AWS Cloud Security and Incident Response Automation

GASAE · 20 questions

• A city AWS account for online permitting must prove CloudTrail and AWS Config are enabled in every organizational unit. What automation focus is that?
• A county wants GuardDuty findings to open IR tickets automatically without analysts watching the AWS console all day. What monitoring automation pattern is that?
• A transit authority centralizes VPC Flow Logs into a security account for correlation across fare and operations VPCs. What telemetry design is that?
• A school district uses AWS Config rules to flag public S3 buckets that may hold student records. What compliance automation is that?
• A public-health department maps AWS Security Hub controls to its HIPAA-adjacent checklist for continuous evidence. What automation alignment is that?
• A city IR playbook auto-isolates an EC2 instance tagged as compromised only after dual human approval. What AWS response design is that?
• A county uses Lambda-backed response to snapshot EBS volumes before wiping a malware-hit jump box. What IR automation priority is that?
• A housing authority revokes suspicious IAM access keys through automation when GuardDuty flags them. What AWS IR action is that?
• A parks department quarantines a compromised ECS task without taking down the entire cluster serving park reservations. What containment approach is that?
• An emergency-management AWS account uses Step Functions to collect logs then notify the fusion center during an incident. What IR automation pattern is that?
• A city runs continuous Security Hub improvement sprints driven by automated finding trends rather than one-time audits. What AWS security practice is that?
• A county remediates common CIS AWS Foundations failures with event-driven automation when Config detects drift. What improvement pattern is that?
• A transit DevSecOps team measures mean time to remediate public-exposure findings month over month on AWS. What continuous-improvement signal is that?
• A library consortium promotes auto-remediation from staging AWS accounts to production only after a burn-in period. What safe-promotion practice is that?
• A water utility tags every automated AWS security fix with a linked change ticket for auditors. What continuous-improvement control is that?
• A city SOC uses a Bedrock-class generative assist to draft IR summaries from CloudTrail excerpts for analysts to review. What AI-assisted AWS workflow is that?
• A county detection team asks an AI agent to propose Athena queries over VPC Flow Logs, then requires analyst review before execution. What AI-assisted investigation pattern is that?
• A housing authority refuses sending raw citizen PII from S3 access logs to an external generative model. What AI workflow control is that?
• A 311 cloud team builds an agent that may recommend Security Hub suppressions only when it also supplies justification text for analysts. What controlled AI triage practice is that?
• A city architect ties Bedrock agents to read-only IAM roles for investigation and never grants them delete APIs. What AI-assisted AWS design is that?