Handling and Responding to Cloud Security Incidents ECIH Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is a common method for detecting security incidents in a cloud environment?

   • ARelying solely on the cloud provider's security notifications without any customer-side monitoring
   • BPhysically inspecting the server hardware in the provider's data center
   • CDisabling all network traffic to prevent attacks
   • DAnalyzing cloud provider audit logs for suspicious API calls
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of revoking compromised credentials during a cloud security incident?

   • ATo enable the attacker to be traced more easily
   • BTo comply with data retention policies
   • CTo prevent the attacker from continuing to access cloud resources
   • DTo improve the performance of the cloud environment
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   After a cloud incident, the incident handler is conducting a post-incident review. The organization wants to improve its cloud security posture. Which action is most effective?

   • AUpdate the incident response playbook based on lessons learned.
   • BReplace the cloud provider to avoid similar incidents.
   • CConduct a security awareness training for all employees.
   • DIncrease the budget for more security tools.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company experiences a data breach in its PaaS application. The incident handler needs to contain the incident and then recover. The application uses a managed database and a web service. Which sequence of actions is most effective?

   • ADelete the web service and recreate it from scratch, then restore the database.
   • BRestore the database from backup first, then isolate the web service.
   • CIsolate the web service, revoke compromised credentials, then restore from a clean backup.
   • DChange all passwords and then take a snapshot of the database.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security team is designing a detection strategy for a cloud environment that uses IaaS and SaaS. They need to detect incidents that involve compromised credentials and data exfiltration. Which combination of monitoring sources is most effective?

   • AOnly cloud provider audit logs and VM memory dumps.
   • BOnly SaaS login logs and application logs.
   • COnly network flow logs and DNS logs.
   • DCloud provider audit logs, SaaS login logs, and network flow logs.
   Reveal Solution Discussion Select an answer first