AWS Certified Security - Specialty
Get started today
Ultimate access to all questions.
Ultimate access to all questions.
In the event of a compromised AWS environment, how would you protect and preserve forensic artifacts using AWS services? Provide a detailed plan involving S3, S3 Object Lock, and isolated forensic accounts.
Explanation:
To protect and preserve forensic artifacts, it is crucial to use an isolated forensic account, which enhances security by isolating sensitive data. Storing these artifacts in an S3 bucket with S3 Object Lock ensures that the data cannot be altered or deleted, providing immutable storage for forensic evidence.