A bank's incident responders repeat the same log-analysis steps in every investigation. The security team wants those steps packaged as approved Jupyter notebooks that analysts run in a controlled environment. The notebooks read CloudTrail and VPC flow log archives from the log archive account, and no investigation data may leave AWS.
Analysts must run the approved notebooks without administrator rights, and the environment must be built the same way for every investigation. Any change to a notebook must be reviewed before analysts can use it.
Which approach should the security team use?
Choose one answer.
AA. Give each analyst an administrator role in the log archive account, and let analysts write notebooks on their laptops with whatever libraries and tools they choose, outside any shared review.
BB. Copy the log archives to each analyst workstation every morning, so that analysts can run the notebooks offline in their own tools without needing to reach AWS at all during the work.
CC. Run reviewed notebooks from a version-controlled repository on a SageMaker AI notebook instance in a private subnet, with VPC endpoints, internet access off and a read-only role.
DD. Run the notebooks on a notebook instance with direct internet access turned on, so that the team can install new libraries and tools whenever it needs them during an investigation.
Show the answer and explanation
Answer: C
A. Wrong: Administrator rights break the least-privilege rule, and laptop setups cannot be built the same way each time. Notebooks written on laptops would also skip the review that the team requires before use.
B. Wrong: Copying the archives moves sensitive data out of the controlled account, which the requirements forbid. Each workstation would also drift from the others over time, so the investigations would not share one environment.
C. Right: Correct. Version control and review keep only approved notebooks in use, and the instance can be rebuilt the same way each time. With internet access off and VPC endpoints in place, the data stays inside AWS, and the read-only role limits what analysts can do. Learn more: Amazon SageMaker AI notebook instances (opens in a new tab)
D. Wrong: Direct internet access lets investigation data leave the environment, which the requirements rule out. Installing libraries from the internet also makes each environment different from the last.
Explanation
A controlled notebook environment keeps data inside AWS, uses a read-only role, and is rebuilt from code and reviewed notebooks. Administrator laptops, copied archives and open internet access each break one of the stated requirements.
Want more on Incident response plans, runbooks and preparation? The 5 full-length practice sets have 7 more Incident response plans, runbooks and preparation questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →