3.8 Determine the Steps to Investigate Potential Data Loss from a Variety of Vectors of Modality Such as Cloud, Endpoint, Server, Databases, Application 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A web application allows users to upload files. The application logs show that a user uploaded a file that contained a script, and the script was executed on the server. The security team suspects that the application failed to validate the file type. Which investigation step is most appropriate to determine the scope of the data loss?

   • ARun an antivirus scan on the server to identify the script.
   • BBlock the user's IP address in the firewall.
   • CDelete the uploaded file from the server immediately.
   • DReview the web server logs and the application logs to identify the file that was uploaded and the commands that were executed.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization discovers that customer data was exfiltrated from a cloud database. The investigation team has access to CloudTrail logs, database audit logs, and VPC flow logs. Which correlation would BEST identify the scope of the data loss?

   • AReview only the CloudTrail logs for any API calls to the database service.
   • BAnalyze VPC flow logs for large outbound transfers to unknown IPs.
   • CCorrelate CloudTrail API calls with database audit logs to identify which user or role performed the export and what data was retrieved.
   • DMatch the database audit log entries with the VPC flow logs to identify which IP addresses accessed the database.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company uses a multi-cloud environment with AWS S3 and an Azure SQL database. An alert indicates that customer data was exfiltrated. The investigation team has limited time and must preserve evidence while minimizing production impact. CloudTrail is enabled in AWS, and Azure SQL audit logs are enabled. The team suspects either a misconfigured S3 bucket or a SQL injection in the Azure database. Which approach BEST balances evidence preservation with production continuity?

   • ATake both the S3 bucket and the Azure SQL database offline immediately to prevent further data loss.
   • BPreserve CloudTrail logs and Azure SQL audit logs, and analyze them to determine which vector was used before taking any containment action.
   • CRestore both systems from the most recent backups to ensure no data is lost.
   • DDisable the S3 bucket policy and the Azure SQL firewall rules simultaneously.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security analyst is investigating a data loss incident that involves a user's endpoint, a file server, and a cloud storage service. The analyst has collected logs from all three sources, but the logs show different timestamps because the systems are in different time zones. The analyst must determine the sequence of events. Which step is most appropriate?

   • AUse the timestamps from the file server as the authoritative source.
   • BConvert all timestamps to a common time zone, such as UTC, and then sort the events chronologically.
   • CUse the timestamps from the cloud storage service because they are the most accurate.
   • DIgnore the timestamps and focus on the user's actions.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   During a data loss investigation, an analyst has completed the detection and scoping phase. What is the next step in the investigation workflow?

   • AImmediately remediate the vulnerability that allowed the data loss.
   • BCollect and preserve evidence from affected systems and logs.
   • CNotify law enforcement before any internal analysis.
   • DDelete any suspicious files to prevent further spread.
   Reveal Solution Discussion Select an answer first