5.1 Containing and Investigating Security Incidents PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary goal of isolating affected services and processes during incident response?

   • ATo prevent further damage and contain the spread of the attack
   • BTo permanently delete all affected resources
   • CTo improve system performance by removing unnecessary processes
   • DTo allow the attacker to continue but monitor their actions
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   An incident responder needs to find all log entries related to a specific user's activity across multiple Google Cloud projects over the past 7 days. Which tool is most appropriate for this scope analysis?

   • ACloud Monitoring
   • BCloud Asset Inventory
   • CLogs Explorer
   • DCloud IAM
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which Google Cloud security tool is specifically designed to provide a centralized view of security alerts and findings across an organization?

   • ACloud Monitoring
   • BCloud Logging
   • CSecurity Command Center
   • DCloud Asset Inventory
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   After a security incident, the security team identifies that the root cause was a misconfigured firewall rule that allowed excessive access. The network engineering team is responsible for firewall rules. The security team wants to ensure the misconfiguration is fixed and that similar misconfigurations are prevented in the future. What is the most effective way to achieve this?

   • ACreate a new firewall rule that overrides the misconfigured one.
   • BReport the misconfiguration to management and let them decide.
   • CWork with the network engineering team to fix the rule and implement a process for reviewing firewall rule changes.
   • DAsk the network engineering team to delete all firewall rules and recreate them from scratch.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   An incident responder identifies a compromised compute instance that is communicating with a known command-and-control server. Which action is most directly an isolation step to contain the incident?

   • ADetach the instance's boot disk and attach it to a clean instance for analysis
   • BUpgrade the instance to a larger machine type
   • CApply a firewall rule that blocks all egress traffic from the instance
   • DTake a snapshot of the instance's disk for evidence
   Reveal Solution Discussion Select an answer first