Incident Response in Cloud CCSE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium · select all that apply

   A security analyst is reviewing Azure AD sign-in logs and notices a user account that has been locked out multiple times. The analyst suspects a brute-force attack. Which of the following are appropriate initial triage actions? (Select all that apply.)

   • AReview the user's recent activity for any unusual access patterns
   • BCorrelate the sign-in attempts with other Azure AD logs, such as audit logs
   • CDisable the user account immediately
   • DReset the user's password and require MFA
   • ECheck the sign-in logs for the source IP addresses and user agents
   Check answers Discussion Select an answer first
2. 7foundation · easy

   What is the primary benefit of using automated playbooks in cloud incident response?

   • AThey automatically patch all vulnerabilities in the cloud environment
   • BThey reduce the time to respond to common incidents by executing predefined actions
   • CThey guarantee that no incident will occur
   • DThey eliminate the need for security monitoring
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company experiences a data breach involving a misconfigured Azure Blob Storage container that exposed customer data. The incident response team has contained the issue. The company must notify affected customers and regulatory authorities. Which party is responsible for determining the notification timeline and content?

   • AThe public relations department
   • BThe legal and compliance department
   • CThe cloud service provider (Microsoft)
   • DThe incident response team
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is using AWS and wants to detect potential crypto-mining activity on their EC2 instances. They have enabled VPC Flow Logs and CloudTrail. Which combination of logs should they analyze to detect the crypto-mining activity?

   • AAWS Config to check the instance configuration for any changes that might indicate mining software installation.
   • BOnly VPC Flow Logs to see if there is any traffic to the internet, regardless of destination.
   • COnly CloudTrail to see if any IAM users have logged in from suspicious IP addresses.
   • DVPC Flow Logs to identify unusual outbound traffic to known mining pools, and CloudTrail to identify any unauthorized API calls that may have launched new instances.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security operations team wants to automate the initial response to a suspected compromised Azure VM. They need a solution that automatically isolates the VM from the network, collects key forensic artifacts, and notifies the incident response team. Which Azure service or feature should they use?

   • AAzure Policy that automatically applies a 'deny all' NSG to any VM that triggers a security alert.
   • BAzure Security Center's just-in-time (JIT) VM access feature to block all inbound traffic to the VM.
   • CAzure Sentinel with an automation rule that triggers a playbook using Azure Logic Apps to apply an NSG and collect diagnostics.
   • DAzure Monitor alert rule that sends an email to the security team when a VM is suspected of compromise.
   Reveal Solution Discussion Select an answer first