Foundational Cloud Concepts GEIR Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is a typical cloud logging source that records actions taken by users and services through the management plane?

   • AApplication logs from a web server
   • BAudit logs of API calls
   • CDNS query logs
   • DSyslog from a virtual machine's operating system
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Why is IAM important for incident response in the cloud?

   • AIt provides a backup of all virtual machines
   • BIt provides a way to attribute actions to specific identities
   • CIt encrypts all data in the cloud
   • DIt automatically blocks all malicious traffic
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   In which cloud service model does the customer have the least direct visibility into the underlying operating system and application runtime during an incident response investigation?

   • APlatform as a Service (PaaS)
   • BSoftware as a Service (SaaS)
   • CFunction as a Service (FaaS)
   • DInfrastructure as a Service (IaaS)
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An organization is considering a community cloud for a joint project with several partner organizations. What forensic implication should the incident responder consider?

   • ACommunity clouds are always public, so no forensic controls are needed
   • BEvidence may be co-mingled with data from other member organizations, requiring careful legal and technical separation
   • CThe provider is solely responsible for all forensic evidence, so the customer does not need to collect anything
   • DThe organization has exclusive use of the entire infrastructure, simplifying evidence acquisition
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company uses a SaaS application for customer relationship management. During an incident, the IR team needs to obtain forensic evidence from the application. The company has a legal requirement to preserve evidence in a specific format. Which approach is most appropriate?

   • ARequest the provider to export the relevant data and logs in the required format, using the provider's eDiscovery or export features
   • BAccess the underlying database directly to extract the evidence
   • CPerform a network capture between the customer's browser and the SaaS service
   • DUse a memory forensics tool on the application server
   Reveal Solution Discussion Select an answer first