CCSE CCSE Incident Response & Forensics in Cloud 2

Question 1

Which of the following is a key consideration when collecting volatile evidence from a running cloud virtual machine?

Accepted Answer

Capture memory contents before any other action

Answer

Memory is volatile and lost on shutdown, so capturing RAM contents first preserves running processes, network connections, and encryption keys.

Question 2

A cloud incident responder needs to preserve the state of a compromised EC2 instance. What is the best first step?

Accepted Answer

Create an AMI snapshot of the instance

Answer

Creating an AMI snapshot preserves the disk state of the compromised instance for forensic analysis without altering evidence.

Question 3

Which NIST framework phase occurs immediately after containment during incident response?

Accepted Answer

Eradication

Answer

According to NIST SP 800-61, eradication follows containment and involves removing the root cause of the incident from the environment.

Question 4

What is the purpose of a post-incident review (PIR) in cloud security?

Accepted Answer

To identify lessons learned and improve future response capabilities

Answer

A PIR analyzes what happened, why it happened, and how to improve detection, response, and prevention for future incidents.

Question 5

In Azure, which service provides centralized security event collection and correlation for incident investigation?

Accepted Answer

Azure Sentinel (Microsoft Sentinel)

Answer

Microsoft Sentinel is Azure's cloud-native SIEM that collects, correlates, and analyzes security events across the environment.

(CCSE) Certified Cloud Security Engineer Practice Test