MENU
A company receives an alert from AWS Support. The alert shows a compromised access key on a single standalone AWS account. A security engineer must determine the scope of the issue. Then, the security engineer must triage and remediate the issue.
Which solution will meet these requirements?
Comprehensive and Detailed 100to 150 words of Explanation From AWS Certified Security -- Specialty topics: AWSCompromisedKeyQuarantineV3 is applied by AWS when IAM user credentials are compromised or exposed, and AWS explicitly warns not to remove the policy until the support-case instructions are followed. The correct response is to first determine scope by reviewing CloudTrail activity for the compromised key, identify API calls and unauthorized resources, remove unauthorized resources, rotate or replace the compromised access keys, and only then remove the quarantine policy after remediation is complete. Deleting the user immediately can destroy useful attribution and may break legitimate dependencies. Removing the quarantine policy first is unsafe because it may restore attacker capability. CloudWatch logs alone do not provide the full account-wide API activity trail needed for scope determination.
================