AWS Certified Security - Specialty SCS-C02 — Topic 1 Question 245

Question

A security engineer received an Amazon GuardDuty alert indicating a finding involving the Amazon EC2 instance that hosts the company’s primary website. The GuardDuty finding received read: UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration. The security engineer confirmed that a malicious actor used API access keys intended for the EC2 instance from a country where the company does not operate. The security engineer needs to deny access to the malicious actor. What is the first step the security engineer should take?

Accepted Answer

Correct answer: D. The correct answer is D. Option D: Open the IAM console and revoke all IAM sessions that are associated with the instance profile. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

AWS Certified Security - Specialty SCS-C02 — Question 245