Handling and Responding to Cloud Security Incidents ECIH Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company runs a critical application on a VM in an IaaS environment. The VM is compromised, and the attacker may have accessed sensitive data. The incident handler must contain the incident while preserving evidence for potential legal action. The company has a limited budget and cannot afford to lose the VM's data. Which action is most appropriate?

   • APower off the VM immediately to prevent further damage.
   • BDelete the VM and restore from the last backup.
   • CSnapshot the VM's disk, then isolate the VM by removing its public IP and applying a restrictive network security group.
   • DRely on the cloud provider's support team to contain the incident.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company's incident response team is new to cloud environments. They are responding to a security incident in a PaaS application. Which challenge is most likely to complicate their response compared to an on-premises incident?

   • AThe need to physically seize the server hardware.
   • BInability to collect any logs from the application.
   • CThe requirement to notify law enforcement before any investigation.
   • DLimited visibility into the underlying infrastructure and provider-managed components.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which action is an effective containment strategy for a compromised cloud virtual machine?

   • AIsolating the VM by applying network security rules that block all inbound and outbound traffic
   • BIgnoring the incident and waiting for the cloud provider to resolve it
   • CDeleting the VM immediately without preserving any data
   • DIncreasing the VM's permissions to allow better access for investigation
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company experiences a security incident in a serverless application. The incident handler needs to preserve evidence. Which evidence source is most likely to be available?

   • AA memory dump of the serverless function's runtime.
   • BExecution logs and traces from the serverless platform.
   • CA network packet capture from the function's virtual network.
   • DA forensic image of the function's container.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which cloud service model places the least security responsibility on the customer for the underlying infrastructure?

   • AIaaS
   • BSaaS
   • CPaaS
   • DOn-premises
   Reveal Solution Discussion Select an answer first