A federal agency runs 25 AWS accounts. When a security incident occurs, responders must get administrator access to an affected account within 15 minutes. Responders may not hold long-term credentials, and every session must be traceable to one person.
The agency also keeps a forensic account for investigators. Some investigations run up to two hours, so a session must last that long without being renewed mid-task. Responders sign in through an external identity provider that requires multi-factor authentication.
Which solution meets these requirements?
Choose one answer.
AA. Create an IAM user with administrator access for each responder in each account, and store the users' long-term access keys in a secrets vault that responders open during an incident.
BB. Create a break-glass role in the forensic account that trusts the identity provider, and have responders chain from it into an administrator role in each affected account.
CC. Create one shared break-glass IAM user in each account, with its password and a hardware MFA token kept in the security office safe for responders to sign out.
DD. Pre-create a break-glass role in each account that trusts the agency SAML provider and allows two-hour sessions. Responders assume it through federated sign-in.
Show the answer and explanation
Answer: D
A. Wrong: Each key is tied to one responder, but access keys are long-term credentials, which the agency forbids for responders. Keys for 25 accounts would also have to be stored, rotated and protected between incidents.
B. Wrong: Role chaining caps the session at one hour, so a two-hour investigation would lose access mid-task. The chain also adds a hop before every account, which slows the first minutes of a response.
C. Wrong: A shared user cannot show which responder ran each session, so the traceability rule fails. Its password is also a long-term credential that responders would hold during an incident.
D. Right: Correct. The role exists before any incident, so access takes minutes, and each session carries the federated user's identity. The two-hour maximum session duration fits the longest investigation, and the identity provider enforces MFA at sign-in. Learn more: IAM roles (opens in a new tab)
Explanation
A break-glass role that is ready before any incident gives fast access, and federated sign-in ties each session to one person without long-term credentials. A two-hour maximum session duration matches the longest investigation, and the identity provider enforces MFA. Role chaining is capped at one hour, and per-responder keys or a shared user break the credential or traceability rules.
Want more on Incident response plans, runbooks and preparation? The 5 full-length practice sets have 7 more Incident response plans, runbooks and preparation questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →