Exam AWS Certified Security - Specialty topic 1 question 216 discussion

AE . Step functions : https://aws.amazon.com/blogs/compute/orchestrating-a-security-incident-response-with-aws-step-functions/

key words: environment must be provisioned = A Cloudformation Key words: processes must be orchestrated = E Step functions

Looking to design "incident RESPONSE plan", with 2 requirements: PROVISIONING of forensic env, and ORCHESTRATED response process. I'd argue GuardDuty is required for threat detection and continuous monitoring, but not in response. Therefore I'd go with CloudFormation (provisioning) and Step Functions (orchestration).

A - environment provision E - Automated response process & orchestrator

We can use Cloudformation to provision a trusted environment. AWS Step Functions to automate incident response procedures.

AE looks good since it did not mention how to 'detect' the anomaly

✑ Automated response processes must be orchestrated via AWS Step Functions , so answer is AE

AE for me as well. Cloudformation for trusted and automation is step function.

hmm, the title of this blog seems very similar to what the question is asking... https://aws.amazon.com/blogs/security/how-to-automate-incident-response-in-aws-cloud-for-ec2-instances/ but then you read through it and it doesn't use GuardDuty, Inspector, Macie, Step Functions anywhere... Only the using of Cloudformation is certain, so I'm sure A is correct at least

I don't really like this question, it seems a bit vague, and because of the vagueness, seems like it could be a trick question. That being said, I suppose I'd reluctantly agree with A and E, for reasons similar to what others answers have said

Answer: AE. Very tricky question. My response is based on wording in question. A trusted forensic environment must be provisioned. ==>Cloud formation for environment provisioning. Automated response processes must be orchestrated. ==>Step function for orchestration.

AE : A cloudformation to create your Ec2 / E step fct for automatisation : 'You can use Step Functions to easily automate recurring tasks) Not Guardduty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts, workloads, and data stored in Amazon S3. Not Inspector : gives findings on Securities on Ec2 Macie : personal Infos

more details: https://bhconsulting.ie/aws-incident-response/

A to provision the environment

how AWS CloudFormation help for forensic Cldy? can you provide source please ?

A. for forensic E. - for automated response