Handling and Responding to Cloud Security Incidents ECIH Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company uses a serverless function in a PaaS environment. The function processes user uploads. The security team wants to detect if the function is being abused to execute unauthorized code. Which monitoring approach is most effective?

   • ADeploy a host-based intrusion detection system on the underlying server.
   • BCapture and analyze network traffic at the function's virtual network interface.
   • CPerform a vulnerability scan of the function's container image.
   • DEnable detailed logging and tracing for the function and monitor for anomalous execution patterns.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company uses a SaaS application for HR management. An incident occurs where an employee's account is compromised. The incident handler needs to contain the incident and preserve evidence. Which action is most appropriate?

   • ADelete the user's data to prevent further exposure.
   • BDisable the compromised user account and enable litigation hold on the user's data.
   • CRequest the provider to take a snapshot of the underlying server.
   • DChange the user's password and continue monitoring.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company uses a SaaS email platform. During an incident, the incident handler needs to preserve mailbox data and identify the scope of a phishing campaign that exfiltrated data. The company does not have direct access to the underlying servers. Which action should the incident handler take first?

   • AUse the platform's eDiscovery or litigation hold feature to preserve relevant mailboxes and export message traces.
   • BRequest the cloud provider to snapshot the virtual machines hosting the mail service.
   • CTake a memory dump of the email server using remote management tools.
   • DDeploy a network sniffer in the customer's virtual network to capture email traffic.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company uses a containerized application on a managed Kubernetes service (PaaS). The security team suspects that a container is compromised and is communicating with a command-and-control server. The incident handler must detect and contain the threat. Which action is most effective?

   • ADeploy a host-based IDS on each container.
   • BEnable Kubernetes audit logging and network policy to block egress from the compromised container.
   • CTake a snapshot of the underlying node's disk.
   • DDelete the entire Kubernetes cluster and recreate it.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An incident handler is responding to a compromised IaaS VM. The VM is running a critical application and cannot be stopped immediately. The incident handler needs to preserve evidence while maintaining availability. What is the best approach?

   • ACapture memory using a cloud provider's live memory capture feature.
   • BCreate a disk snapshot and then power off the VM.
   • CClone the VM to another instance and continue running the original.
   • DUse the guest OS to copy log files to a remote server.
   Reveal Solution Discussion Select an answer first