3.8 Determine the Steps to Investigate Potential Data Loss from a Variety of Vectors of Modality Such as Cloud, Endpoint, Server, Databases, Application 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A user reports that sensitive files were copied to a USB drive from their corporate laptop. The laptop is still powered on and the user is still logged in. Which action should the investigator take FIRST to preserve evidence?

   • ACapture the contents of RAM and running processes, then create a forensic image of the hard drive.
   • BAsk the user to unplug the USB drive and then shut down the laptop.
   • CCopy the USB drive's contents to a network share for analysis.
   • DCreate a forensic image of the laptop's hard drive using a write-blocker.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A cloud administrator discovers that a storage bucket in Azure was configured with public access and contained a backup of a customer database. The administrator suspects that the public access was enabled by an insider. Which evidence source is most useful to determine who enabled public access?

   • AThe Azure activity log, which records the user principal name and the timestamp of the configuration change.
   • BThe storage account's diagnostic logs, which show read and write operations on the blobs.
   • CThe network security group flow logs, which show traffic to and from the storage account.
   • DThe Azure Policy compliance report, which shows whether the storage account is compliant with the organization's policies.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company's customer relationship management (CRM) application allows users to export contact lists. The application logs show that a user exported a large list of contacts, but the user claims they only exported a small subset. The security team suspects that the application's API is being abused to bypass the user interface limits. Which investigation step is most appropriate?

   • ACheck the user's browser history to see if they used the UI to export the contacts.
   • BDisable the user's account to prevent further exports.
   • CReview the API gateway logs to see if the user made direct API calls that bypassed the UI limits.
   • DAsk the user to demonstrate how they exported the contacts.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   An endpoint security analyst is investigating a data loss incident involving a user's workstation. Which endpoint vector is most commonly associated with data exfiltration?

   • ASQL injection on a database server
   • BMisconfigured cloud storage
   • CInsider threat from a cloud administrator
   • DRemovable media such as USB drives
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An application allows users to export reports. A security analyst suspects that a malicious insider used the application's API to export a large volume of customer data. Which combination of log sources would provide the strongest evidence of the insider's actions?

   • AEndpoint logs for the insider's workstation.
   • BDatabase logs showing queries from the application server.
   • CNetwork firewall logs showing connections to the application server.
   • DAPI access logs and application audit logs showing the user ID and the export parameters.
   Reveal Solution Discussion Select an answer first