MENU
Refer to the exhibit.
A company went through several rounds of restructuring and the previous security team has been let go A new engineer joins and rediscovers all the tools that the previous team left behind. One of the tools Is a Bash script related to monitoring AWS accounts for threats What is the purpose of the script?
The correct answer is Monitoring failed AWS console login attempts. The Bash script shown in the exhibit is clearly designed to parse AWS CloudTrail logs and extract specific authentication-related events.
Breaking down the script behavior from a professional cloud security perspective:
gunzip -c *.json.gz indicates the script is processing compressed CloudTrail log files, which are typically stored in .json.gz format.
jq -c '.Records[]' parses individual CloudTrail records, a common approach when analyzing AWS activity logs.
The filter conditions explicitly check for:
eventSource == 'signin.amazonaws.com'
eventName == 'ConsoleLogin'
responseElements.ConsoleLogin == 'Failure'
These fields are definitive indicators of failed AWS Management Console login attempts. Additionally, the script extracts contextual fields such as:
Event time
Source IP address
Error message
AWS region
Username
MFA usage status
This data is exactly what security teams use to detect credential abuse, password spraying, brute-force attempts, and compromised IAM accounts. Monitoring failed console logins is a foundational cloud threat hunting activity, especially for identifying early stages of account takeover.
Option B is incorrect because the script does not establish AWS CLI sessions or authenticate to accounts. Option C is incorrect because instance errors would involve services like ec2.amazonaws.com and different event names. Option D is incorrect because the script is analyzing---not archiving---records, and it applies filtering logic rather than storage or lifecycle management.
From a threat hunting and cloud security standpoint, this script supports identity-focused detection, which is critical in AWS environments where IAM misuse is one of the most common initial access vectors. It aligns with MITRE ATT&CK -- Credential Access and Initial Access, particularly techniques involving valid account abuse.
In summary, the script's clear purpose is to monitor failed AWS console login attempts, making Option A the correct and professionally validated answer.