Incident Response in the Cloud CSE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   Your company uses a multi-cloud environment with workloads in AWS and Azure. A data breach occurs, and you need to coordinate with the cloud providers during the incident response. What is the primary reason for involving the cloud providers early?

   • ATo obtain provider-side logs and metadata that are not accessible to you.
   • BTo have the providers take over the entire incident response process.
   • CTo negotiate a refund for the downtime caused by the incident.
   • DTo request that the providers delete all your data to prevent further exposure.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A company uses AWS and has enabled GuardDuty, CloudTrail, and VPC Flow Logs. The security team receives an alert about an EC2 instance communicating with a known malicious IP. The instance is part of an auto-scaling group and is critical for production. The team needs to contain the threat while minimizing downtime and preserving evidence. What is the most appropriate action?

   • ATerminate the instance immediately and let the auto-scaling group launch a replacement.
   • BDetach the instance from the auto-scaling group and apply a security group that blocks all traffic to the malicious IP.
   • CModify the route table to block all traffic to the internet.
   • DDisable the VPC Flow Logs to prevent further data collection.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   When responding to a cloud incident that involves personal data of EU citizens, which legal consideration is most relevant?

   • AThe General Data Protection Regulation (GDPR) requirements for breach notification and data protection
   • BThe Sarbanes-Oxley Act (SOX) requirements for financial reporting
   • CThe Health Insurance Portability and Accountability Act (HIPAA) requirements for health data
   • DThe Payment Card Industry Data Security Standard (PCI DSS) requirements for cardholder data
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   After a major cloud security incident, a company has restored its services and is conducting a post-incident review. The review reveals that the incident was caused by a misconfigured security group that was not detected by existing monitoring. The team wants to prevent similar incidents in the future. What is the most effective improvement to implement?

   • AImplement automated configuration compliance checks and alerting for security group changes.
   • BDisable security group changes to prevent future misconfigurations.
   • CIncrease the frequency of manual security group reviews.
   • DRely on the cloud provider to monitor security groups.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A cloud incident involves a compromised database in a multi-tenant environment. You need to collect evidence for legal proceedings, but the cloud provider may need to preserve their own logs. What is the best way to ensure evidence is preserved?

   • ARely solely on the provider's logs without taking your own snapshots.
   • BDelete the database to prevent further access and rely on backups.
   • CTake a snapshot of the database but do not inform the provider.
   • DRequest that the provider preserve their logs and take your own snapshots of the database.
   Reveal Solution Discussion Select an answer first