Handling and Responding to Cloud Security Incidents ECIH Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   During a cloud incident, the incident handler needs to preserve forensic evidence from a compromised database in a PaaS environment. Which evidence source is most likely to be available and useful?

   • AA forensic image of the physical disk where the database resides.
   • BA memory dump of the database server's hypervisor.
   • CDatabase transaction logs and audit logs from the PaaS service.
   • DA network packet capture from the provider's internal backbone.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company's cloud environment is under a DDoS attack. The attack targets a public-facing web application hosted on IaaS. The incident handler needs to contain the attack while maintaining service availability. Which action is most effective?

   • ABlock all incoming traffic to the web application.
   • BEnable the cloud provider's DDoS protection service and adjust auto-scaling policies.
   • CChange the DNS to point to a different IP address.
   • DTerminate the web application instances and wait for the attack to end.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company uses a PaaS service for its web application. During an incident, the application is compromised and is serving malicious content. The incident handler needs to contain the incident. What is the most effective containment action?

   • ADelete the application code from the repository.
   • BChange the DNS to point to a static error page.
   • CDisable the user accounts that have access to the PaaS console.
   • DStop the application instance or scale it to zero.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   An incident handler is responding to a breach in a SaaS application. The attacker exfiltrated data from a shared document repository. The company needs to preserve evidence but also must continue business operations using the same application. Which approach is best?

   • ATake the entire SaaS application offline until the investigation is complete.
   • BRequest the provider to provide a full backup of the entire application database.
   • CDelete the compromised user's documents to prevent further exposure.
   • DExport the relevant document versions and audit logs, then revoke the compromised user's access.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   After a ransomware incident in a cloud environment, the incident handler needs to recover services. The organization has a backup strategy that includes daily snapshots. What is the most important consideration before restoring from backups?

   • ARestore the most recent backup to minimize data loss.
   • BEnsure the backup is from a time before the infection and is not compromised.
   • CNotify the cloud provider before restoring any data.
   • DChange all passwords before restoring.
   Reveal Solution Discussion Select an answer first