Question

A security team at a financial services company is building a formal incident-response capability on AWS. They want to reduce mean time to respond and ensure responders can act during a real event without needing to manually create access or gather tools under pressure. The CISO asks the team to focus first on preparation activities as defined by the AWS incident-response lifecycle. Which combination of actions BEST reflects the 'preparation' phase for AWS incident response?

Accepted Answer

Pre-provision a dedicated forensics/security account with break-glass IAM roles, maintain documented runbooks, and regularly run tabletop exercises and game days

Answer

Wait for a GuardDuty finding, then create a new IAM role with administrative access so responders can begin investigating the affected resources

Answer

Immediately isolate any suspected instance by detaching it from its security group and terminating it to stop the attacker

Answer

Restore affected workloads from the most recent backups and rotate all credentials after confirming the threat has been eradicated