Incident Response in Cloud CCSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   During a cloud security incident, the incident response team needs to communicate with the cloud service provider (CSP) to obtain forensic data and coordinate containment. Which communication channel should be used to ensure a formal and documented process?

   • APost a message on the CSP's public forum asking for help with the incident.
   • BSend an email to the CSP's general contact address and wait for a response.
   • COpen a support ticket with the CSP and request the necessary logs and assistance, documenting all interactions.
   • DUse a personal connection at the CSP to get the information quickly without formal documentation.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a best practice for restoring a compromised cloud workload to a known good state?

   • AApply a patch to the operating system
   • BRestore from a backup taken before the incident
   • CSimply restart the VM
   • DRebuild the workload from scratch without any backups
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company using Google Cloud Platform (GCP) detects that a compromised service account key is being used to create new Compute Engine instances in a project. The security team needs to contain the incident while preserving evidence for investigation. Which set of actions should be taken FIRST?

   • ADelete the compromised service account and all instances created by it, then restore the project from the last backup.
   • BApply a firewall rule that blocks all traffic to the new instances, then wait for the attacker to stop using the key.
   • CDisable the compromised service account key, revoke the service account's IAM roles, and then snapshot the disks of any newly created instances.
   • DRotate the compromised key by generating a new key and updating the applications, then delete the old key after 24 hours.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is a typical output of a cloud incident post-mortem?

   • AA list of actionable recommendations to improve cloud security and incident response
   • BA bill for the cost of the incident
   • CA new set of credentials for all users
   • DA guarantee that similar incidents will never happen again
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of maintaining a chain of custody when collecting evidence from cloud resources?

   • ATo ensure the evidence is stored in the most cost-effective manner
   • BTo speed up the forensic analysis process
   • CTo comply with cloud provider's terms of service
   • DTo prove that the evidence has not been tampered with and is admissible in legal proceedings
   Reveal Solution Discussion Select an answer first