CCSK Incident Response and Business Continuity in Cloud

Question 1

What is the primary challenge of cloud incident response compared to on-premises incident response?

Accepted Answer

Limited physical access and reliance on provider-supplied logs reduce investigative control

Answer

Cloud incidents are always less severe than on-premises incidents

Answer

Cloud providers handle all incident response on behalf of customers

Answer

Cloud environments produce too much data for incident investigation

Question 2

According to CCSK, what should be included in a cloud-specific incident response plan?

Accepted Answer

Defined roles, escalation procedures, provider notification requirements, evidence preservation methods, and cloud-specific playbooks

Answer

Only a contact list for the cloud provider's support team

Answer

A list of all cloud services subscribed to by the organization

Answer

Only the technical runbooks for shutting down cloud services

Question 3

What is 'evidence preservation' in cloud incident response and why is it challenging?

Accepted Answer

Capturing forensic artifacts (logs, snapshots, memory) before they are overwritten or auto-deleted in dynamic cloud environments

Answer

Preserving cloud invoices for cost audits

Answer

Backing up data to prevent business disruption during an incident

Answer

Preserving encryption keys during a security incident

Question 4

What does CCSK recommend for 'containment' of a compromised cloud workload?

Accepted Answer

Isolate the workload by modifying security groups and network ACLs while preserving forensic state

Answer

Immediately delete the compromised instance to stop the attack

Answer

Notify all users of the incident before taking containment action

Answer

Transfer the workload to a different cloud region

Question 5

According to CCSK, what is the role of a 'runbook' in cloud incident response?

Accepted Answer

A documented, step-by-step procedure for responding to specific types of security incidents in cloud environments

Answer

A financial document tracking incident response costs

Answer

A performance benchmarking tool for cloud workloads

Answer

A compliance checklist for cloud provider audits

Question 6

What is 'cloud forensics' and what unique challenges does the cloud environment present?

Accepted Answer

Digital forensic investigation in cloud environments, challenged by multi-tenancy, ephemeral resources, and limited physical access

Answer

Financial forensics for cloud billing disputes

Answer

Network traffic analysis for cloud performance issues

Answer

Analyzing cloud provider audit reports for compliance