Incident Response in the Cloud CSE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security incident is detected in a serverless application running on AWS Lambda. The incident response team needs to contain the threat. What is the most effective containment action?

   • ADisable the Lambda function's trigger and revoke the function's execution role permissions.
   • BIncrease the Lambda function's timeout to allow more time for investigation.
   • CChange the Lambda function's runtime to a different version.
   • DDelete the Lambda function and recreate it from a backup.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company's cloud environment has been compromised. The attacker used a legitimate user's credentials to access a cloud storage bucket and exfiltrate data. The incident response team has identified the compromised account and wants to contain the threat. However, the user is a senior executive and the company does not want to disrupt their work. What is the best approach?

   • AChange the user's password but do not revoke access keys.
   • BLeave the account active and monitor for further suspicious activity.
   • CNotify the executive and ask them to stop using the account.
   • DTemporarily disable the user's account and provide a limited-access account for critical tasks.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   After a ransomware attack encrypted several cloud storage buckets, the incident response team has contained the threat and eradicated the malware. The company wants to restore services with minimal data loss. What should be the next step in the recovery process?

   • AImmediately make the buckets public to allow users to access their files.
   • BRestore the affected buckets from the most recent clean backup.
   • CLeave the encrypted buckets as they are and hope the attacker provides the decryption key.
   • DRecreate the buckets and manually re-enter the data from memory.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst notices unusual API calls from a compromised IAM user account in AWS. The account has permissions to launch EC2 instances and modify security groups. You need to contain the threat while preserving evidence for investigation. What should you do first?

   • AChange the compromised user's password and require MFA on the next login.
   • BTake a snapshot of all EC2 instances before taking any action.
   • CImmediately revoke the compromised user's access keys and attach a deny-all policy.
   • DDelete the compromised user account entirely.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   After a security incident, a company has restored its cloud services and eradicated the threat. The incident response team is conducting a post-incident review. What is the primary goal of this review?

   • AIdentify lessons learned and improve the incident response process.
   • BImmediately implement all possible security improvements without prioritization.
   • CDelete all evidence related to the incident to reduce legal exposure.
   • DAssign blame to the individuals responsible for the incident.
   Reveal Solution Discussion Select an answer first