Examkin

Soru

Zorluk: Çok zorIncident Response Process and Playbooks

A security analyst discovers that an operational AWS IAM access key belonging to a production microservice repository was inadvertently committed to a public version control repository. Following standard incident response playbook procedures for credential exposure, place the following response actions in the correct sequential order from first to last.

  1. 1Revoke the exposed IAM access key and apply an explicit deny policy to immediately terminate active unauthorized API sessions.
  2. 2Isolate affected compute instances associated with the key activity and preserve volatile system memory for forensic analysis.
  3. 3Analyze CloudTrail logs to identify unauthorized resource modifications and eradicate any persistence mechanisms or secondary backdoor accounts established by the adversary.
  4. 4Deploy clean application instances, issue newly rotated credentials via a secure secrets manager, and restore normal production traffic.
  5. 5Conduct a post-incident review to implement automated pre-commit secret scanning hooks and update the organization's incident response playbook.

Cevap

The correct sequence of incident response actions is: 1) Revoke the exposed IAM access key and apply an explicit deny policy, 2) Isolate affected compute instances and preserve volatile memory, 3) Analyze CloudTrail logs to identify and eradicate persistence mechanisms, 4) Deploy clean application instances with rotated credentials and restore operations, and 5) Conduct a post-incident review to implement automated secret scanning and update playbooks.
The correct order follows standard incident response frameworks applied to credential exposure playbooks: initial containment (revoking credentials and isolating workloads), eradication (analyzing audit logs to uncover and remove adversary persistence), recovery (redeploying clean workloads with newly generated secrets), and post-incident activity (updating preventive secret-scanning hooks and playbooks).

Adım Adım Çözüm

1
Revoke Compromised Credentials
Terminates ongoing malicious API transactions using the exposed access key.
Immediate containment must disable the attack vector before the adversary can execute further actions.
2
Isolate Systems and Safeguard Evidence
Prevents adversary lateral movement and preserves volatile memory dumps.
Workload isolation limits blast radius while preserving digital forensic evidence for investigation.
3
Scope Impact and Eradicate Persistence
Identifies unauthorized infrastructure modifications, rogue IAM roles, and persistent backdoors.
Complete eradication requires identifying and removing all adversary footholds prior to system recovery.
4
System Recovery and Secret Rotation
Restores application workloads using clean images and new secrets.
Recovery ensures business services resume securely without lingering threat actor access.
5
Post-Incident Lessons Learned
Implements automated CI/CD secret scanning and improves the response playbook.
Post-incident activities address root causes and update organizational controls to prevent recurrence.

Anahtar Kavram

Incident Response Lifecycle & Playbook Execution Sequence
Bu soruyu puanla

Konular

Incident Response Process and Playbooks

Bu konudan daha fazla soru