Incident Response in Cloud CCSE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   During an incident in Azure, a security analyst sees a suspicious sign-in from a user account that has Global Administrator privileges. The sign-in occurred from an unfamiliar IP address at 3:00 AM. The analyst needs to determine if the account is compromised and what actions the attacker took. Which sequence of actions best achieves this?

   • AReset the user's password immediately and then review the sign-in logs to see if any other accounts were affected.
   • BDelete the user account and then restore it from a backup of Azure AD.
   • CReview the Azure AD sign-in logs and audit logs for the user, correlate with Azure Activity Log for any changes to directory settings, and then temporarily disable the user account.
   • DBlock the unfamiliar IP address at the firewall and then wait for the user to report any unusual activity.
   Reveal Solution Discussion Select an answer first
2. 17application · medium · select all that apply

   A company has experienced a ransomware attack on a GCP project. The incident response team has contained the affected instances. Which of the following are appropriate eradication and recovery steps? (Select all that apply.)

   • AReview and update IAM policies to remove any excessive permissions
   • BDelete the compromised instances and all their snapshots
   • CPatch the operating system and applications to the latest versions
   • DReimage the instances from a known good image
   • ERestore the affected instances from clean backups taken before the incident
   Check answers Discussion Select an answer first
4. 18expert · hard

   During an incident, a forensic investigator needs to collect memory from a compromised Linux VM running in AWS. The VM is in a private subnet with no direct internet access. The investigator has IAM permissions to use Systems Manager (SSM) and AWS Lambda. The organization requires that all evidence be preserved with a documented chain of custody and that the VM remain running for further analysis. Which approach best meets these requirements?

   • AStop the VM, detach the root volume, and attach it to a forensic workstation to perform offline memory analysis.
   • BUse SSM Run Command to execute a memory acquisition tool on the VM, store the memory dump in an S3 bucket with versioning enabled, and record the command execution ID and timestamp in the chain-of-custody log.
   • CUse AWS Lambda to invoke the EC2 API to trigger a snapshot of the instance's memory, then store the snapshot in a forensic S3 bucket.
   • DCreate an AMI of the running VM and launch a new instance from that AMI, then perform memory acquisition on the new instance.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   After a cloud incident, the incident response team is conducting a post-mortem. They found that the incident response plan did not include specific steps for handling a compromised service account in AWS. What should the team do to improve the plan?

   • AOnly document the incident in the post-mortem report and take no further action.
   • BUpdate the incident response plan to include a playbook for compromised service accounts, and conduct a tabletop exercise to test it.
   • CDelete the incident response plan and create a new one from scratch.
   • DBlame the team member who missed the service account compromise and move on.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which AWS service provides a detailed audit log of API calls made within an AWS account, which is commonly used for security monitoring and incident detection?

   • AAWS Config
   • BAmazon CloudWatch
   • CAWS CloudTrail
   • DAmazon GuardDuty
   Reveal Solution Discussion Select an answer first