Incident Response in the Cloud CSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   After a ransomware incident in your cloud environment, you have contained the threat and eradicated the malware. You now need to restore services to normal operation. Which step should be part of the recovery phase?

   • ANotify the cloud provider and request a full account reset.
   • BImmediately re-enable all user access to the restored services.
   • CConduct a lessons-learned review before restoring any services.
   • DRestore data from clean backups and verify the integrity of the restored data.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is an effective containment strategy for a compromised cloud resource?

   • AIncreasing the resource's permissions to allow better monitoring
   • BIsolating the resource by applying network security group rules to block traffic
   • CDeleting all logs related to the resource to clean up
   • DIgnoring the incident until business hours to avoid disruption
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   After a cloud incident is resolved, your organization wants to improve its incident response capabilities. Which activity is most important for the post-incident phase?

   • AImmediately restore all services to their pre-incident configuration.
   • BDelete all logs related to the incident to free up storage space.
   • CConduct a lessons-learned review to identify gaps and update the incident response plan.
   • DNotify the cloud provider that the incident is closed and no further action is needed.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company is designing an incident response plan for a serverless architecture using AWS Lambda and API Gateway. The security team wants to ensure that the plan accounts for the unique aspects of serverless, such as ephemeral execution environments and limited visibility. What is the most important element to include in the plan?

   • AFocus on traditional VM-based incident response procedures.
   • BEnsure that detailed logging and monitoring are enabled for all Lambda functions and API calls.
   • CRely on the cloud provider to handle all incident response for serverless.
   • DDisable logging to reduce the attack surface.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company uses AWS CloudTrail, Amazon GuardDuty, and AWS Config to monitor its cloud environment. An analyst wants to ensure that any new IAM user creation is detected and alerted in near real-time. What is the most effective method?

   • AManually review CloudTrail logs on a daily basis.
   • BUse GuardDuty to monitor for IAM user creation.
   • CEnable AWS Config rules to detect IAM user creation.
   • DCreate a CloudWatch Events rule that triggers on the 'CreateUser' API call and sends a notification to an SNS topic.
   Reveal Solution Discussion Select an answer first