AWS Security Incident Response Automation

1. How does GuardDuty integrate with incident response automation?

It provides database backups

It detects threats and can trigger EventBridge rules for automated response

It manages DNS records

It handles load balancing

2. What is the primary purpose of creating runbooks in AWS Systems Manager for incident response?

To replace security monitoring tools

To document and automate consistent, repeatable response procedures

To eliminate the need for security training

To bypass IAM controls

3. How should you handle sensitive data discovered during automated incident response?

Log it to CloudWatch Logs without encryption

Store it in S3 with public access

Encrypt, isolate, and restrict access to forensic data; follow compliance requirements

Share it with all team members immediately

4. In an incident response automation context, what does 'immutable infrastructure' mean?

Infrastructure that can never be changed

Replacing compromised resources with new ones rather than patching them in place

Infrastructure that requires manual updates

Infrastructure that uses only legacy systems

5. Which service combination would you use to automatically quarantine a resource when a specific security event is detected?

S3 and CloudFront

GuardDuty, EventBridge, and Systems Manager

Route 53 and ACM

API Gateway and WAF only

6. What role does CloudWatch play in automated incident response?

It stores EC2 backups

It monitors metrics and logs, triggering alarms that can initiate automated actions

It manages DNS failover

It handles SSL certificate validation

7. How can you test an automated incident response workflow without affecting production?

Run it directly in production during business hours

Test in a separate AWS account or sandbox environment first

Skip testing to save time

Use only manual testing methods

8. What is the benefit of using AWS Secrets Manager in an automated incident response workflow?

It prevents all API calls to AWS services

It securely stores and rotates credentials needed for remediation scripts

It eliminates the need for encryption

It replaces IAM entirely

9. Which tool would you use to run automated security checks and remediation across multiple AWS accounts?

CloudFront

AWS Organizations with Config aggregator and Systems Manager

S3 versioning

VPC Flow Logs

10. In an incident response automation pipeline, when should you implement a manual approval step?

Never; all actions should be fully automated

Only for non-critical resources

For high-risk actions like instance termination or data deletion

Only during business hours

11. Which AWS service enables you to automatically respond to security events by triggering Lambda functions when CloudTrail logs specific API calls?

EventBridge

CloudWatch Events

SNS

SQS

12. What is a critical security consideration when using Lambda functions for automated incident response?

Lambda functions should have full administrative access to all AWS services

Lambda execution roles should follow least privilege and have only necessary permissions

Lambda functions do not need to be monitored

Sensitive credentials can be hardcoded in Lambda environment variables

13. Which AWS service would you use to automatically isolate a security group that has been modified with overly permissive rules?

CloudFront

Systems Manager with Config remediation

Route 53

API Gateway

14. How can you ensure that automated incident response actions are logged for compliance and audit purposes?

Disable CloudTrail to reduce noise

Enable CloudTrail and Config to log all API calls and configuration changes

Store logs only in volatile memory

Use private S3 buckets without versioning

15. In an automated incident response workflow, what is the purpose of using SNS topics?

To encrypt all communications between services

To notify security teams and escalate alerts to on-call personnel

To store forensic data for later analysis

To manage IAM roles and permissions

16. What should you include in a Systems Manager Automation document to ensure secure remediation of a compromised EC2 instance?

Only the instance ID and termination command

Steps to isolate the instance, collect forensics, and optionally terminate or restore from backup

Direct SSH credentials for manual access

Public IP addresses of all affected instances

17. Which of the following is a key benefit of using EventBridge rules for incident response?

It provides network isolation for EC2 instances

It routes security events from multiple AWS services to targets like Lambda and SNS

It manages VPC peering connections

It handles certificate rotation automatically

18. How does AWS Config help with incident response automation?

It monitors API calls and logs them to CloudTrail

It tracks configuration changes and can trigger remediation when non-compliance is detected

It encrypts data in transit between services

It manages SSL/TLS certificates

19. In an automated incident response system, which service would you use to store and retrieve the current state of security group configurations for rollback purposes?

DynamoDB

S3

Systems Manager Parameter Store

Secrets Manager

20. What is the primary advantage of using AWS Systems Manager Automation documents for incident response?

They provide real-time monitoring of all resources

They enable repeatable, automated remediation workflows without manual intervention

They encrypt all data at rest automatically

They replace the need for IAM policies

AWS Security Specialty Incident Response Automation Quiz