Cloud Application Logging, Monitoring, and Incident Response
This domain tests whether you can detect an event, reconstruct it, and contain it without destroying the evidence. Items commonly present an active compromise and ask for the first action.
Core rules
- Log three layers: control plane (management API calls, IAM changes, key usage, changes to logging configuration itself), data plane where available, and application security events (authentication successes and failures, authorization denials, administrative actions).
- Centralize logs into a separate, tightly restricted account; make storage immutable with object lock/WORM, set retention by obligation, and protect the pipeline from the workload it observes.
- Detect with SIEM correlation plus native threat detection. Configure high-signal alerts: root or global-admin use, logging disabled, new access keys created, trust policy changes, and spikes in authorization denials.
- Incident response lifecycle (NIST SP 800-61): preparation, detection and analysis, containment, eradication, recovery, post-incident activity. Cloud mechanics differ - snapshot before termination, isolate with a quarantine security group rather than powering off, preserve memory where feasible, and use a dedicated forensics account.
- Prepare access and automation in advance. Notification clocks (for example 72 hours under GDPR) start when you become aware, not when analysis finishes.
Worked example
An analyst sees anomalous API calls originating from an EC2 instance. Reasoning: terminating the instance destroys volatile evidence and may tip off the attacker. Instead, apply a quarantine security group allowing only the forensics host, snapshot the EBS volumes, capture logs and instance metadata, then revoke the instance role's sessions and rotate every credential it could reach. Only after evidence is secured do you rebuild from a known-good image and reintroduce the workload.
Traps
Terminating the instance first; keeping logs only in the compromised account; assuming provider logs capture application authorization decisions; and treating silence as safety when no high-signal detections were ever configured.