During cloud infrastructure monitoring, a SOC analyst detects suspicious automated API calls using a developer service account key to copy sensitive object storage buckets to an unapproved external destination. The security team must immediately initiate containment procedures according to the incident response playbook. Which of the following containment actions should the incident response team execute immediately? (Select TWO.)
- Revoke the compromised service account's active access keys and temporary session tokens.Answer
- Attach an explicit inline deny policy to the service account restricting object storage read and export operations.Answer
- CRe-image all build nodes and host virtual machines associated with the cloud developer environment.
- DUpdate web application firewall rules to block SQL injection payloads directed at edge application servers.
Answer
The incident response team should revoke the compromised service account's active access keys and session tokens, and attach an explicit inline deny policy restricting object storage operations.
In cloud incident response playbooks, containing compromised identity credentials requires stopping authentication and authorization channels immediately. Revoking access keys invalidates credential access, while applying an explicit IAM deny policy provides immediate permission enforcement across the cloud environment to stop ongoing data exfiltration.
Step-by-Step Solution
Key Concept
Cloud Identity Incident Containment