Incident Response in the Cloud CSE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which activity is typically part of the post-incident review (lessons learned) process?

   • ADocumenting what happened, what was done, and what could be improved
   • BImmediately restoring all services without checking for vulnerabilities
   • CDeleting all incident-related logs to free up storage
   • DAssigning blame to the employee who caused the incident
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following is a recommended practice for preserving digital evidence from a compromised cloud virtual machine?

   • AReboot the virtual machine to clear any malicious processes
   • BTake a snapshot of the virtual machine's disk before performing any investigation
   • CInstall additional security tools on the virtual machine to analyze the threat
   • DImmediately delete the virtual machine to prevent further damage
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A ransomware attack encrypts data in your cloud environment. You have identified the compromised VM and need to contain the threat. However, the VM contains critical evidence that may be needed for legal action. What is the best containment strategy that preserves evidence?

   • AIsolate the VM by removing its network interface and take a snapshot of its disk.
   • BPower off the VM immediately and then copy the disk.
   • CDelete the VM and restore from backups.
   • DApply a network security group rule to block all inbound traffic to the VM.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   Your organization uses Google Cloud Platform (GCP) and wants to detect potential security incidents early. You need to set up a monitoring solution that can identify anomalous behavior across your cloud resources. What should you implement?

   • AUse only the default GCP dashboard without any custom alerts.
   • BSet up a VPN to encrypt all traffic between your on-premises network and GCP.
   • CDeploy a firewall that blocks all inbound traffic to your VPC.
   • DEnable Cloud Audit Logs and configure alerts for suspicious activities like failed logins or unusual API calls.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A company detects that a compromised service account is being used to access a cloud database and exfiltrate data. The incident response team wants to contain the threat while preserving evidence for investigation. What is the best containment action?

   • ADelete the service account immediately.
   • BDisconnect the database from the network.
   • CIgnore the alert and monitor the activity for a few more days.
   • DRevoke the service account's permissions and rotate its credentials.
   Reveal Solution Discussion Select an answer first