AWS Certified Security - Specialty
Get started today
Ultimate access to all questions.
Ultimate access to all questions.
During a security incident, you need to capture relevant forensics data from a compromised resource. Describe the steps you would take using Amazon EBS volume snapshots and memory dumps, and how you would ensure the integrity of this data using AWS services.
Explanation:
Capturing forensics data involves creating EBS snapshots and memory dumps. To ensure the integrity of this data, it should be stored in an isolated forensic account, which enhances security by isolating sensitive data. Using S3 Object Lock ensures that the data cannot be altered or deleted, providing immutable storage for forensic evidence.