During a cloud incident, a compromised VM is identified. The SOC needs to preserve evidence while minimizing disruption to the business. Which action is most appropriate?

Take a snapshot of the VM's disk and then isolate the VM by removing it from the network or applying a security group that blocks traffic.

Copy the VM's RAM to a file using a tool inside the VM.

Leave the VM running and continue monitoring without any action.

Immediately terminate the VM to stop the attack.

A forensic investigator needs to collect evidence from a cloud environment where a containerized application ran briefly and was then terminated. Which approach is most likely to yield useful forensic data?

Request the container image from the container registry

Check the local disk of the container host

Attempt to recover the container's memory from the host

Review cloud audit logs and container orchestration logs

A forensic investigator is handling a case involving a cloud VM that was compromised. The VM is part of an auto-scaling group and may be terminated at any time. The investigator needs to preserve evidence while maintaining the availability of the application. Which action is the most appropriate?

Rely on the auto-scaling group's launch template as evidence

Enable termination protection but do not snapshot

Detach the VM from the auto-scaling group and take a snapshot

Terminate the VM immediately to stop the attack

Which cloud security tool is commonly used to automate the collection and centralization of security logs from multiple cloud services for SOC analysis?

Security information and event management (SIEM) system

Virtual private network (VPN) gateway

EC-CouncilCertified SOC Analyst

Domain 6Objective 3

SOC for Cloud Environments CSA Practice Questions (Page 10)

Part of the Incident Response, Forensics and Cloud SOC domain, which makes up ~23% of our current practice bank.

50questions here

10free pages

7concepts

Questions 46–50

46foundation · easy
Which compliance framework is specifically designed for organizations that handle credit card data and is often applicable to cloud environments?
Select an answer first
47application · medium
During a cloud incident, a compromised VM is identified. The SOC needs to preserve evidence while minimizing disruption to the business. Which action is most appropriate?
Select an answer first
48application · medium
A forensic investigator needs to collect evidence from a cloud environment where a containerized application ran briefly and was then terminated. Which approach is most likely to yield useful forensic data?
Select an answer first
49expert · hard
A forensic investigator is handling a case involving a cloud VM that was compromised. The VM is part of an auto-scaling group and may be terminated at any time. The investigator needs to preserve evidence while maintaining the availability of the application. Which action is the most appropriate?
Select an answer first
50foundation · easy
Which cloud security tool is commonly used to automate the collection and centralization of security logs from multiple cloud services for SOC analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.