Examkin

Question

Difficulty: HardLog Analysis and SIEM Management

A security analyst investigating a high-priority SIEM alert reviews the following audit log snippet generated sequentially across cloud control plane services within a 15-second window:

[
{
"eventTime": "2026-07-27T14:22:05Z",
"eventName": "AssumeRole",
"userIdentity": { "type": "AWSAccount", "principalId": "AROA3X921EXAMPLE:session1" },
"sourceIPAddress": "198.51.100.45",
"requestParameters": { "roleArn": "arn:aws:iam::123456789012:role/DevOps-Admin-Role" }
},
{
"eventTime": "2026-07-27T14:22:12Z",
"eventName": "GetSecretValue",
"userIdentity": { "type": "AssumedRole", "principalId": "AROA3X921EXAMPLE:DevOps-Admin-Role" },
"sourceIPAddress": "198.51.100.45",
"requestParameters": { "secretId": "prod/db/credentials" }
},
{
"eventTime": "2026-07-27T14:22:18Z",
"eventName": "CreateAccessKey",
"userIdentity": { "type": "AssumedRole", "principalId": "AROA3X921EXAMPLE:DevOps-Admin-Role" },
"sourceIPAddress": "198.51.100.45",
"requestParameters": { "userName": "backup-svc" }
}
]

Based on these log entries, which of the following best assesses the threat activity and identifies the appropriate SIEM correlation rule tuning strategy?

  1. An adversary assumed an administrative role to harvest database credentials and establish persistence via access key creation; configure a SIEM correlation rule to detect rapid sequences of AssumeRole followed by credential generation from untrusted IP addresses.Answer
  2. B
    A SQL injection attack successfully extracted database secrets; deploy web application firewall (WAF) inspection rules to sanitize HTTP GET parameters on the secrets service endpoint.
  3. C
    An authentication failure occurred due to expired user credentials during IAM login; increase the SIEM alert threshold to trigger only after multiple failed login attempts.
  4. D
    Legitimate automated credential rotation; increase the SIEM correlation rule time window from seconds to hours to filter out operational false positives.

Answer

An adversary assumed an administrative role to harvest database credentials and establish persistence via access key creation; configure a SIEM correlation rule to detect rapid sequences of AssumeRole followed by credential generation from untrusted IP addresses.
The correct answer accurately identifies the attack chain: an actor leveraged temporary security credentials from an assumed role (AssumeRole) to read sensitive production secrets (GetSecretValue) and immediately created long-term access keys (CreateAccessKey) for persistence. Designing a SIEM correlation rule to monitor tight time windows between role assumption and persistence mechanisms from external IP addresses provides high-fidelity detection for account compromise.

Step-by-Step Solution

1
Analyze the event sequence and timestamps in the cloud audit log snippet.
The log shows three distinct events from IP address 198.51.100.45 spanning 13 seconds: AssumeRole, GetSecretValue, and CreateAccessKey.
Tracking event progression across short timestamps reveals automated or rapid post-exploitation behavior.
2
Evaluate the security impact of each API operation in the context of the cyber attack lifecycle.
AssumeRole elevates permissions, GetSecretValue retrieves production database credentials (credential access), and CreateAccessKey generates long-term API access keys for an existing user account (persistence).
Identifying the specific API actions maps the log events directly to adversary tactics and techniques.
3
Determine the optimal SIEM correlation rule design to detect this pattern.
A multi-event correlation rule linking identity assumption, secret retrieval, and persistence generation within a tight time frame (e.g., < 60 seconds) effectively alerts on compromised role abuse without generating excessive false positives.
SIEM correlation engines rely on temporal and logical chaining of heterogeneous event types to identify compound threats.

Key Concept

Cloud Security Log Analysis and Multi-Event SIEM Correlation Rules
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic