Incident Response in the Cloud CSE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   Your organization uses a hybrid cloud environment with on-premises and AWS resources. You need to detect incidents that span both environments. What is the best approach?

   • AUse only AWS CloudTrail for monitoring and ignore on-premises logs.
   • BDeploy a separate SIEM for each environment.
   • CMonitor each environment separately and manually correlate events.
   • DCentralize logs from both environments into a single SIEM platform.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is responding to a security incident that involves a cloud provider's managed service. The incident response team needs to collect evidence and coordinate with the provider. The provider has a legal obligation to preserve evidence but also has a policy that limits access to certain logs. What is the best way to handle this situation?

   • AAttempt to access the logs through unauthorized means.
   • BThreaten legal action if the provider does not provide all logs immediately.
   • CWork with the provider's incident response team to obtain the necessary logs while respecting their policies.
   • DDemand immediate access to all logs without regard to the provider's policies.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A cloud incident involves a data breach in a multi-tenant environment. You need to collect evidence that may be used in legal proceedings. What is a critical consideration for maintaining chain of custody?

   • AUse the cloud provider's default logging without any additional configuration.
   • BDocument who collected the evidence, when, and how it was handled.
   • CShare the evidence with the cloud provider immediately.
   • DEnsure the evidence is stored in the same region as the incident.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   Your organization uses AWS CloudTrail to monitor API activity. You need to detect a potential compromised account that is making unusual API calls. What is the best way to detect this?

   • ADisable the account's access keys to prevent further API calls.
   • BEnable MFA on the account and hope the attacker cannot bypass it.
   • CCreate a CloudWatch alarm that triggers on specific API calls from the account.
   • DReview the CloudTrail logs manually once a week.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A cloud security analyst notices that an S3 bucket in AWS is publicly accessible and contains sensitive data. This is a common cloud security incident. What is the immediate containment action?

   • AChange the bucket policy to block all public access.
   • BDelete the S3 bucket and all its contents.
   • CCreate a new bucket and copy the data to it.
   • DEnable versioning on the bucket to preserve previous versions.
   Reveal Solution Discussion Select an answer first