3.8 Determine the Steps to Investigate Potential Data Loss from a Variety of Vectors of Modality Such as Cloud, Endpoint, Server, Databases, Application 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An employee's laptop was stolen, and the laptop contained sensitive customer data. The company's endpoint protection logs show that the laptop was encrypted, but the employee had also copied some files to a USB drive that was in the laptop bag. The security team must determine whether the data on the USB drive was encrypted. Which investigation step is most appropriate?

   • ACheck the endpoint protection logs to see if the USB drive was encrypted by the company's policy.
   • BAsk the employee if they encrypted the USB drive.
   • CReport the incident as a data breach because the USB drive was lost.
   • DAssume the USB drive was encrypted because the laptop was encrypted.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company's web application allows users to upload files. An investigator suspects that an attacker abused an insecure API endpoint to upload a malicious file that then exfiltrated data. Which log sources should the investigator correlate to confirm the attack?

   • AAPI gateway logs, file upload logs, and outbound network traffic logs.
   • BEndpoint antivirus logs and firewall logs only.
   • CDatabase query logs and authentication logs only.
   • DWeb server access logs and API gateway logs only.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A web application suffered a data breach. The application logs show API calls from multiple IP addresses, but the API gateway logs are incomplete. The investigator must determine the scope of the data loss. Which approach is BEST?

   • ARely solely on the API logs to identify the affected data.
   • BBlock all IP addresses that appear in the API logs.
   • CCorrelate the available API logs with web server logs and database audit logs to reconstruct the attack timeline.
   • DAsk the application developers to recreate the attack in a test environment.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A security analyst is beginning an investigation into a potential data loss incident. According to a structured investigation workflow, which sequence of steps should the analyst follow to ensure a thorough and defensible investigation?

   • ARemediate immediately, then collect evidence to determine what happened.
   • BCollect evidence, identify the root cause, contain the incident, and then remediate.
   • CDetect and scope the incident, collect and preserve evidence, analyze the data, identify the root cause, and then remediate.
   • DIdentify the root cause first, then determine if data loss actually occurred.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A cloud storage bucket was found to be publicly readable, and sensitive files were downloaded by unknown parties. The bucket's access logs are enabled. Which evidence should the investigator preserve FIRST?

   • AThe bucket's access logs and the bucket policy version history.
   • BThe billing records for the cloud account.
   • CThe list of current bucket objects and their sizes.
   • DThe IAM roles that have permissions to the bucket.
   Reveal Solution Discussion Select an answer first