CCSE Incident Response & Forensics in Cloud Flashcards

Which phase of the incident response lifecycle involves identifying indicators of compromise (IoCs) in a cloud environment?

Answer: Detection and Analysis

Detection and Analysis is the phase where security teams identify IoCs and determine the scope of a cloud security incident.

When performing cloud forensics, which service in AWS provides immutable API call logs critical for investigation?

Answer: AWS CloudTrail

AWS CloudTrail records all API calls across an AWS account, providing an immutable audit trail essential for forensic investigations.

What is the primary challenge of digital forensics in cloud environments compared to traditional on-premises forensics?

Answer: Multi-tenancy and shared infrastructure

Multi-tenancy means forensic investigators cannot access underlying physical hardware or isolate one tenant's data from another's.

During cloud incident containment, which action best limits lateral movement by a compromised cloud workload?

Answer: Applying restrictive security group rules to isolate the resource

Applying restrictive security group rules isolates the compromised resource while preserving forensic evidence and minimizing service disruption.

Which concept ensures that cloud forensic evidence maintains its integrity from collection through court presentation?

Answer: Chain of custody

Chain of custody documents every person who handled the evidence and every action taken, ensuring its integrity and admissibility.

In a cloud incident response plan, what does the term 'runbook' refer to?

Answer: A predefined set of automated or manual steps for responding to specific incidents

A runbook is a documented set of procedures that guides responders through the steps needed to handle a specific type of incident.