Incident Response in Cloud CCSE Practice Questions (Page 11)

Questions 51–55

1. 51foundation · easy

   Which containment action is most appropriate for a compromised cloud VM that is actively communicating with a known command-and-control server?

   • ATerminate the VM immediately
   • BChange the VM's password
   • CApply a network security group rule to block traffic to the command-and-control server
   • DDelete the VM's disk
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A company uses AWS Organizations with multiple accounts. An alert from GuardDuty indicates that an EC2 instance in a production account is communicating with a known malicious IP. The instance has a role that allows it to access an S3 bucket containing sensitive data. The security team needs to determine if data was exfiltrated. Which approach is BEST?

   • AContact AWS Support to retrieve the instance's network traffic
   • BReview CloudTrail events for the instance's role and correlate with S3 access logs
   • CTerminate the instance immediately and restore from a snapshot
   • DDisable the instance's role and then check S3 access logs
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   During an incident involving a compromised Azure VM, the incident response team needs to preserve volatile evidence before shutting down the VM. The VM is running a critical application and cannot be stopped immediately. Which approach is BEST for collecting volatile evidence?

   • AUse Azure Bastion to connect and run memory capture tools on the VM
   • BEnable Azure Defender for Servers to collect additional logs
   • CTake a snapshot of the VM's OS disk and attach it to a forensic VM
   • DStop the VM immediately and copy the VHD to a forensic storage account
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   A security team wants to automate the response to a specific type of incident: an S3 bucket that becomes publicly readable. They want to automatically revert the bucket policy to a known good state and notify the security team. Which AWS service or feature should they use?

   • AAWS Identity and Access Management (IAM) to create a policy that denies public access to all S3 buckets.
   • BAmazon GuardDuty to detect the public bucket and automatically delete the bucket.
   • CAWS Config with a managed rule that detects public S3 buckets and triggers a Lambda function to restore the bucket policy.
   • DAWS CloudTrail to monitor PutBucketPolicy events and then manually revert the policy.
   Reveal Solution Discussion Select an answer first
6. 55foundation · easy

   During a cloud security incident, when should the organization notify the cloud service provider (CSP)?

   • AOnly after the incident is fully resolved
   • BImmediately if the incident involves the provider's infrastructure or services
   • COnly if the incident is reported in the news
   • DNever, because the provider is not responsible for customer incidents
   Reveal Solution Discussion Select an answer first