Question

A cloud-hosted web application was compromised via an exploited API endpoint. During the enterprise incident response, the DFIR team discovers that CloudTrail management events are available but the S3 data-plane access logs and the application-tier logs were only retained for 7 days—well short of the estimated 6-week dwell time. Leadership demands a root-cause determination of the initial access vector. Which action MOST effectively enables the team to reconstruct the earliest attacker activity despite the retention gap?

Accepted Answer

Pivot to durable secondary telemetry—VPC flow logs, WAF logs, load balancer access logs, and CDN records—and correlate their retained timestamps to bound the intrusion window and infer the entry vector

Answer

Immediately extend the S3 and application log retention policy to 365 days so the missing historical events become available for analysis

Answer

Restore the application servers from the oldest available backup and replay production traffic to regenerate the missing log entries

Answer

Declare the root cause undeterminable and proceed directly to eradication, since the primary logs covering the dwell period no longer exist