An incident response team is responding to a confirmed security incident involving unauthorized API key usage and data exfiltration from an enterprise cloud storage bucket. Place the following incident response actions in the correct sequential order from first step to last step according to standard incident response playbooks.
- 1Analyze cloud audit logs (CloudTrail) to confirm unauthorized API calls and determine the scope of compromised data.
- 2Revoke the compromised IAM access keys and apply a restrictive policy to halt ongoing bucket access.
- 3Remove persistent backdoor IAM roles created by the adversary and restore bucket permissions to a secure baseline.
- 4Conduct a post-incident retrospective meeting to document the incident timeline and update incident playbooks.
Answer
The correct sequence follows the standard NIST incident response framework: Detection & Analysis (analyzing audit logs to scope the incident), Containment (revoking access keys and locking down storage access), Eradication & Recovery (deleting backdoor IAM roles and restoring secure baseline permissions), and Post-Incident Activity (holding a lessons-learned retrospective and updating playbooks).
The standard incident response process flows sequentially through four main phases: Detection & Analysis, Containment, Eradication & Recovery, and Post-Incident Activity. First, analyzing audit logs establishes incident scope (Detection & Analysis). Second, revoking compromised access keys halts ongoing exfiltration (Containment). Third, deleting unauthorized backdoor roles and restoring baseline permissions removes threat persistence and restores secure operations (Eradication & Recovery). Finally, conducting a post-incident retrospective documents lessons learned (Post-Incident Activity).
Step-by-Step Solution
Key Concept
NIST Incident Response Lifecycle Phases