Incident Response in the Cloud GCAD Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company's infrastructure is defined as code using Terraform. After a ransomware attack, the security team needs to eradicate the malware and recover the environment. The team has verified that the Terraform configuration is clean and the last known good state is stored in a remote backend. Which recovery approach is MOST aligned with cloud-native best practices?

   • ARun antivirus scans on all affected instances and then resume operations.
   • BTear down the affected environment and redeploy using Terraform from the clean state.
   • CManually reconfigure the existing instances to remove the malware.
   • DRestore each affected VM from the most recent backup snapshot.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   After a security incident, the incident response team is preparing the post-incident report. The team wants to identify the root cause and recommend improvements. Which activity is MOST important to include in this phase?

   • ADelete all logs and evidence to free up storage space.
   • BConduct a root cause analysis and document the findings and recommendations.
   • CReimage all affected instances and redeploy the application.
   • DRestore all affected systems from backups.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security team is developing an incident response plan for a new cloud environment. They want to ensure that the 'detection' phase is effective. Which action is MOST important to implement during the 'preparation' phase?

   • ADefine the roles and responsibilities of the incident response team.
   • BConduct a tabletop exercise to test the incident response plan.
   • CEstablish a chain of custody process for forensic evidence.
   • DEnable comprehensive logging and monitoring across all cloud services and define alerting thresholds.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   In the cloud incident response lifecycle, which phase involves actions such as enabling CloudTrail, configuring backup policies, and defining escalation procedures before an incident occurs?

   • ARecovery
   • BDetection
   • CContainment
   • DPreparation
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security analyst detects an active crypto-mining campaign running on a set of production EC2 instances in AWS. The instances are part of an auto-scaling group and are behind an Application Load Balancer. The analyst needs to contain the incident while preserving evidence for a potential legal case. Which action should the analyst take FIRST?

   • ACreate an AMI of the instances while they are still running, then terminate them.
   • BTerminate the instances immediately and rely on the auto-scaling group to launch fresh replacements.
   • CDetach the instances from the auto-scaling group, stop them, and take EBS snapshots of the root volumes.
   • DModify the security group to block all outbound traffic, but leave the instances running for observation.
   Reveal Solution Discussion Select an answer first