Incident Response in the Cloud CSE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A security analyst notices that an S3 bucket is publicly accessible and contains sensitive customer data. Which type of cloud security incident does this represent?

   • ACompromised account
   • BDenial of service
   • CMisconfiguration
   • DData breach
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company detects a ransomware attack in its cloud environment. The attack has encrypted several virtual machines and is spreading to other resources. The incident response team needs to contain the attack quickly, but they also need to preserve evidence for law enforcement. What is the most effective containment strategy?

   • AIgnore the affected VMs and focus on protecting unaffected resources.
   • BPower off the affected VMs immediately to stop the encryption process.
   • CIsolate the affected VMs by disconnecting them from the network and taking snapshots before disconnection.
   • DDelete the affected VMs and restore from backups.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   Your organization's cloud security team detects a potential data exfiltration from an Azure Storage account. The incident response plan requires preserving evidence for potential legal action. You need to collect the storage account's activity logs and access logs while maintaining chain of custody. What should you do first?

   • ADisable the storage account's public access and then continue normal operations.
   • BCopy the logs to a separate, access-controlled storage account and enable immutability on the copied data.
   • CDelete the storage account to stop further access and then recover the logs from backups.
   • DModify the storage account's access keys to prevent unauthorized access.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   Your organization uses a third-party SaaS application that stores sensitive data. A security incident occurs, and you need to coordinate with the SaaS provider for investigation. The provider's terms of service limit your access to logs. What is the best approach?

   • ATerminate the contract with the provider immediately.
   • BAttempt to bypass the provider's access controls to obtain logs.
   • CRely solely on your own application logs and ignore the provider's data.
   • DRequest the provider's incident response assistance and clarify what logs they can provide.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which third-party might need to be coordinated with during a cloud incident response?

   • AThe cleaning service for your data center
   • BThe internet service provider (ISP) for your office network
   • CA third-party security vendor that provides your cloud security monitoring tools
   • DThe hardware manufacturer of your on-premises servers
   Reveal Solution Discussion Select an answer first