Incident Response is 14% of the exam. These notes follow the AWS Security Incident Response Guide: what to preserve first, how containment behaves, and how to deal with compromised long-term and temporary credentials.
Before isolating or shutting down a compromised instance, capture its memory: EBS snapshots only hold what was written to disk, not what is in memory. Then acquire the snapshots and isolate; shutting it down once you have the evidence is the recommended choice.
Official source: docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide/aws-security-incident-response-guide.html
Changing a security group does NOT close connections that are already tracked: it only blocks future traffic. To contain you can also use a NACL (processed top-down, so the deny must come first), but it affects every resource in the subnet.
Official source: docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide/aws-security-incident-response-guide.html
To contain an access key (prefix AKIA) you can deactivate or delete it: a deactivated key can be reactivated, a deleted one cannot be recovered. An IAM principal can have at most two access keys at a time.
Official source: docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide/aws-security-incident-response-guide.html
Temporary credentials (prefix ASIA) are not rotated or revoked: they expire. If an attacker created them with an IAM user's access key, attach an inline policy that denies based on the token issue time, or delete and recreate the user.
Official source: docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide/aws-security-incident-response-guide.html
Prepare the instance before investigating: enable termination protection, disable Delete on Termination on its volumes and tag it. A tag such as Status=Quarantine can automatically trigger forensic acquisition and isolation.
Official source: docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide/aws-security-incident-response-guide.html
Answer practice questions, then review your mistakes with spaced repetition.