A SaaS company must cut mean time to respond for ransomware in three AWS Regions, requiring pre-provisioned forensic jump access, isolated evidence storage with Object Lock, and pre-deployed GuardDuty, Security Hub, and Detective. Legal requires tested runbooks and no production credential reuse. Which incident preparation design meets these readiness requirements?
Select an answer to reveal the explanation.
Short Explanation
You’re staging gear before the fire starts. A dedicated IR account keeps tools and evidence clean, like a go-bag packed with locked evidence kits ready to grab.
Full Explanation
The correct design satisfies all readiness pillars together because a dedicated IR account provides blast-radius separation across the three Regions, break-glass roles deliver pre-provisioned forensic jump access without dependence on production access paths, an S3 Object Lock vault in Compliance mode preserves chain of custody with WORM immutability for ransomware evidence, and pre-enabled GuardDuty, Security Hub, and Detective with proper delegation ensure historical telemetry and immediate correlation to cut mean time to respond while supporting tested runbooks without credential reuse. The versioned-archive design fails on evidence immutability by concept because versioning with MFA Delete enables operational recovery but not Object Lock legal hold, still allowing privileged deletion and failing tamper-proof retention required for legal admissibility. The corporate-SSO design fails on identity isolation because extending production workforce roles into the IR account reuses the same identity provider and compromise domain an attacker may control, violating segregation and risking loss of forensic access during an IdP outage. The StackSets-at-declaration design fails on pre-deployment readiness because enabling detection after declaration loses pre-incident baselines, introduces cross-Region deployment and backfill delay, and directly increases response time despite sounding efficient. For exams, remember that fast automation is still scored as unprepared when the prompt says pre-provisioned or pre-enabled, so do not equate minutes-to-deploy with ready. Practically, validate with a game day that break-glass login works with no production credentials, that the vault denies object deletion until retention expires, and that GuardDuty and Security Hub show active delegated coverage in all three Regions before any incident.