Incident Response in Cloud CCSE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium · select all that apply

   A company uses AWS and wants to improve its ability to detect security incidents. Which of the following are effective cloud-native detection mechanisms? (Select all that apply.)

   • AEnable CloudTrail and configure a trail to send events to CloudWatch Logs
   • BEnable GuardDuty to analyze VPC flow logs and DNS logs
   • CEnable AWS Shield Advanced for all accounts
   • DSet up AWS Budgets to monitor cost anomalies
   • EUse AWS Config to continuously monitor resource configuration changes
   Check answers Discussion Select an answer first
2. 2expert · hard

   After a major security incident, the incident response team conducts a post-mortem. They identify that the detection was delayed because the security team did not have access to logs from a newly acquired subsidiary's cloud environment. Which improvement is MOST effective to prevent this in the future?

   • AIntegrate the subsidiary's logs into the central SIEM and establish a service-level agreement for log availability
   • BIncrease the frequency of security audits for the subsidiary
   • CCreate a new incident response plan for the subsidiary
   • DRequire the subsidiary to use the same cloud provider as the parent company
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company's GCP project has a Compute Engine instance that is suspected of being used as a command-and-control server. The instance has a public IP and is part of a VPC network with other critical instances. The incident response team wants to contain the threat without disrupting other workloads. Which containment step is MOST effective?

   • AShut down the entire VPC network to isolate the instance
   • BDelete the instance immediately to stop the malicious activity
   • CRemove the instance's public IP address and attach a new one
   • DApply a firewall rule to block all outbound traffic from the instance's network tag
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A multinational company experiences a data breach involving personal data of EU residents stored in an AWS S3 bucket. The incident response team is coordinating with the cloud provider and legal counsel. The company has a contractual obligation to notify customers within 72 hours. Which action should the team take to ensure compliance and effective coordination?

   • AAsk AWS to delete the S3 bucket and all logs to prevent further exposure, then notify customers that the data has been secured.
   • BNotify only the cloud provider and internal management, and keep the breach confidential to avoid reputational damage.
   • CNotify the relevant supervisory authority and affected customers within the required timeframe, while coordinating with AWS to obtain detailed access logs and preserve evidence.
   • DWait for the forensic investigation to complete before notifying any parties to ensure the notification is accurate.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which Azure service is used to collect and analyze telemetry data, including application logs, performance metrics, and security events, to help detect potential incidents?

   • AAzure Security Center
   • BAzure Active Directory
   • CAzure Monitor
   • DAzure Policy
   Reveal Solution Discussion Select an answer first