Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A security analyst is reviewing correlated events in a SIEM console generated from cloud audit logs:

text
[2026-07-27T10:14:22Z] AWS CloudTrail: eventName=ConsoleLogin, userIdentity=arn:aws:iam::123456789012:user/jdoe, sourceIPAddress=198.51.100.45, responseElements={ConsoleLogin=Success}, additionalEventData={MFAUsed=No}
[2026-07-27T10:14:25Z] AWS CloudTrail: eventName=CreateAccessKey, userIdentity=arn:aws:iam::123456789012:user/jdoe, sourceIPAddress=198.51.100.45, responseElements={accessKey={accessKeyId=AKIAIOSFODNN7EXAMPLE}}
[2026-07-27T10:15:01Z] AWS CloudTrail: eventName=DescribeInstances, userIdentity=arn:aws:iam::123456789012:user/jdoe, sourceIPAddress=203.0.113.88, userAgent=aws-cli/2.11.0

Based on the log sequence provided, which of the following conclusions and immediate mitigation steps are correct? (Select TWO.)

  1. The compromised identity logged into the console without multi-factor authentication before creating a persistent programmatic access key.Answer
  2. The incident response process should immediately revoke active IAM user sessions and deactivate access key AKIAIOSFODNN7EXAMPLE.Answer
  3. C
    The log entries indicate a web application SQL injection attack targeting the cloud database management service.
  4. D
    The DescribeInstances entry demonstrates a failed authorization attempt due to inadequate role permissions on the target server.

Answer

The correct conclusions and actions are that the user identity was authenticated without MFA prior to creating a programmatic access key, and that responders must deactivate access key AKIAIOSFODNN7EXAMPLE and revoke active user sessions.
The CloudTrail log sequence demonstrates that account `jdoe` logged into the management console without MFA (`MFAUsed=No`) and immediately created a long-term API access key (`AKIAIOSFODNN7EXAMPLE`). Shortly thereafter, that generated access key was utilized from a different IP address (`203.0.113.88`) to perform infrastructure enumeration (`DescribeInstances`). Effective incident containment requires deactivating the compromised access key and invalidating all active user sessions.

Step-by-Step Solution

1
Analyze the ConsoleLogin log telemetry
Identified that user `jdoe` authenticated successfully from IP `198.51.100.45` with `MFAUsed=No`.
Single-factor console login represents a primary vulnerability indicator in administrative audit trails.
2
Correlate chronologically subsequent API calls
Observed key generation (`CreateAccessKey` ID `AKIAIOSFODNN7EXAMPLE`) 3 seconds post-login, followed by AWS CLI recon (`DescribeInstances`) from a secondary IP (`203.0.113.88`).
Sequencing shows post-compromise persistence creation and immediate secondary IP access using programmatic credentials.
3
Determine containment requirements
Containment requires invalidating generated credentials (`AKIAIOSFODNN7EXAMPLE`) and terminating active session tokens.
Invalidating the key stops external CLI access, and revoking sessions prevents ongoing console persistence.

Key Concept

Cloud Audit Log Analysis and SIEM Event Correlation
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic