1.3 - Respond to compromised resources and workloads (isolation, revoked sessions, automated containment)
AWS Certified Security Specialty objective 1.3 covers containing a compromise without destroying the evidence. You isolate a confirmed compromised EC2 instance by replacing its security group with one that allows nothing, which cuts the attacker off while keeping the instance running so memory can still be captured, and in an Auto Scaling group you detach or set the instance to standby rather than terminating it. Leaked temporary credentials of an IAM role are killed with Revoke Sessions, which attaches an inline deny policy on tokens issued before a timestamp without deleting the role; an exposed long-lived access key is deactivated first, then rotated, and AWS may itself attach the AWSCompromisedKeyQuarantine policy. Systems Manager Session Manager and Run Command let responders collect data on hundreds of hosts with no inbound SSH port. Cross-account forensic snapshots of encrypted volumes require the KMS key to be shared with the forensic account, S3 Block Public Access stops a bucket being re-exposed, and an SCP can freeze an entire compromised account. EventBridge filters GuardDuty severity to drive Lambda or SSM automations. Expect scenarios asking what to do first, and which action contains without erasing.
Isolate but keep memory = swap the security group for one that allows nothing, never stop the instance. Leaked role credentials = Revoke Sessions, not delete the role. Collect from a host with no open port = SSM Session Manager or Run Command.
Practice questions
1. An EC2 instance is confirmed compromised but memory must still be captured. How should it be isolated?
- Terminate the instance right away and rebuild it from a hardened AMI, since the workload is stateless and can be replaced
- Detach the elastic network interface of the instance so that no packet can reach it from anywhere on the network
- Replace its security group with one that allows no traffic except the forensic path (correct answer)
- Move the instance to a private subnet whose route table has no route towards the internet gateway of the VPC
Swapping the security group cuts the attacker off instantly while the instance keeps running, so memory survives and the forensic tooling can still reach it. Terminating destroys the evidence, detaching the primary interface is not possible and would also cut the responders, and an instance cannot change subnet once launched.
2. An IAM role's temporary credentials have leaked. Sessions must stop immediately without deleting the role. What works?
- Wait for the session to expire naturally, since temporary credentials are short lived and become useless on their own
- Attach an inline deny policy using the aws:TokenIssueTime condition (correct answer)
- Rotate the access keys of the role from the IAM console so that the leaked pair no longer matches the stored secret
- Change the trust policy of the role so that the compromised principal can no longer call sts:AssumeRole on it in future
A deny statement conditioned on aws:TokenIssueTime being earlier than the current moment invalidates every session issued before the incident, which is the documented way to revoke role sessions. Waiting leaves the attacker active for the remaining lifetime, roles have no access keys to rotate, and editing the trust policy only blocks new assumptions while existing sessions keep working.
3. A GuardDuty finding must automatically trigger an isolation action with no human in the loop. Which design fits?
- A CloudWatch alarm on a custom metric that publishes to an SNS topic subscribed by the engineer on call for the region
- An AWS Config rule evaluating the instance state, associated with a remediation action that runs on the next evaluation cycle
- A scheduled Systems Manager Automation document that lists the findings every ten minutes and acts on the ones it has not seen
- An EventBridge rule on the finding, targeting a Lambda function or an SSM Automation document (correct answer)
GuardDuty emits findings to EventBridge in near real time, and a rule with a Lambda or Automation target performs the isolation within seconds. An SNS notification requires a human, a Config rule reacts to configuration state rather than to a threat finding, and a scheduled poller adds delay the attacker can exploit.
4. An IAM user's long term access key appears in a public code repository. What is the first action?
- Deactivate the exposed access key (correct answer)
- Open a support case with AWS and wait for their guidance before touching anything, to avoid destroying useful evidence
- Rewrite the repository history to remove the commit that contains the key, then keep using the same key pair as before
- Enable multi factor authentication on the user so that the exposed key can no longer be used without a second factor
Deactivating the key stops the abuse immediately and, unlike deletion, keeps it available for the investigation. Waiting for support leaves the key usable, rewriting history does not help because the key is already copied and indexed, and MFA does not protect programmatic access keys unless a policy explicitly requires it.
5. A forensic snapshot of an encrypted EBS volume must be analysed in a separate forensic account. What is required?
- Nothing beyond sharing the snapshot, because AWS decrypts and re encrypts it automatically when it crosses an account boundary
- Copy the snapshot without encryption first, because a snapshot must always be unencrypted before it can be shared with another account
- Share the snapshot and grant the forensic account use of the KMS key (correct answer)
- Move the KMS key itself to the forensic account, since a customer managed key can be transferred between accounts on request
An encrypted snapshot is unusable without the KMS key, so the key policy must grant the forensic account kms:Decrypt and the related permissions, and the key must be customer managed since the AWS managed key cannot be shared. AWS never silently decrypts data, decrypting before sharing would break the evidence, and a KMS key cannot be moved between accounts.
6. Which service lets a responder collect data from a compromised instance without opening an inbound SSH port?
- EC2 Instance Connect, which pushes a temporary public key to the instance and then opens an SSH connection over port 22
- AWS Systems Manager Session Manager (correct answer)
- A bastion host placed in a public subnet, reachable only from the office address range declared in its security group
- AWS Client VPN, which builds an encrypted tunnel from the responder's workstation into the subnet hosting the instance
Session Manager works through an outbound connection made by the SSM agent, so no inbound port and no bastion are needed, and every session is logged. Instance Connect and a bastion both still rely on inbound SSH, and Client VPN gives network reachability without removing the need for an open port on the instance.