AWS Incident Response Framework Quiz

What you'll be asked

1. Which AWS service is primarily used to collect and store logs for security auditing and forensic analysis during an incident?
2. During the 'Containment' phase of an incident, which action is considered a best practice for an EC2 instance suspected of being compromised?
3. Which AWS service would you use to automate the response to a detected security threat, such as automatically revoking an IAM user's credentials?
4. When performing forensic analysis on an EC2 instance, why is it recommended to create a snapshot of the EBS volume rather than imaging the live disk?
5. You have identified an unauthorized IAM role modification. According to the AWS Shared Responsibility Model, which component of the incident response process is entirely the customer's responsibility?

Answers and explanations come after you submit.