Handling and Responding to Cloud Security Incidents ECIH Practice Questions (Page 10)

Questions 46–48

1. 46application · medium

   During an incident in an IaaS environment, a compromised Linux VM is identified. The incident handler must preserve forensic evidence while minimizing disruption to the running system. Which approach is best?

   • APower off the VM immediately and then copy the virtual disk file.
   • BLog into the VM and run the 'dd' command to copy the disk.
   • CRely on the cloud provider's support team to collect all evidence.
   • DCreate a snapshot of the VM's disk and collect memory using a cloud-based memory acquisition tool.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A company detects that an attacker has gained access to a cloud storage bucket containing sensitive data. The incident handler must contain the incident. Which action is most effective?

   • ADelete the storage bucket and recreate it later.
   • BContact the cloud provider to shut down the entire account.
   • CMove the data to a different region to prevent access.
   • DRevoke the compromised access keys and change the bucket's access policy to deny public access.
   Reveal Solution Discussion Select an answer first
3. 48expert · hard

   A company is responding to a security incident in a hybrid cloud environment. Some workloads are on-premises, and some are in IaaS. The incident handler must coordinate the response across both environments. Which challenge is most significant?

   • ADifferent levels of visibility and control between on-premises and cloud environments.
   • BThe requirement to notify all customers of the incident.
   • CThe inability to use the same forensic tools in both environments.
   • DThe need to obtain a warrant for cloud data.
   Reveal Solution Discussion Select an answer first