Suspicious operations by an administrator account have been detected.
Stop the spread while preserving evidence.
Which response is appropriate?
Contain the incident by disabling or rotating credentials while preserving logs and resource state for investigation.
Detailed explanation
Incorrect. Deleting logs and resources destroys evidence and complicates recovery.
Incorrect. Deleting logs and resources destroys evidence and complicates recovery.
Incorrect. Granting broader privileges can increase the damage.
Incorrect. Granting broader privileges can increase the damage.
Correct. Credential containment and preservation of evidence can proceed together.
Correct. Credential containment and preservation of evidence can proceed together.
Incorrect. Disabling detection can hide an ongoing attack.
Incorrect. Disabling detection can hide an ongoing attack.
Try it yourself
An example you can run in a temporary verification environment.
printf '%s\n' 'contain credentials, preserve evidence, assess scope'Expected result
contain credentials, preserve evidence, assess scopeKey points
- Containment
- Evidence preservation
- Impact assessment
Notes
- Environment: クラウドインシデント対応の概念確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.