Handling and Responding to Cloud Security Incidents ECIH Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company uses a multi-cloud environment with IaaS and PaaS services. The security team wants to centralize detection and monitoring of security incidents across all cloud providers. Which approach is most effective?

   • AUse a single cloud provider for all workloads to simplify monitoring.
   • BDeploy a network tap in each provider's data center to capture traffic.
   • CRely on each provider's native monitoring console and review them separately.
   • DUse a third-party cloud security posture management (CSPM) tool that integrates with each provider's APIs.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company detects a crypto-mining malware on a set of VMs in a PaaS environment. The incident handler must contain the threat while preserving the ability to investigate. Which action is most effective?

   • AStop the VMs and take them offline for the duration of the investigation.
   • BIsolate the affected VMs by applying a network security group that blocks all outbound traffic.
   • CChange the passwords of all user accounts in the subscription.
   • DDelete the affected VMs immediately to eradicate the malware.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company is migrating its incident response process to the cloud. The team is used to having physical access to servers. What is the most significant challenge they will face?

   • AInability to use open-source tools.
   • BDifficulty in identifying the cloud provider's security team.
   • CIncreased latency in network communications.
   • DLack of physical access to servers for forensic acquisition.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company detects a ransomware attack in a cloud environment. The attacker has encrypted data in a storage bucket and is demanding payment. The incident handler must contain the incident and recover data. Which action is most effective?

   • ARevoke the attacker's access, restore the bucket from a clean backup, and enable versioning.
   • BDisable the storage account and wait for the attacker to release the data.
   • CDelete the encrypted bucket and recreate it.
   • DPay the ransom to get the decryption key.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security analyst is setting up monitoring for a hybrid cloud environment. The organization uses IaaS for critical workloads and SaaS for email. The analyst needs a unified view of security events across both environments. Which approach is most effective?

   • ADeploy an agent on every virtual machine and collect logs locally.
   • BUse a cloud-native SIEM that ingests logs from both IaaS and SaaS via APIs.
   • CEnable logging in the IaaS environment and review logs manually.
   • DRely on the SaaS provider's built-in security alerts only.
   Reveal Solution Discussion Select an answer first