CCSE CCSE Incident Response & Forensics in Cloud

Question 1

Which phase of the incident response lifecycle involves identifying indicators of compromise (IoCs) in a cloud environment?

Accepted Answer

Detection and Analysis

Answer

Detection and Analysis is the phase where security teams identify IoCs and determine the scope of a cloud security incident.

Question 2

When performing cloud forensics, which service in AWS provides immutable API call logs critical for investigation?

Accepted Answer

AWS CloudTrail

Answer

AWS CloudTrail records all API calls across an AWS account, providing an immutable audit trail essential for forensic investigations.

Question 3

What is the primary challenge of digital forensics in cloud environments compared to traditional on-premises forensics?

Accepted Answer

Multi-tenancy and shared infrastructure

Answer

Multi-tenancy means forensic investigators cannot access underlying physical hardware or isolate one tenant's data from another's.

Question 4

During cloud incident containment, which action best limits lateral movement by a compromised cloud workload?

Accepted Answer

Applying restrictive security group rules to isolate the resource

Answer

Applying restrictive security group rules isolates the compromised resource while preserving forensic evidence and minimizing service disruption.

Question 5

Which concept ensures that cloud forensic evidence maintains its integrity from collection through court presentation?

Accepted Answer

Chain of custody

Answer

Chain of custody documents every person who handled the evidence and every action taken, ensuring its integrity and admissibility.

(CCSE) Certified Cloud Security Engineer Practice Test