Incident Response in Cloud CCSE Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A security analyst is investigating a potential insider threat in a GCP project. An employee with access to a service account key has been terminated, but the key was not rotated. The analyst sees unusual activity from the service account, including creating new instances and accessing sensitive data. The analyst needs to determine if the terminated employee is using the key. Which approach best confirms this?

   • AAsk the terminated employee's manager if they know the employee's password.
   • BDisable the service account key immediately and then check if the unusual activity stops.
   • CReview Cloud Logging for the service account's activity, including the source IP addresses and user agent, and correlate with the terminated employee's last known IP address.
   • DUse Cloud Asset Inventory to see if the service account has been granted additional permissions recently.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A company's cloud environment was compromised through a vulnerable web application running on an AWS EC2 instance. The incident has been contained, and the root cause was identified as an unpatched vulnerability in the application. What should the team do to eradicate the root cause and recover the service?

   • ASimply restart the EC2 instance and hope the vulnerability is no longer exploitable.
   • BPatch the application with the latest security updates, rebuild the EC2 instance from a known good AMI, and restore data from a clean backup.
   • CIncrease the security group rules to block all inbound traffic to the instance.
   • DCreate a new AMI from the current instance and launch a new instance from that AMI.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A security incident involves a GCP Compute Engine instance that was compromised. The incident response team needs to collect forensic evidence while minimizing disruption to the instance's operation. The instance is running a critical batch job that cannot be interrupted. Which approach is BEST?

   • AStop the instance and create a disk image
   • BRun memory capture tools on the instance via SSH
   • CUse gcloud compute instances export to export the instance configuration
   • DCreate a snapshot of the instance's disk and attach it to a forensic VM
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which of the following is a cloud-specific containment strategy for a compromised user account?

   • ADisable the user account and revoke active sessions
   • BChange the user's display name
   • CWait for the account to expire
   • DSend an email to the user asking them to stop
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   During an incident in AWS, a security analyst sees that an EC2 instance has been compromised and is running cryptocurrency mining software. The analyst needs to preserve evidence for potential legal action while containing the incident. The instance is in an Auto Scaling group, and the launch configuration may be compromised. Which action best preserves evidence and contains the incident?

   • AUpdate the Auto Scaling group's launch configuration to a known good one, and let the instance continue running.
   • BDetach the instance from the Auto Scaling group, stop the instance, and take a snapshot of the EBS volumes for forensic analysis.
   • CTerminate the instance immediately to stop the mining activity, and rely on CloudTrail logs for evidence.
   • DCreate an AMI of the running instance and then terminate it, using the AMI for forensic analysis.
   Reveal Solution Discussion Select an answer first