- The situation at Marlow Health
- Your role and the brief
- Sandbox and tooling
Investigate suspicious access to a healthcare cloud account
A clinic group’s AWS account shows an unexpected admin user and a stopped trail. In your own sandbox account you generate the incident with an attack simulator, then investigate blind: build the timeline from CloudTrail, scope what was touched, contain and eradicate, harden the account, add detection that actually fires, and write the incident report.
PCREATED BYPrepmeetsProject studio, Prepmeets
THE CHALLENGE → YOUR OUTCOME
Real context. Work that matters.
Marlow Health, a group of outpatient clinics, gets a message from a vendor that one of its cloud credentials looks exposed. In your sandbox you stand in for the clinic’s one security-minded engineer. You investigate what the credential was used for, remove the attacker’s foothold, harden the account and write the report the clinic’s data protection officer needs to decide whether anyone has to be notified.
What’s at stake
Your responsibility: Work as the security engineer, incident responder—investigate the requirements, implement your approach and verify the result.Marlow moved appointment letters and scanned referrals into AWS two years ago. A reporting job reads from the letters bucket every night with an access key belonging to a service user called svc-reporting. The key was created by a contractor, has never been rotated and was given broad IAM permissions “so the job would stop failing”.
Success means: An incident report the IT manager can hand to the data protection officer: a verified timeline, the scope and its limits, the containment and eradication steps with evidence they worked, the hardening and detection now in place, and a plain statement of what Marlow still cannot know. Explain the decisions and checks behind your implementation.
WHAT YOU’LL BUILD
01AWS
02CloudTrail
03IAM
Marlow Health sandbox AWS account
INCLUDED WITH YOUR PROJECT
A workspace, not just a document.
Your brief, a Jira-style task board and an interview studio—all in one place.
A look inside your workspace
Start with the full project brief
Build step by step Track your progress Own your interview story
Know where you’re heading.
- 01The situation at Marlow Health
- 02Your role and the brief
- 03Sandbox and tooling
- 04The account and its logs
- 05Build, simulate, hunt, contain, harden, report
- 06Test the defence
- 07What you hand over
- 08Submission and cleanup
Practise explaining your decisions
Which decision mattered most in your solution, and how did you verify it?
Use your own implementation to connect Situation, Task, Action and Result into one interview story.
Before you begin · tools & running costs
Prerequisites: Your own accounts and access to AWS CloudTrail and Athena, IAM, access keys and policy simulation, GuardDuty and EventBridge, Stratus Red Team.
Additional costs: Cloud and tool usage in your own accounts may incur charges. Set a budget and clean up after testing.
Work in your own accounts and repositories. Never share credentials or confidential data.
What’s included
Project brief, target-design guidance, assigned tasks, resource guidance and interview prompts. Detailed requirements become part of your purchased workspace.
P
MEET YOUR PROJECT EXPERT
Prepmeets
Project studio, PrepmeetsWe are the team that builds Prepmeets. Between us we have run cloud platforms, delivery pipelines, analytics teams and AI governance programmes in banks, hospitals, retailers and government departments, and these projects are the work we used to hand to new joiners in their first fortnight. Every one of them is a real scenario with the client’s name changed, scoped to a week of evenings, and reviewed by the person who originally did the job.
View verified expert profile Expert review is an optional paid service, separate from project access.
£19.90Start this project