Incident Response in Cloud CCSE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which phase of the incident response lifecycle involves identifying the indicators of compromise and determining whether an incident has occurred?

   • ADetection and Analysis
   • BPreparation
   • CContainment, Eradication, and Recovery
   • DPost-Incident Activity
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   During an incident, a compromised Azure VM is part of a backend pool for a load balancer serving a production web application. The VM is generating malicious outbound traffic. The team must contain the VM without causing downtime for the application. Which action is BEST?

   • ADelete the VM and let the load balancer redistribute traffic
   • BStop the VM immediately and keep it in the backend pool
   • CRemove the VM from the load balancer backend pool and then apply a network security group (NSG) to block outbound traffic
   • DApply an NSG to the VM's subnet that blocks all outbound traffic
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security analyst notices a spike in failed login attempts to an AWS S3 bucket, followed by a successful login from an unfamiliar IP address. The analyst checks CloudTrail and sees that the successful login used an IAM user that was created two weeks ago but has never been used. The analyst needs to determine the scope of the incident. Which action is MOST appropriate?

   • ACorrelate CloudTrail events for the IAM user across all regions and services, and review the source IP and user agent
   • BDisable the IAM user immediately and reset the bucket policy
   • CDelete the IAM user and rotate all access keys in the account
   • DContact the cloud provider to request a full account audit
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security analyst notices that a cloud storage bucket in AWS S3 has been modified to allow public read access, and the bucket contains sensitive customer data. The analyst suspects that an insider with IAM permissions changed the bucket policy. What is the FIRST step the analyst should take to confirm the insider threat and contain the exposure?

   • ACreate a new S3 bucket and copy the data to it, then update the application to use the new bucket.
   • BDisable the IAM user's access keys and then wait for the user to explain the change.
   • CReview CloudTrail logs for the PutBucketPolicy event to identify the user and source IP, then immediately remove the public access by reverting the bucket policy.
   • DDelete the bucket to prevent further exposure, then restore from a backup.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security analyst is investigating a potential data exfiltration from a GCP project. The analyst suspects that a service account key was used to access a Cloud Storage bucket. Which log source should the analyst examine FIRST to confirm the use of the service account key?

   • AFirewall rules logging
   • BCloud Monitoring metrics
   • CCloud Audit Logs for Cloud Storage
   • DVPC flow logs
   Reveal Solution Discussion Select an answer first