Which cloud-specific detection technique is used to identify a potential compromised credential by analyzing sign-in logs for impossible travel patterns?

Anomalous API activity detection

A forensic investigator is handling a case involving a cloud VM that hosted a multi-tenant application. The investigator needs to collect evidence without violating the privacy of other tenants. Which approach is most appropriate?

Ask the cloud provider to provide logs from all tenants on the same host.

Request physical access to the underlying server to image the entire disk.

Use the cloud provider's snapshot and export features to capture only the VM's disk, and ensure that any data belonging to other tenants is not included in the collection.

Use a forensic tool inside the VM to search for other tenants' data.

Which containment action is most appropriate for a compromised cloud resource that is actively exfiltrating data?

Disabling the resource's network access

In a cloud incident response process, what is the primary purpose of taking a snapshot of a compromised virtual machine?

To restore the VM to a known good state

To preserve evidence for forensic analysis

EC-CouncilCertified SOC Analyst

Domain 6Objective 3

SOC for Cloud Environments CSA Practice Questions (Page 8)

Part of the Incident Response, Forensics and Cloud SOC domain, which makes up ~23% of our current practice bank.

50questions here

10free pages

7concepts

Questions 36–40

36foundation · easy
Which cloud-specific detection technique is used to identify a potential compromised credential by analyzing sign-in logs for impossible travel patterns?
Select an answer first
37foundation · easy
Which cloud deployment model is characterized by infrastructure that is provisioned for exclusive use by a single organization, but may be located on-premises or hosted by a third-party provider?
Select an answer first
38expert · hard
A forensic investigator is handling a case involving a cloud VM that hosted a multi-tenant application. The investigator needs to collect evidence without violating the privacy of other tenants. Which approach is most appropriate?
Select an answer first
39foundation · easy
Which containment action is most appropriate for a compromised cloud resource that is actively exfiltrating data?
Select an answer first
40foundation · easy
In a cloud incident response process, what is the primary purpose of taking a snapshot of a compromised virtual machine?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.