Handling and Responding to Cloud Security Incidents ECIH Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   After a cloud incident, the incident handler is planning recovery. The organization has a multi-cloud environment. What is the most important factor to consider during recovery?

   • ARestore services in the correct order based on dependencies.
   • BRestore the most critical service first regardless of dependencies.
   • CRestore all services simultaneously to save time.
   • DUse the same cloud provider for all restored services.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company detects a compromised IaaS instance that is part of a production application. The instance is communicating with a known command-and-control server. The incident handler needs to contain the threat while minimizing downtime. Which action best achieves this?

   • ADelete the instance's public IP address and leave it on the private network.
   • BDetach the instance from the network by modifying the security group to block all traffic.
   • CTake a snapshot of the instance and then restore it from backup.
   • DImmediately terminate the instance and launch a new one from a clean image.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Why is it important to preserve cloud logs (e.g., API logs, flow logs) as part of forensic evidence?

   • AThey are required to be stored for at least 10 years by law.
   • BThey automatically contain the attacker's identity and location.
   • CThey provide a record of actions taken in the cloud environment that can help reconstruct the incident timeline.
   • DThey are the only evidence that can be used in court.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   After a cloud security incident has been contained and eradicated, what is the first step in the recovery phase?

   • AImmediately reconnecting all isolated systems without verification
   • BRestoring services from known-good backups
   • CChanging the cloud provider to prevent future incidents
   • DDeleting all logs to free up storage
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is the most appropriate method to acquire forensic evidence from a cloud-based virtual machine?

   • ADeleting the VM and restoring from a backup
   • BPowering off the VM and removing its physical hard drive
   • CTaking a snapshot of the virtual machine's disk
   • DCopying the VM's memory by accessing the host server directly
   Reveal Solution Discussion Select an answer first