Incident Response in Cloud CCSE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is a legal or regulatory notification requirement that may apply after a cloud data breach?

   • AWaiting for the attacker to disclose the breach
   • BPublishing the incident on social media
   • CNotifying affected individuals and regulatory authorities within a specified timeframe
   • DInforming all competitors about the breach
   Reveal Solution Discussion Select an answer first
2. 32application · medium · select all that apply

   An incident response team is collecting evidence from a compromised Azure VM. Which of the following are appropriate evidence collection methods that preserve chain of custody? (Select all that apply.)

   • ARecord the time and identity of the person collecting each piece of evidence
   • BCopy the VM's VHD to a forensic workstation
   • CDelete the VM after collecting logs
   • DCapture the VM's memory using a tool like LiME
   • ETake a snapshot of the VM's OS disk and store it in a separate storage account
   Check answers Discussion Select an answer first
4. 33expert · hard

   A forensic investigator is responding to a security incident involving a Kubernetes cluster running in Google Kubernetes Engine (GKE). The investigator needs to collect evidence from a compromised pod without disrupting the cluster's availability. The pod is running a containerized application that stores data in an emptyDir volume. Which approach best preserves evidence while minimizing impact?

   • AUse kubectl exec to run a forensic tool inside the container to capture memory and files, and copy the emptyDir volume contents to a persistent storage location.
   • BDelete the pod immediately to stop the attack, and then rely on the cluster's logging system for evidence.
   • CUse gcloud compute instances list to find the node running the pod, then attach a forensic disk to the node and perform memory acquisition from the host.
   • DTake a snapshot of the entire GKE cluster using the Google Cloud console, then restore the cluster to a clean state.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   An organization using Azure has detected a compromised VM that is part of a domain controller for a hybrid Active Directory environment. The VM is running critical business applications that cannot be offline for more than 30 minutes. The security team needs to contain the incident while maintaining business continuity. Which containment strategy best balances these constraints?

   • ADetach the VM's disks and attach them to a new VM to continue operations.
   • BImmediately shut down the VM to stop the attack, and then restore from the last backup.
   • CApply an NSG to the VM that only allows traffic from the corporate VPN and specific management IPs, then begin forensic collection while the VM remains online.
   • DDelete the VM and recreate it from a snapshot, hoping the malware is not in the snapshot.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   An organization discovers that a developer accidentally left an AWS S3 bucket publicly readable, exposing customer data. Which cloud-specific threat vector does this represent?

   • AMisconfigured service
   • BInsider threat
   • CDenial of service
   • DCompromised credentials
   Reveal Solution Discussion Select an answer first