complete.

48. A containment action must isolate an instance within two minutes of a specific Amazon GuardDuty finding, without human involvement. Which solution meets these requirements?

1. A Create a Security Hub insight that groups the finding type for review each morning.
2. B Create a scheduled AWS Lambda function that queries GuardDuty findings each hour.
3. C Configure GuardDuty to publish findings to an Amazon SNS topic subscribed by the on-call engineer.
4. D Create an Amazon EventBridge rule matching the finding type that invokes a Systems Manager Automation runbook.

49. Following a data exposure, the team must determine every principal that accessed a specific Amazon S3 object over the past six months. Which source provides this, assuming it was configured in advance?

1. A Amazon GuardDuty findings raised during the six-month period.
2. B CloudTrail management events for the account containing the bucket.
3. C CloudTrail data events for the bucket, retained in Amazon S3 or in CloudTrail Lake for the full period.
4. D AWS Config configuration history for the bucket.

50. An incident response plan must define when an incident is escalated to executive leadership. Which approach is appropriate?

1. A Define escalation criteria in advance based on impact and data sensitivity, so the decision is not made under pressure.
2. B Escalate every security finding so leadership is always informed.
3. C Escalate once the incident has been contained.
4. D Let the responder on duty decide at the time.

51. A forensic account must be prepared so evidence can be analysed in isolation. Which combination of steps meets these requirements? (Select TWO.)

1. A Grant production administrators access to the forensic account for convenience.
2. B Pre-authorize the cross-account snapshot sharing and key grants that evidence transfer will require.
3. C Connect the forensic account to production through a transit gateway.
4. D Disable logging in the forensic account to avoid contaminating evidence.
5. E Create a dedicated account with no trust relationships to production and no shared network path.

52. An incident response plan must be validated against a scenario that cannot be safely executed in production. Which approach is appropriate?

1. A Run a tabletop exercise for that scenario and execute the technically safe scenarios as live experiments.
2. B Execute the scenario in production during a low-traffic window.
3. C Rely on the runbook being reviewed by an experienced engineer.
4. D Skip validation for scenarios that cannot be executed.

53. An instance must be isolated during an incident, but terminating its network connections would destroy evidence held in active sessions. Which approach is appropriate?

1. A Apply an isolation security group that blocks new connections while capturing volatile state before any disruptive action.
2. B Terminate the instance and analyse its volume snapshots.
3. C Detach the instance's network interface immediately.
4. D Stop the instance to prevent further activity.

54. An IAM role's credentials are suspected compromised, and revoking sessions must not disrupt the legitimate workload using that role. Which approach is appropriate?

1. A Rotate the access keys belonging to the role.
2. B Attach a deny conditioned on aws:TokenIssueTime before the current moment, which invalidates existing sessions while permitting new ones.
3. C Detach every policy from the role until the investigation completes.
4. D Delete the role and recreate it with the same name.

55. An S3 bucket was made public by a configuration change, and the team must establish what was accessed while it was exposed. Which source provides this?

1. A CloudTrail data events for the bucket, if they were enabled before the exposure occurred.
2. B The bucket's current access control configuration.
3. C Amazon Macie findings for the bucket.
4. D CloudTrail management events for the account.

56. A compromised access key must be disabled immediately, and the team is unsure which principal owns it. Which approach is appropriate?

1. A Apply a service control policy denying all actions in the account.
2. B Wait for the owner to identify themselves.
3. C Look up the key identifier in the IAM credential report or with the IAM API to find its owner, then deactivate it.
4. D Delete every access key in the account to be certain.

57. A ransomware incident requires restoring data while preserving the encrypted copies as evidence. Which approach is appropriate?

1. A Restore over the affected data to return to service quickly.
2. B Delete the encrypted data and restore from the most recent backup.
3. C Restore to a new location from a recovery point predating the incident, leaving the affected data untouched.
4. D Decrypt the affected data with a key recovered from the attacker.

58. An incident response plan must define how responders obtain elevated access during an incident. Which approach is appropriate?

1. A Share the root user credentials with the response team.
2. B Grant responders standing administrator access.
3. C Pre-provision a break-glass role with defined approval and alerting, so its use is possible but always visible.
4. D Have responders request access from an administrator during the incident.

59. An incident response plan must specify how evidence is preserved so it remains admissible. Which practice applies?

1. A Store evidence in the account where the incident occurred.
2. B Establish and document a chain of custody recording who handled each artifact, when, and what was done to it.
3. C Share evidence with all engineering teams for analysis.
4. D Compress evidence to reduce storage cost.

60. An incident response plan must be exercised without disrupting production. Which approach is appropriate?

1. A Run the exercise against production during peak hours.
2. B Run the exercise against a representative non-production environment or as a tabletop, depending on what the scenario permits.
3. C Run the exercise only after an actual incident occurs.
4. D Skip the exercise and review the runbook instead.

61. An organization must define when a security event becomes a security incident. Which approach is appropriate?

1. A Define classification criteria in advance based on impact, data sensitivity, and confirmed compromise, so the decision is consistent.
2. B Classify an event as an incident only once leadership is informed.
3. C Treat every finding as an incident.
4. D Let the responder on duty decide each time.

62. An incident response capability must be able to isolate a compromised account within an organization. Which preparation is required?

1. A Plan to delete the account's IAM users during an incident.
2. B Plan to change the account's root password during an incident.
3. C Pre-authorize the ability to apply a restrictive service control policy to the account's organizational unit, and test it.
4. D Plan to remove the account from the organization during an incident.

63. An EC2 instance must be preserved for forensic analysis while being removed from service. Which sequence is appropriate?

1. A Restore it from its machine image and continue operating.
2. B Terminate it and analyse the last snapshot.
3. C Isolate it, capture volatile memory, snapshot its volumes, tag it as evidence, and remove it from its Auto Scaling group.
4. D Reboot it to clear the compromise and return it to service.

64. A GuardDuty finding indicates credential exfiltration from an EC2 instance role. Which immediate action is appropriate?

1. A Stop the instance.
2. B Rotate the account's root credentials.
3. C Delete the role immediately.
4. D Revoke the role's existing sessions with a token issue time condition and investigate what those credentials accessed.

65. An S3 bucket's objects have been encrypted by an attacker using a key the organization does not control. Which recovery action is appropriate?

1. A Pay for the key and decrypt the objects.
2. B Attempt to decrypt the objects with the account's KMS keys.
3. C Restore the affected objects from earlier versions or from a backup in a separate account, and preserve the encrypted versions as evidence.
4. D Delete the encrypted objects and accept the loss.

66. An automated response must contain a finding without an engineer approving each action. Which control keeps the automation safe?

1. A Grant the automation administrator permissions so it can handle any scenario.
2. B Run the automation on a schedule rather than on the finding.
3. C Scope the automation's permissions to exactly the containment actions it performs, and log every execution.
4. D Require an approval step before every action.