Security · Difficulty 4 of 5 · 45 min
Investigators cannot reconstruct an intrusion
After a suspected intrusion, investigators find gaps in the account's activity record and in the threat detector's findings. Some parts look healthy at first glance, including a second record that appears fully enabled. The workload runs in one region on purpose. Bring what is captured back in line with what security expects.
Where the symptom shows: CloudTrail
Take this challenge on a live account
A live AWS account, already broken, and a clock. You fix it with the provider's own console and command line, then read a report of how you worked. We host the cloud account. Nothing lands on your bill.
More challenges
- SecurityDefences look active but let everything throughElastic Load Balancing · 45 min · level 4
- SecurityA regulated data set fails its auditS3 · 90 min · level 5
- SecurityStorefront slows down under a traffic surgeElastic Load Balancing · 15 min · level 2
- SecurityInjection attempts reach the applicationElastic Load Balancing · 15 min · level 2
- SecurityOpen to the whole internetS3 · 5 min · level 1
- SecurityA protected route answers anyoneAPI Gateway · 5 min · level 1