CCSK Incident Response and Business Continuity in Cloud 1 — Questions and Answers
Question 1: What is the primary challenge of cloud incident response compared to on-premises incident response?
- Cloud incidents are always less severe than on-premises incidents
- Limited physical access and reliance on provider-supplied logs reduce investigative control (Correct answer)
- Cloud providers handle all incident response on behalf of customers
- Cloud environments produce too much data for incident investigation
Correct answer: Limited physical access and reliance on provider-supplied logs reduce investigative control
In cloud environments, customers cannot access physical media and depend on provider-provided logs and APIs for forensic investigation, limiting their control.
Question 2: According to CCSK, what should be included in a cloud-specific incident response plan?
- Only a contact list for the cloud provider's support team
- Defined roles, escalation procedures, provider notification requirements, evidence preservation methods, and cloud-specific playbooks (Correct answer)
- A list of all cloud services subscribed to by the organization
- Only the technical runbooks for shutting down cloud services
Correct answer: Defined roles, escalation procedures, provider notification requirements, evidence preservation methods, and cloud-specific playbooks
A cloud IR plan must address cloud-specific factors like evidence collection from provider APIs, provider notification protocols, and isolation procedures for cloud workloads.
Question 3: What is 'evidence preservation' in cloud incident response and why is it challenging?
- Preserving cloud invoices for cost audits
- Capturing forensic artifacts (logs, snapshots, memory) before they are overwritten or auto-deleted in dynamic cloud environments (Correct answer)
- Backing up data to prevent business disruption during an incident
- Preserving encryption keys during a security incident
Correct answer: Capturing forensic artifacts (logs, snapshots, memory) before they are overwritten or auto-deleted in dynamic cloud environments
Cloud environments auto-delete logs, terminate instances, and scale dynamically, requiring rapid evidence capture before artifacts disappear.
Question 4: What does CCSK recommend for 'containment' of a compromised cloud workload?
- Immediately delete the compromised instance to stop the attack
- Isolate the workload by modifying security groups and network ACLs while preserving forensic state (Correct answer)
- Notify all users of the incident before taking containment action
- Transfer the workload to a different cloud region
Correct answer: Isolate the workload by modifying security groups and network ACLs while preserving forensic state
Containment in cloud involves isolating the workload through network controls while preserving its state for forensic investigation before remediation.
Question 5: According to CCSK, what is the role of a 'runbook' in cloud incident response?
- A financial document tracking incident response costs
- A documented, step-by-step procedure for responding to specific types of security incidents in cloud environments (Correct answer)
- A performance benchmarking tool for cloud workloads
- A compliance checklist for cloud provider audits
Correct answer: A documented, step-by-step procedure for responding to specific types of security incidents in cloud environments
Runbooks provide pre-defined, tested procedures for common incident types, enabling faster and more consistent response without ad hoc decision-making under pressure.
Question 6: What is 'cloud forensics' and what unique challenges does the cloud environment present?
- Financial forensics for cloud billing disputes
- Digital forensic investigation in cloud environments, challenged by multi-tenancy, ephemeral resources, and limited physical access (Correct answer)
- Network traffic analysis for cloud performance issues
- Analyzing cloud provider audit reports for compliance
Correct answer: Digital forensic investigation in cloud environments, challenged by multi-tenancy, ephemeral resources, and limited physical access
Cloud forensics faces unique challenges including inability to access physical media, evidence volatility in ephemeral environments, and jurisdictional issues with multi-tenant data.
CCSK Incident Response and Business Continuity in Cloud 1
What is the primary challenge of cloud incident response compared to on-premises incident response?