Incident Response in the Cloud CSE Practice Questions (Page 10)

Questions 46–49

1. 46application · medium

   A cloud security team is developing an incident response plan for a hybrid cloud environment. They want to ensure that the plan addresses the unique aspects of cloud, such as shared responsibility and rapid scalability. What is the most important element to include in the plan?

   • ADefine roles and responsibilities for both the cloud provider and the customer.
   • BRely solely on the provider's incident response team.
   • CFocus only on on-premises components since the cloud is the provider's responsibility.
   • DCreate a static plan that does not need to be updated.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A healthcare organization experiences a cloud security incident that may involve protected health information (PHI). The incident response team is preparing to notify affected parties. Which legal or regulatory requirement should they consider first?

   • AThe preference of the organization's legal counsel to delay notification.
   • BThe breach notification timeline specified by applicable data protection regulations.
   • CThe cloud provider's internal notification policy.
   • DThe organization's internal IT change management process.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A company experiences a data breach involving a cloud database. The incident response team needs to understand the scope of the breach and comply with legal notification requirements. Which action is most important when coordinating with the cloud provider?

   • AImmediately publish a public statement about the breach before notifying the provider.
   • BRequest detailed logs and metadata from the provider to support the investigation.
   • CAsk the provider to delete all data related to the incident to prevent further exposure.
   • DAssume the provider will handle all legal notifications on behalf of the company.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which of the following is a primary method for detecting security incidents in a cloud environment?

   • AAnalyzing application performance metrics
   • BConducting periodic penetration tests
   • CReviewing user feedback from support tickets
   • DMonitoring cloud provider audit logs and configuring alerts
   Reveal Solution Discussion Select an answer first