Incident Response

IR plans, isolation and forensics, credential invalidation, and recovery.

Domain 2: Incident Response · 14% of exam · 3 questions

Question 1 of 3 · keys: 1–5 select, Enter submit, ← → navigate

Domain 2: Incident ResponseIncident ResponsemediumSingle choice

CloudTrail shows an IAM user's access key making API calls from an unknown IP — the key is compromised. What's the correct FIRST response?

Delete the IAM user entirelyDeactivate the access key (and rotate), then investigate the blast radiusSend the user an email asking if it was themChange the user's console password