CCSE CCSE Incident Response & Forensics in Cloud 1 — Questions and Answers
Question 1: Which phase of the incident response lifecycle involves identifying indicators of compromise (IoCs) in a cloud environment?
- Preparation
- Detection and Analysis (Correct answer)
- Containment
- Eradication
Correct answer: Detection and Analysis
Detection and Analysis is the phase where security teams identify IoCs and determine the scope of a cloud security incident.
Question 2: When performing cloud forensics, which service in AWS provides immutable API call logs critical for investigation?
- AWS Config
- Amazon CloudWatch
- AWS CloudTrail (Correct answer)
- AWS GuardDuty
Correct answer: AWS CloudTrail
AWS CloudTrail records all API calls across an AWS account, providing an immutable audit trail essential for forensic investigations.
Question 3: What is the primary challenge of digital forensics in cloud environments compared to traditional on-premises forensics?
- Lack of encryption support
- Limited storage capacity
- Multi-tenancy and shared infrastructure (Correct answer)
- Absence of logging capabilities
Correct answer: Multi-tenancy and shared infrastructure
Multi-tenancy means forensic investigators cannot access underlying physical hardware or isolate one tenant's data from another's.
Question 4: During cloud incident containment, which action best limits lateral movement by a compromised cloud workload?
- Terminating all cloud instances
- Applying restrictive security group rules to isolate the resource (Correct answer)
- Disabling all IAM users
- Shutting down the cloud account
Correct answer: Applying restrictive security group rules to isolate the resource
Applying restrictive security group rules isolates the compromised resource while preserving forensic evidence and minimizing service disruption.
Question 5: Which concept ensures that cloud forensic evidence maintains its integrity from collection through court presentation?
- Data sovereignty
- Chain of custody (Correct answer)
- Data residency
- Evidence tokenization
Correct answer: Chain of custody
Chain of custody documents every person who handled the evidence and every action taken, ensuring its integrity and admissibility.
Question 6: In a cloud incident response plan, what does the term 'runbook' refer to?
- A real-time threat intelligence feed
- A predefined set of automated or manual steps for responding to specific incidents (Correct answer)
- A cloud provider's SLA document
- A penetration testing report
Correct answer: A predefined set of automated or manual steps for responding to specific incidents
A runbook is a documented set of procedures that guides responders through the steps needed to handle a specific type of incident.
CCSE CCSE Incident Response & Forensics in Cloud 1
Which phase of the incident response lifecycle involves identifying indicators of compromise (IoCs) in a cloud environment?