Handling and Responding to Cloud Security Incidents ECIH Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the main purpose of conducting a lessons-learned meeting after a cloud security incident?

   • ATo identify what went well and what can be improved in the incident response process
   • BTo delete all evidence related to the incident
   • CTo immediately resume normal operations without any changes
   • DTo assign blame to individuals responsible for the incident
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company uses a SaaS CRM application. The security team discovers that a third-party integration has excessive permissions and may have accessed customer data. The incident handler must contain the incident. Which action is most appropriate?

   • AChange the CRM administrator password.
   • BRevoke the integration's access and review the CRM's audit logs for data access.
   • CDisable the entire CRM application for all users.
   • DDelete the third-party integration and all its data.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   After a cloud security incident, the incident handler is conducting a post-incident review. What is the primary goal of this review?

   • AIdentify the attacker's identity and pursue legal action.
   • BAssign blame to the responsible team.
   • CRestore all services to their pre-incident state.
   • DImprove the incident response process and update security controls.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   After a cloud incident, the incident handler is conducting a post-incident review. The team found that the incident was detected late because monitoring alerts were not configured for a critical service. The company wants to improve detection for future incidents. Which action is most appropriate?

   • ADisable monitoring for non-critical services to reduce noise.
   • BRely on the cloud provider's default monitoring alerts.
   • CIncrease the frequency of manual log reviews.
   • DImplement automated alerting for critical services and integrate logs into a centralized SIEM.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   After a ransomware incident in an IaaS environment, the incident handler has contained the threat and eradicated the malware. The company needs to recover its services. Which step should be taken first?

   • AReimage the VMs from the cloud provider's default image.
   • BRecreate the VMs manually and reconfigure all applications.
   • CEnable multi-factor authentication on all user accounts.
   • DRestore the affected VMs from clean backups taken before the incident.
   Reveal Solution Discussion Select an answer first