During the eradication phase of cloud incident response, what is the primary goal?

To restore services to normal operation as quickly as possible

To remove the root cause of the incident from the environment

To notify affected customers about the incident

To collect and preserve evidence for legal purposes

During initial triage of a cloud security alert, which of the following is the FIRST step an incident responder should take?

Isolate the affected virtual machine immediately

Delete the affected resources to prevent further damage

Verify the alert is a true positive and not a false positive

In cloud forensics, which of the following is considered volatile evidence that should be collected first?

Data stored in an Amazon S3 bucket

The contents of a running VM's memory

Configuration files on a managed database

Network flow logs stored in CloudWatch

A security team wants to automate the response to a suspected compromised Azure AD account. They want to automatically revoke the user's sessions and require re-authentication when a risky sign-in is detected. Which combination of Azure services should they use?

Azure AD Privileged Identity Management and Azure AD B2B

Azure Security Center and Azure Sentinel

Azure AD Identity Protection and Conditional Access

Azure Monitor and Azure Automation

EC-CouncilCertified Cloud Security Engineer

Domain 4Objective 2

Incident Response in Cloud CCSE Practice Questions (Page 6)

Part of the Cloud Penetration Testing and Incident Response domain, which makes up ~20% of our current practice bank.

57questions here

12free pages

10concepts

Questions 26–30

26foundation · easy
Which of the following is a common cloud-specific threat vector that involves an attacker using stolen credentials to access cloud resources?
Select an answer first
27foundation · easy
During the eradication phase of cloud incident response, what is the primary goal?
Select an answer first
28foundation · easy
During initial triage of a cloud security alert, which of the following is the FIRST step an incident responder should take?
Select an answer first
29foundation · easy
In cloud forensics, which of the following is considered volatile evidence that should be collected first?
Select an answer first
30expert · hard
A security team wants to automate the response to a suspected compromised Azure AD account. They want to automatically revoke the user's sessions and require re-authentication when a risky sign-in is detected. Which combination of Azure services should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCSE” is a trademark of its owner, used for identification only.