Incident Response in the Cloud CSE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   During the eradication phase of incident response, which action is most appropriate?

   • AIncreasing the logging level on all resources
   • BConducting a post-incident review
   • CRestoring the system from a known good backup
   • DNotifying the public about the incident
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a common cloud-specific security incident that results from a user or application having more permissions than necessary?

   • AExcessive permissions
   • BDistributed denial-of-service (DDoS) attack
   • CRansomware infection on a laptop
   • DPhishing email
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   Your organization uses a SaaS application that stores customer data. A security incident occurs, and you need to coordinate with the SaaS provider for investigation. The provider's support team is slow to respond, and the incident may involve legal obligations. What is the best approach?

   • AAttempt to access the provider's infrastructure to gather evidence yourself.
   • BEscalate the issue through the provider's formal incident response channel and document all communications.
   • CWait for the provider to respond and take no further action.
   • DTerminate the contract with the provider immediately.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which legal or regulatory requirement commonly impacts incident response in the cloud by mandating notification of affected individuals?

   • ACopyright laws
   • BEnvironmental protection laws
   • CData breach notification laws (e.g., GDPR, HIPAA)
   • DExport control regulations
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   In the context of cloud incident response, which of the following best describes the purpose of the preparation phase?

   • ATo collect and preserve digital evidence from cloud resources while maintaining chain of custody.
   • BTo contain the impact of an incident by isolating affected cloud resources and revoking compromised credentials.
   • CTo identify the root cause of an incident and implement permanent fixes to prevent recurrence.
   • DTo develop and test incident response procedures, define roles, and ensure tools and access are ready before an incident occurs.
   Reveal Solution Discussion Select an answer first