Incident Response in the Cloud GCAD Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company using a SaaS email platform (e.g., Microsoft 365) suspects a breach of a user's mailbox. The incident response team needs to collect forensic evidence. According to the shared responsibility model, which action is MOST appropriate for the customer to take?

   • ATake a snapshot of the virtual machine hosting the mailbox from the hypervisor.
   • BUse the provider's API to download the user's mailbox as a PST file.
   • CRequest a litigation hold and eDiscovery export from the SaaS provider for the affected mailbox.
   • DDeploy a network sniffer in the same VNet to capture the user's traffic.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst is configuring monitoring for a new cloud environment. The goal is to detect a potential brute-force attack on the SSH service of an EC2 instance. Which combination of AWS services would BEST achieve this?

   • AVPC Flow Logs to monitor network traffic to the instance on port 22.
   • BAWS Config to monitor the security group rules and alert if SSH is open to the world.
   • CAWS Trusted Advisor to check for open SSH ports and provide recommendations.
   • DCloudWatch Logs to collect SSH logs, a CloudWatch Logs metric filter to count failed authentication attempts, and a CloudWatch Alarm to trigger an SNS notification.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company's production environment was compromised. The attacker gained access to an EC2 instance and modified the application code. The company uses a CI/CD pipeline to deploy the application. The security team has completed containment and eradication. Which recovery strategy is MOST effective and aligned with cloud best practices?

   • AManually SSH into the instance and revert the code changes.
   • BRestore the EC2 instance from the latest EBS snapshot.
   • CRedeploy the application from the CI/CD pipeline, which uses a known-good version of the code from the source repository.
   • DCreate a new AMI from the compromised instance and launch a new instance from it.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company uses Google Cloud and has detected a compromised Compute Engine instance. The instance is part of a managed instance group. The security team needs to contain the instance while preserving evidence and avoiding disruption to the managed instance group's autoscaling. Which action is MOST appropriate?

   • AApply a firewall rule that denies all traffic to the instance's tags.
   • BSet the instance's 'delete protection' and then apply a firewall rule to deny all traffic.
   • CStop the instance and create a snapshot of its disks.
   • DRemove the instance from the managed instance group and create a snapshot of its disks.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A forensic investigator needs to collect evidence from a compromised AWS workload. The workload runs on EC2 instances in an auto-scaling group and uses an RDS database. The investigator must preserve the evidence in a way that is admissible in court. Which evidence collection method is MOST appropriate?

   • AEnable AWS CloudTrail and AWS Config and wait for the logs to be generated.
   • BCreate a new EC2 instance from an AMI of the compromised instance and run forensic tools on it.
   • CUse the AWS CLI to download the entire contents of the EBS volumes and RDS database to a local forensic workstation.
   • DTake EBS snapshots of the EC2 instances and an RDS snapshot of the database, and document the chain of custody.
   Reveal Solution Discussion Select an answer first