Incident Response in the Cloud GCAD Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security team needs to detect and alert on suspicious activity in a multi-cloud environment (AWS and Azure). The team wants to minimize the number of tools and have a unified view. Which approach is MOST effective?

   • AUse AWS CloudTrail and Azure Monitor to collect logs, and rely on the native consoles for alerts.
   • BUse AWS GuardDuty and Azure Sentinel separately, and manually correlate findings.
   • CUse Azure Sentinel as the primary SIEM and ingest AWS logs into it.
   • DUse a third-party SIEM that ingests logs from both AWS and Azure and provides centralized alerting.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst is setting up alerting for a new cloud environment. They want to be notified when an IAM user fails to authenticate multiple times. Which AWS service should be used to generate the alert?

   • AVPC Flow Logs to monitor network traffic to the IAM service.
   • BAWS Trusted Advisor to check for unused IAM credentials.
   • CAWS Config rules to check for IAM users with weak passwords.
   • DCloudWatch Alarms on the 'FailedAuthentication' metric from CloudTrail.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company's cloud environment is under attack. The attacker has compromised an EC2 instance and is using it to launch a port scan against other instances in the same VPC. The security team needs to contain the incident, but they also need to preserve evidence for a criminal investigation. The instance is running a critical production workload that cannot be stopped. Which approach BEST balances containment, evidence preservation, and business continuity?

   • ATerminate the instance immediately and take a snapshot of its EBS volume.
   • BCreate an AMI of the instance, then use AWS Network Firewall to block the port scan traffic.
   • CRemove the instance's security group rules to block all inbound and outbound traffic, and take a memory dump of the instance.
   • DDetach the instance from the VPC and attach it to a separate isolated VPC for analysis.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A customer using Azure experiences a data breach involving a virtual machine. The customer suspects the VM's OS was compromised. The customer requests that Microsoft provide forensic evidence from the host. According to the shared responsibility model, which statement is accurate?

   • AMicrosoft will provide full disk images of the VM's virtual hard disks upon request.
   • BMicrosoft is responsible for all forensic evidence because the VM runs on Microsoft infrastructure.
   • CThe customer must rely solely on their own logs because Microsoft does not provide any forensic data.
   • DMicrosoft will provide host-level logs and metadata, but the customer is responsible for collecting evidence from the guest OS.
   Reveal Solution Discussion Select an answer first
6. 30application · hard

   During the containment phase of an incident, a security analyst identifies that a compromised application is running in a Kubernetes cluster. The analyst needs to contain the incident without losing the ability to collect forensic evidence. Which action is MOST appropriate?

   • ADelete the pod immediately to stop the attack.
   • BScale the deployment to zero replicas and capture the pod logs before deletion.
   • CCordon the node and use ephemeral containers to capture evidence from the running pod.
   • DCreate a network policy to block all traffic to the pod and then wait for the pod to be terminated by the cluster autoscaler.
   Reveal Solution Discussion Select an answer first