Incident Response in Cloud CCSE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   After a ransomware incident on an AWS EC2 instance, the incident response team has contained the instance and collected forensic evidence. The team now needs to restore the service to a known good state. The instance was originally launched from a custom AMI that is no longer available. What is the BEST course of action?

   • ALaunch a new instance from a public AMI and reconfigure the application manually
   • BRestore the instance from the most recent EBS snapshot that predates the incident
   • CContact AWS Support to recover the original AMI
   • DReuse the current instance after removing the ransomware files
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company's Azure subscription has a virtual machine that was compromised because the admin account had a weak password. The attacker used the VM to launch additional attacks. The incident response team wants to prevent similar incidents. Which combination of actions is MOST effective?

   • AEnable Azure AD password protection and require multi-factor authentication for all admin accounts
   • BChange the VM's public IP address and update the firewall rules
   • CInstall antivirus software on the VM
   • DMove the VM to a different resource group
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst receives an alert from Azure Defender indicating that a virtual machine (VM) in the production subscription has been communicating with a known command-and-control (C2) IP address. The analyst needs to confirm the scope of the compromise before taking action. The VM is part of a virtual network (VNet) with several other VMs. Which combination of actions should the analyst take FIRST to validate the alert and determine the blast radius?

   • AImmediately delete the VM's network interface and then restore from the last snapshot to ensure the malware is removed.
   • BReview Azure Activity Log for the VM's recent operations, then use Network Watcher IP flow verify to check if the C2 communication is allowed, and then isolate the VM by applying a network security group (NSG) that denies all outbound traffic.
   • CCreate a new Azure Sentinel workbook to visualize all network flows from the VM, then wait for 24 hours to see if the C2 traffic repeats.
   • DDisable the VM's public IP address and then run a full antivirus scan on the VM using the Azure Security Center recommendation.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   After a security incident in a multi-cloud environment, the incident response team conducts a post-mortem. They find that the detection was delayed because logs from different cloud providers were not centralized. What is the MOST effective improvement to implement?

   • ACreate a centralized logging solution that aggregates logs from all cloud providers into a single SIEM
   • BHire more security analysts
   • CDisable logging for less critical services to reduce noise
   • DIncrease the frequency of manual log reviews
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   After a cloud security incident, the incident response team conducts a post-mortem. They identify that the detection was delayed because logs from a critical application were not being forwarded to the central SIEM. Which improvement should be prioritized to address this gap?

   • AReplace the SIEM with a different vendor's product that has better dashboards.
   • BIncrease the retention period of the SIEM to store logs for a longer duration.
   • CConfigure the application to send logs to the SIEM using a log-forwarding agent, and create an automated alert for missing log sources.
   • DTrain the security analysts to manually check the application logs every hour.
   Reveal Solution Discussion Select an answer first