3.8 Determine the Steps to Investigate Potential Data Loss from a Variety of Vectors of Modality Such as Cloud, Endpoint, Server, Databases, Application 350-201 Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   An organization suspects that a cloud storage bucket was accessed by an unauthorized party. Which investigation step is most appropriate to determine the cause?

   • AInspect the hard drive of the storage server.
   • BReview the cloud provider's access logs for the storage bucket.
   • CInterview all employees who have access to the cloud console.
   • DCheck the firewall logs on the organization's on-premises network.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security analyst is investigating a data loss incident where a user's credentials were used to access a file share and download sensitive files. The analyst has collected the authentication logs and the file share access logs. Which step should the analyst take next in the investigation workflow?

   • APreserve the authentication logs by exporting them to a secure location.
   • BCorrelate the authentication logs with the file share access logs to establish the timeline and the files that were accessed.
   • CNotify the user that their credentials were compromised.
   • DReset the user's password and revoke their access to the file share.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which investigation step is most effective for detecting unauthorized access to a server?

   • AChecking the server's physical location
   • BReviewing authentication and access logs
   • CScanning the server for malware
   • DReviewing the server's power consumption
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   A database administrator is investigating a potential data loss incident. Which database vector is most commonly associated with data exfiltration?

   • AEmail exfiltration
   • BRemovable media on an endpoint
   • CMisconfigured storage bucket
   • DSQL injection
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A database was compromised via SQL injection, and the attacker exported a large volume of data. The database is in production and cannot be stopped. The investigator must preserve evidence while maintaining availability. Which combination of actions is MOST appropriate?

   • ARun a series of SELECT queries to determine which records were exported.
   • BTake a full backup of the database and restore it to a separate server for analysis.
   • CEnable database audit logging if not already enabled, capture network traffic to the database, and snapshot the database's transaction logs.
   • DStop the database and copy the data files to an external drive.
   Reveal Solution Discussion Select an answer first