Incident Response in the Cloud CSE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is a key adaptation of the incident response process specifically for cloud environments?

   • ARelying solely on on-premises network traffic captures for investigation.
   • BUsing the cloud provider's native logging and monitoring services as primary sources of evidence.
   • CFocusing only on the application layer and ignoring infrastructure logs.
   • DEliminating the need for a formal incident response plan because the provider handles everything.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary purpose of maintaining a chain of custody when collecting digital evidence from cloud resources?

   • ATo reduce the cost of evidence storage
   • BTo speed up the forensic analysis process
   • CTo document the sequence of custody and control of the evidence to prove its integrity
   • DTo ensure the evidence is stored in a secure location
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A multinational company experiences a data breach that affects personal data of customers in multiple jurisdictions, including the EU and the US. The incident response team is preparing to notify authorities and affected individuals. What is the most important consideration?

   • ANotify only the authorities in the company's home country.
   • BWait for the cloud provider to notify all authorities.
   • CDetermine the applicable legal and regulatory requirements in each jurisdiction.
   • DNotify all authorities at the same time to simplify the process.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A global company experiences a cloud data breach that affects customers in multiple countries. The incident response team must notify affected parties while coordinating with cloud providers. What is the most important consideration?

   • ADelay notification until the full investigation is complete.
   • BNotify all affected parties immediately without considering legal nuances.
   • CNotify the cloud provider first and wait for their instructions.
   • DDetermine the applicable data protection regulations for each affected jurisdiction.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An organization is investigating a security incident in a multi-tenant cloud environment. The incident response team needs to collect evidence from a virtual machine that may be shared with other tenants. What is the most important consideration when collecting evidence?

   • AOnly collect evidence from the cloud provider's logs, not from the VM itself.
   • BCollect evidence as quickly as possible without regard to other tenants.
   • CAvoid involving the cloud provider to maintain confidentiality.
   • DEnsure that the evidence collection method does not violate the provider's acceptable use policy or tenant isolation boundaries.
   Reveal Solution Discussion Select an answer first