Handling and Responding to Cloud Security Incidents ECIH Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company uses a SaaS CRM and an IaaS environment. A security incident involves unauthorized access to the CRM data. The incident handler needs to preserve evidence and contain the incident. The company has legal requirements to preserve data for potential litigation. Which action is most appropriate?

   • AContact the cloud provider to shut down the CRM service.
   • BTake a snapshot of the CRM's underlying database server.
   • CDelete the compromised user's account to prevent further access.
   • DPlace a litigation hold on the CRM data and revoke the compromised user's access.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   An incident handler needs to acquire forensic evidence from a compromised cloud environment. The environment includes IaaS VMs, a PaaS database, and SaaS email. Which evidence collection approach is most comprehensive?

   • ACollect only SaaS email exports.
   • BCollect VM snapshots, database backups, and email exports.
   • CCollect only cloud provider audit logs.
   • DCollect only VM memory dumps and disk snapshots.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An organization wants to detect cloud security incidents early. They have a multi-cloud environment with IaaS and SaaS. Which monitoring strategy is most effective?

   • AEnable native cloud provider logging and integrate with a third-party SIEM.
   • BUse a single cloud provider's monitoring tool for all environments.
   • CRely on the cloud provider's default security alerts.
   • DDeploy a network IDS in each cloud environment.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   After a cloud security incident has been resolved, the incident handler is conducting a post-incident review. Which activity is most important for improving future incident response?

   • ADeleting all logs to free up storage space.
   • BAssigning blame to the employee who caused the incident.
   • CImmediately reverting all security controls to their previous settings.
   • DDocumenting lessons learned and updating the incident response plan.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company detects a data breach in a PaaS application. The attacker used a compromised service account to access a database. The incident handler must contain the incident, but the application must remain available for customers. Which action is most effective?

   • ADisable the application's public endpoint to prevent further access.
   • BDelete the database and restore from a backup.
   • CRotate the service account credentials and restrict the database's network access to only the application's IP range.
   • DChange the database password and do nothing else.
   Reveal Solution Discussion Select an answer first