Incident Response in Cloud CCSE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is the primary purpose of a post-incident review (post-mortem) in cloud incident response?

   • ATo immediately restore all services without any analysis
   • BTo document what happened and identify areas for improvement in the incident response process
   • CTo assign blame to individuals who caused the incident
   • DTo delete all logs related to the incident to save storage
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company experiences a security incident that involves a data breach in a multi-cloud environment. The incident response team has contained the incident, but the company must notify affected customers and regulatory bodies. The company operates in the EU and the US. Which factor is MOST important in determining the notification requirements?

   • AThe number of affected users
   • BThe location of the cloud data centers
   • CThe type of data involved and the applicable legal jurisdiction
   • DThe cloud provider's incident response policy
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A security operations team wants to automate the initial response to a suspected compromised IAM credential in AWS. They want to automatically disable the IAM user and revoke temporary credentials when a CloudTrail alert fires. Which service should they use?

   • AAWS Config with a managed rule
   • BAmazon GuardDuty with a custom threat list
   • CAWS Shield Advanced
   • DAWS Lambda triggered by CloudWatch Events
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which of the following best describes the role of orchestration in cloud incident response automation?

   • AIt only collects and stores logs for later analysis
   • BIt is a type of firewall that blocks malicious traffic
   • CIt replaces the need for human incident responders entirely
   • DIt coordinates multiple automated actions across different tools and services to respond to an incident
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   An incident response team is responding to a security incident in a cloud environment. They need to collect evidence from a compromised virtual machine while preserving chain of custody. Which step is MOST important to maintain chain of custody?

   • AHave the cloud provider collect the evidence
   • BDocument who collected the evidence, when, and how it was stored
   • CCollect evidence only after the incident is fully contained
   • DUse the fastest available storage for the evidence
   Reveal Solution Discussion Select an answer first