Incident Response in the Cloud CSE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary goal of the recovery phase in cloud incident response?

   • ATo collect evidence for legal proceedings
   • BTo identify the attacker's identity
   • CTo restore affected cloud services to normal operation while ensuring they are secure
   • DTo update the incident response plan
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which cloud service is commonly used to collect and analyze security-related logs and events for incident detection?

   • AContent delivery network (CDN)
   • BCloud monitoring and logging service (e.g., AWS CloudTrail, Azure Monitor)
   • CVirtual private network (VPN) gateway
   • DCloud storage service (e.g., Amazon S3)
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   During a security incident involving a compromised Azure VM, the incident response team needs to collect forensic evidence that may be used in legal proceedings. The VM is still running and the team suspects the attacker may have modified system files. What is the most appropriate approach to preserve evidence while maintaining chain of custody?

   • APower off the VM immediately and then create a snapshot.
   • BRely on the cloud provider's built-in monitoring logs as the only evidence.
   • CLog into the VM and copy the suspicious files to a forensic workstation.
   • DCreate a snapshot of the VM's OS disk and store it in a separate storage account with restricted access.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst detects that a container in a Kubernetes cluster is communicating with a known command-and-control server. The cluster runs a critical production application. What is the most effective containment action that minimizes disruption to the application?

   • AScale down the deployment to zero replicas.
   • BDisable the node's network interface.
   • CDelete the entire Kubernetes cluster and recreate it from scratch.
   • DApply a network policy that denies egress traffic from the compromised pod to the C2 server.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   After a cloud incident, your organization wants to recover services while also improving future incident response. You have limited resources and need to balance recovery speed with learning. What is the most effective approach?

   • ARestore services from clean backups first, then conduct a lessons-learned review.
   • BRestore services and skip the lessons-learned review to save time.
   • COnly restore the most critical services and ignore the rest.
   • DConduct a full lessons-learned review before restoring any services.
   Reveal Solution Discussion Select an answer first