Play free

Security World 6 · Incident Command · Stage 5

Trace the Root

Prove the cause and the scope before acting: the graph, the SQL and the finding checked against the resource.

  • Amazon Detective
  • CloudTrail Lake queries
  • Athena over flow logs
  • Finding validation
Domain
Security
World
Security World 6: Incident Command (Specialty)
Game type
Evidence desk: Each ticket is the reporter's words: find its cause in the evidence.
Time
About 35 minutes on a first attempt (estimated)
Exam guides
  • SOA-C03Skill 4.2.5: Configure reports and remediate findings from AWS services (for example, AWS Security Hub, Amazon GuardDuty, AWS Config, Amazon Inspector, AWS Security Agent)
  • DEA-C01Skill 4.4.3: Use AWS CloudTrail Lake for centralized logging queries
  • SCS-C03Skill 2.2.2: Search and correlate logs for security events across applications and AWS services; Skill 2.2.3: Validate findings from AWS security services to assess the scope and impact of an event; Skill 2.2.5: Describe methods to conduct root cause analysis (for example, Amazon Detective)