Suspicious operations by an administrator account have been detected.
Stop the spread while preserving evidence.
Which response is appropriate?
Contain the incident by disabling or rotating credentials while preserving logs and resource state for investigation.
Detailed explanation
Incorrect. Deleting logs and resources destroys evidence and complicates recovery.
Incorrect. Granting broader privileges can increase the damage.
Correct. Credential containment and preservation of evidence can proceed together.
Incorrect. Disabling detection can hide an ongoing attack.
Try it yourself
An example you can run in a temporary verification environment.
printf '%s\n' 'contain credentials, preserve evidence, assess scope'Expected result
contain credentials, preserve evidence, assess scopeKey points
- Containment
- Evidence preservation
- Impact assessment
Notes
- Environment: クラウドインシデント対応の概念確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Initial response
Follow the incident-response plan and coordinate containment with evidence preservation.
Prevention
Review root cause, permissions, MFA, and audit settings after recovery to reduce recurrence.