How long is the free retention period for AWS CloudTrail logs?

• 30 days

• 7 days

• Dependent on log volume

• 90 days

Answer explanation

CloudTrail provides free storage of audit logs for 90 days. If you want to keep data for longer than 90 days, you have to set up a trail to be stored in an S3 bucket somewhere or ingested into some other platform.

Which of the following is determined by AWS during EC2 instance creation?

• CPU, memory, and storage specifications

• • 
    

    Access control list configuration

• OS-level patch management

• IP address assignment

Answer explanation

AWS provides IP address assignments based on your choice of public or private. Depending on your configuration (or template selected), AWS will find the resources in their data center and launch that instance for you.

Which AWS service allows investigators to perform SQL-like queries across all logs in an S3 bucket without processing them ahead of time?

• S3 Query

• GuardDuty

• Athena

• Glue

Answer explanation

Athena is an AWS service that allows you to search data that are resident within your S3 buckets as if they were in an SQL database. Athena allows you to search terabytes of data stored in your S3 buckets without having to first process and load it all into something like ELK. In addition, you can schedule Athena queries to run at regular intervals to perform regular threat hunts as new logs are written into your CloudTrail buckets.

The root user of an AWS account has been used to create a Linux EC2 instance. Where will the actions taken by that account be logged, by default?

• VPC Flow Logs

• CloudWatch logs

• /var/log in Linux

• CloudTrail logs

Answer explanation

The actions of the root user on an EC2 instance will be logged in CloudTrail by default. They will not appear in CloudWatch unless CloudWatch is configured to accept them. VPC Flow Logs do not include changes made on an EC2 instance. Linux logs record only changes made by accounts within the instance, not by the accounts of AWS users, including root.

What is the default access permission granted when an S3 bucket is created?

• Private with public access to metadata

• Unlimited public access

• Private with public access to directory listing

• Bucket and objects not public

Answer explanation

By default, all Amazon S3 buckets and objects are private. Only the resource owner, which is the AWS account that created the bucket, can access that bucket

EC2 instance types prefixed with P, G, or F indicate which of the following?

• An attached GPU or FPGA

• Extra RAM

• Bare-metal Macs

• ARM-based processors

Answer explanation

Instances prefixed with P, G, or F indicate that a GPU or FPGA is attached to them. This is the instance type most often abused by crypto miners.

Which AWS storage service is similar to a network-hosted NFS share that can be attached to multiple AWS EC2 instances simultaneously?

• EFS

• VMDK

• S3

• EBS

Answer explanation

Amazon Elastic File System (EFS) is basically a network-hosted NFS share, while Elastic Block Store (EBS) is a dedicated block storage device. This means that multiple instances can all access an EFS share simultaneously, while only one instance at a time can access an EBS volume. Many developers will create an AWS-hosted NFS share (EFS) and then attach it to multiple running EC2 instances. This way, for auto-scaling clusters and containers, they can have persistent data storage. This allows multiple Linux instances and containers to read and write data to a central place, and then AWS will manage auto-scaling of EFS storage. Since EFS shares are regional, the data access speeds should be fast.

A forensic analyst needs to capture memory from a Linux system in AWS. If there is a low likelihood that the target system has a compiler and kernel headers available, what is the best option for collecting memory?

• AVML

• LiME

• Redline

• PSExec

Answer explanation

Acquire Volatile Memory for Linux (AVML) is created and maintained by Microsoft. This tool is statically compiled and works without kernel drivers. AVML has been used on production Linux systems with up to 4 TB of RAM and high usage without issues.

When creating incident response (IR) for an AWS organization, what IAM role should the IR team seek?

• An organization-spanning role with read-only access to all resources

• Allows the description and listing of all AWS resources

• Allows full access to all AWS resources

• Allows read-only access to CloudSearch

Answer explanation

An incident responder should have read-only access to all resources. This gives the responder access to the configurations and logs needed to understand what happened but blocks their ability to make changes inadvertently. The latter can happen if full access is allowed. Access should not be limited to externally accessible devices as the responder would be unable to understand the attacker’s actions once they got past the perimeter.

Which field of a CloudTrail record identifies the action that has taken place?

• responseElements

• eventName

• eventID

• requestParameters

Answer explanation

eventName shows the action that was performed, usually the name of the API function called.