Exam AWS Certified Security - Specialty topic 1 question 353 discussion

https://aws.amazon.com/premiumsupport/knowledge-center/potential-account-compromise/

B,C are correct.

The best practice would be to disable the compromised user account in Active Directory. This enables that the compromised account will not have access to federated or shared resources in AWS. Next we need to prevent the compromised account from being able to access the AWS security tokens service. We can reduce the attack surface and prevent the possibility of lateral movement by restricting access to the AWS Security Token Service. This is because STS is typically used for identify federation and cross account access. BC

Answer is B and C A, D, and E just doesn't make sense.

B and C seem correct answer. AWS STS security tokens are typically used for identity federation, providing cross-account access and for resources related to EC2 instances that require access by other applications. So, C will not block the access of applications that are configured with role to access other AWS services.

The correct actions are B and C. To mitigate the unauthorized use of the IAM role while minimizing production workload downtime, the security engineer should take the following actions: Revoke access for the identity in the on-premises Active Directory: This will prevent the compromised identity from being able to use the IAM role on AWS. Attach an IAM policy to the IAM role to deny all access to any AWS Security Token Service (AWS STS) tokens that were issued prior to the current time: This will prevent the compromised identity from being able to use the IAM role on AWS by invalidating any previously issued AWS STS tokens. This will minimize downtime because the policy will only affect the compromised identity, rather than all users of the IAM role.

Option C will block all STS to the ROLE not identity - remember production workloads are using the role. so only the STS tokens for the identity need to be disabled. so BC are correct not BD

100%. B & C.

sorry BC is correct

BD for me