Security Incidents CV0-004 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company is reviewing its access control policies after a security breach. The breach occurred because a former employee's account was not deprovisioned after they left the company. Which policy change would BEST prevent this from happening again?

   • AConduct quarterly security awareness training
   • BRequire all employees to sign a non-disclosure agreement
   • CImplement an automated deprovisioning process that disables accounts when an employee leaves
   • DUse stronger passwords for all accounts
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company has a policy that requires all cloud resources to be tagged with an owner and cost center. During a security incident, the incident response team needs to quickly identify all resources that a compromised service account could access. The service account has permissions across multiple subscriptions. What is the MOST efficient way to assess the impact?

   • AUse the cloud provider's access analysis tool to list all resources the service account can access
   • BReview the service account's login logs to see which resources it accessed
   • CContact each subscription owner to ask if the service account has access to their resources
   • DCheck the tags on all resources to find the ones owned by the service account
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   A cloud administrator wants to prevent a user from escalating their privileges by modifying their own group memberships. Which control is BEST suited for this?

   • AIncreasing the password complexity requirements.
   • BRestricting the ability to modify group memberships to a separate administrative role.
   • CSetting all user accounts to expire after 90 days.
   • DEnabling multi-factor authentication (MFA) for all users.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the PRIMARY purpose of an incident response plan in the context of a security breach?

   • ATo assign blame to the individual responsible for the breach.
   • BTo provide a structured approach to detect, respond to, and recover from security incidents.
   • CTo document all security incidents for compliance purposes only.
   • DTo guarantee that no security incidents will occur in the future.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A cloud administrator is reviewing security logs and notices that a user account has been added to the 'Global Administrator' role. The user is a standard employee who should only have access to their own department's resources. The change was made using a service account that is used for automated provisioning. The service account's credentials may have been compromised. What is the BEST course of action?

   • ARemove the user from the 'Global Administrator' role, rotate the service account credentials, and investigate the provisioning system for unauthorized changes
   • BIgnore the alert because the change was made by an automated system
   • CChange the service account password and monitor the user's activity
   • DDisable the user account and create a new one with the correct permissions
   Reveal Solution Discussion Select an answer first