1.1 - Design and implement an incident response plan (runbooks, forensic account, chain of custody)
AWS Certified Security Specialty objective 1.1 covers building the incident response programme before anything burns. You learn the phase order preparation, detection and analysis, containment, eradication and recovery, then post-incident activity, and why a runbook turns a stressful judgement call into a repeatable sequence anyone on call can follow. Forensics happens in a dedicated forensic account so the investigation tooling is never under the attacker's control and the blast radius stays contained, with evidence written to a bucket protected by S3 Object Lock in compliance mode and versioning so nothing can be overwritten. Chain of custody means recording who took each disk image, when, and its hash, and memory is captured before the instance is stopped because volatile state disappears on shutdown. The team holds pre-created IAM roles rather than requesting permissions mid-incident, severity levels drive escalation and who authorises taking revenue-critical services offline, and out-of-band communication is used when the corporate mail and chat may already be compromised. Game days rehearse a leaked access key, and post-incident reviews turn findings into concrete changes. Expect scenarios about preparation gaps, evidence integrity and who decides, and ask which practice fits.
Analyse a compromise safely = dedicated forensic account, never the compromised one. Evidence nobody can alter or delete = S3 Object Lock in compliance mode plus versioning. Capture memory first, snapshot the disk after, because volatile state dies on shutdown.
Practice questions
1. AWS Trust and Safety emails your account contact saying one of your EC2 instances is port scanning third party networks. What is the appropriate handling of that notice?
- Treat it as informational only, because AWS would have suspended the instance itself if the activity were genuinely harmful to the networks concerned
- Treat it as a detection signal, investigate the instance and reply within the stated deadline (correct answer)
- Forward it to the finance team, since abuse notices are normally the consequence of an unpaid bill on the account that owns the resource
- Wait for GuardDuty to raise a matching finding, and take no action at all as long as no such finding appears in the console
An abuse notice is external evidence that a workload you own is attacking others, so it enters the incident response process like any other detection, with an investigation and a documented reply before the deadline. AWS does not suspend first and explain later, abuse has nothing to do with billing, and waiting for GuardDuty ignores a report that is already more specific than any finding.
2. An investigation correlates CloudTrail records, application logs from three Regions and a firewall export. Which practice avoids reconstructing a false sequence of events?
- Normalising every timestamp to UTC before building the timeline (correct answer)
- Ordering the records by the moment each file was written into the evidence bucket of the forensic account
- Trusting the order in which the console displays the events, since each service already sorts its own records before rendering them
- Converting all timestamps to the local time zone of the analyst so that the narrative matches the working hours of the team on call
AWS records events in UTC, and a single common reference is what lets records from different sources be ordered reliably. Delivery time into a bucket lags the event by minutes, per service console ordering says nothing about cross source sequencing, and converting to a local zone adds an offset and a daylight saving trap for no benefit.
3. An intrusion is discovered on day sixty of an investigation window, and the log bucket has a lifecycle rule expiring objects after ninety days. Legal asks for a hold. What must happen first?
- Copy the relevant objects to the analyst workstation, then let the lifecycle rule expire the originals as it was already scheduled to do
- Suspend or exclude the affected prefix from the expiration rule before the deadline is reached (correct answer)
- Change the storage class of the objects to Glacier Deep Archive, which pauses the lifecycle clock until the objects are restored again
- Ask AWS Support to freeze the bucket, since only the service team can prevent an expiration rule from running on a given date
A lifecycle rule deletes on schedule and does not care about an ongoing case, so the rule must be stopped or narrowed before the objects reach their expiry date. A copy on a workstation is not a controlled evidence location, transitioning to Glacier changes the storage class without pausing expiration, and AWS Support does not manage customer lifecycle rules.
4. During an incident, why should forensic analysis be performed in a dedicated AWS account rather than in the compromised account?
- Because AWS technically forbids creating snapshots inside an account that GuardDuty has flagged as compromised
- Because the attacker may still hold credentials in the compromised account and could destroy the evidence (correct answer)
- Because forensic tooling licences are billed only once per organizational unit when the tooling is centralised there
- Because cross account snapshot copies are always faster than snapshots taken and analysed inside the same account
An isolated forensic account keeps the evidence and the analysis tooling out of reach of whoever still controls the compromised account, which preserves the chain of custody. AWS places no technical ban on snapshots in a flagged account, licence billing is not a security argument, and cross account copies are in fact slower than local ones.
5. What is the main purpose of a runbook in an AWS incident response plan?
- To list the monthly cost of every security service so the team can justify its budget after an incident
- To replace the on call rotation by describing which engineer should be woken up for each severity level
- To give responders predefined steps for a known incident type so the response is fast and repeatable (correct answer)
- To store the encryption keys needed to decrypt evidence volumes when the security team loses access to them
A runbook removes improvisation under stress by writing down the sequence of actions for a known scenario, which is what makes a response fast, consistent and auditable. Cost reporting is unrelated, a runbook complements rather than replaces the on call rotation, and storing keys inside a document would itself be a serious security flaw.
6. An analyst must preserve the memory of a compromised EC2 instance before anything else. What should be done first?
- Capture the volatile memory while the instance is still running (correct answer)
- Stop the instance immediately, then take an EBS snapshot of each attached volume and analyse it offline
- Reboot the instance into a rescue kernel so that the disk can be mounted read only for imaging
- Terminate the instance and rebuild it from the latest known good AMI to restore service quickly
Memory is the most volatile evidence and disappears the moment the instance stops or reboots, so it must be captured first, on a running instance that has been isolated by security group. Stopping, rebooting or terminating all destroy that memory, and terminating additionally destroys instance store data and any chance of later analysis.