CCSE CCSE Incident Response & Forensics in Cloud 2 — Questions and Answers
Question 1: Which of the following is a key consideration when collecting volatile evidence from a running cloud virtual machine?
- Shut down the VM immediately to preserve the disk
- Capture memory contents before any other action (Correct answer)
- Revoke all IAM permissions first
- Delete network flow logs to reduce noise
Correct answer: Capture memory contents before any other action
Memory is volatile and lost on shutdown, so capturing RAM contents first preserves running processes, network connections, and encryption keys.
Question 2: A cloud incident responder needs to preserve the state of a compromised EC2 instance. What is the best first step?
- Terminate the instance
- Create an AMI snapshot of the instance (Correct answer)
- Reboot the instance to clear malware
- Delete associated S3 buckets
Correct answer: Create an AMI snapshot of the instance
Creating an AMI snapshot preserves the disk state of the compromised instance for forensic analysis without altering evidence.
Question 3: Which NIST framework phase occurs immediately after containment during incident response?
- Preparation
- Detection
- Eradication (Correct answer)
- Recovery
Correct answer: Eradication
According to NIST SP 800-61, eradication follows containment and involves removing the root cause of the incident from the environment.
Question 4: What is the purpose of a post-incident review (PIR) in cloud security?
- To assign blame to responsible team members
- To identify lessons learned and improve future response capabilities (Correct answer)
- To delete all logs from the incident
- To notify law enforcement immediately
Correct answer: To identify lessons learned and improve future response capabilities
A PIR analyzes what happened, why it happened, and how to improve detection, response, and prevention for future incidents.
Question 5: In Azure, which service provides centralized security event collection and correlation for incident investigation?
- Azure Advisor
- Azure Sentinel (Microsoft Sentinel) (Correct answer)
- Azure DevTest Labs
- Azure Cost Management
Correct answer: Azure Sentinel (Microsoft Sentinel)
Microsoft Sentinel is Azure's cloud-native SIEM that collects, correlates, and analyzes security events across the environment.
Question 6: When conducting cloud forensics across multiple regions, investigators must account for which legal consideration?
- Cloud provider uptime guarantees
- Data sovereignty and jurisdictional laws governing data in each region (Correct answer)
- CPU performance benchmarks
- License agreements for forensic tools
Correct answer: Data sovereignty and jurisdictional laws governing data in each region
Different geographic regions have different laws about data access, privacy, and cross-border transfer that can affect forensic investigations.
CCSE CCSE Incident Response & Forensics in Cloud 2
Which of the following is a key consideration when collecting volatile evidence from a running cloud virtual machine?