Handling and Responding to Cloud Security Incidents ECIH Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security incident is detected in a cloud environment. The incident handler needs to preserve evidence for potential legal proceedings. Which action is most appropriate?

   • ACollect logs and snapshots and store them in a separate, access-controlled storage bucket.
   • BDelete the compromised resources to prevent further damage.
   • CCopy logs to the incident handler's personal laptop for safekeeping.
   • DWait until the incident is fully resolved before collecting evidence.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   What is the purpose of enabling cloud provider logging services such as AWS CloudTrail or Azure Activity Log?

   • ATo automatically block all malicious traffic
   • BTo replace the need for any other security monitoring tools
   • CTo physically secure the cloud data center
   • DTo provide a record of API calls and management actions for security monitoring and incident investigation
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is a primary difference between cloud incident response and traditional on-premises incident response?

   • ACloud incident response does not require any logging or monitoring because the provider handles all security.
   • BCloud incident response relies on provider APIs and management consoles for visibility and control, rather than physical access.
   • CIn the cloud, the incident responder typically has direct physical access to the servers involved.
   • DCloud incident response is identical to traditional incident response with no unique challenges.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which of the following is a unique challenge in cloud incident response compared to traditional on-premises incident response?

   • AThe dynamic and elastic nature of cloud resources, which can change or scale during an incident
   • BThe ability to take a physical server offline for forensic imaging
   • CThe requirement to always contact law enforcement before any response action
   • DThe lack of any logging or monitoring capabilities in the cloud
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   In the shared responsibility model for IaaS, which of the following is typically the responsibility of the cloud customer?

   • APatching the guest operating system of a virtual machine
   • BPhysical security of the data center
   • CMaintaining the underlying hypervisor
   • DSecuring the physical network infrastructure
   Reveal Solution Discussion Select an answer first