CloudSec-Pro Data Protection And Incident Response IN Cloud — 10 Questions

Question 1

You notice that an unauthorized user is accessing data in a Google Cloud Storage bucket. To contain the incident, which action is most effective within the Prisma Cloud platform?

Accepted Answer

Apply a Deny policy to the user's IAM role. Applying a Deny policy to the unauthorized user's IAM role within Prisma Cloud is the most effective containment action because it immediately blocks the offending identity's access to the bucket without disrupting other users or destroying data. Prisma Cloud's access governance and policy engine can enforce deny rules that revoke permissions in near real time.

Answer

Delete the storage bucket

Answer

Change the bucket encryption keys

Answer

Update the firewall rules of the VPC

Question 2

You are tasked with ensuring that all EBS snapshots in AWS are encrypted. How do you verify this using Prisma Cloud's policy system?

Accepted Answer

Create a custom policy using RQL to check for unencrypted EBS snapshots. Prisma Cloud provides pre-built compliance policies that scan for 'EBS snapshot encryption' status across the environment.

Answer

Disable the snapshot feature

Answer

Enable VPC flow logs

Answer

Use the AWS CLI to manually check each snapshot

Question 3

During an investigation, you observe that a container has been compromised. Which step is required to preserve the state of the container for future analysis without losing volatile memory data?

Accepted Answer

Take a snapshot of the container via Prisma Cloud Compute. A forensic snapshot or 'container dump' captures the state including memory, which is vital for post-incident investigation.

Answer

Delete the pod immediately

Answer

Rotate the cluster credentials

Answer

SSH into the container and clear logs

Question 4

You are troubleshooting why a specific compliance policy in Prisma Cloud is not triggering alerts for non-compliant S3 buckets. What should you check first?

Accepted Answer

The scan frequency settings of the policy. Policies must be enabled and mapped to the correct resource scope for them to trigger alerts effectively.

Answer

The number of users in the account

Answer

The cloud provider's billing status

Answer

The network latency to the cloud provider

Question 5

A security incident report indicates a potential supply chain attack involving a container image. Which Prisma Cloud Compute feature helps investigate the image history?

Accepted Answer

Image Registry Scanning. Prisma Cloud Compute keeps an 'Image History' record, showing all layers and build details, which is crucial for supply chain attack analysis.

Answer

Host Security

Answer

Runtime Security

Answer

Compliance Reporting

Question 6

A CloudSec-Pro analyst is reviewing an incident where an EC2 instance's ephemeral instance store volume was used to stage sensitive data before exfiltration. The instance was terminated by the attacker. The analyst needs to preserve evidence for forensic analysis. Which action should the analyst take FIRST?

Accepted Answer

Review CloudTrail logs to identify the API calls that led to the data staging and termination.. Once an EC2 instance with instance store volumes is terminated, the data on those volumes is permanently lost. The analyst cannot recover it directly. However, CloudTrail logs record all API calls, including those that may have staged data to other services or initiated termination. Reviewing these logs is the logical first step to reconstruct the incident and identify any other affected resources.

Answer

Capture a memory dump of the running instance before it is terminated.

Answer

Create an EBS snapshot of the root volume and the instance store volume.

Answer

Enable termination protection on the instance to prevent further data loss.

Question 7

A CloudSec-Pro administrator needs to ensure that a database's encryption keys are rotated automatically every 90 days without application changes. The database is hosted on AWS and already encrypted with a customer-managed key in AWS KMS. Which configuration should the administrator apply?

Accepted Answer

Enable automatic key rotation on the customer-managed KMS key with a 90-day rotation period.. Automatic rotation of a customer-managed AWS KMS key changes the backing key material on a defined schedule while preserving the key ARN, so existing encrypted data and applications are unaffected. Setting the rotation period to 90 days meets the requirement without re-encryption or application modification. AWS-managed keys do not allow customer-defined rotation periods, and creating new keys requires re-encryption.

Answer

Enable automatic rotation on the AWS-managed key aws/rds used by the database.

Answer

Configure an AWS Lambda function to call the KMS GenerateDataKey API every 90 days and rotate the database password.

Answer

Create a new KMS key every 90 days and re-encrypt the database with the new key.

Question 8

A CloudSec-Pro professional is reviewing the incident response plan for a cloud environment. The plan must include steps for isolating a compromised virtual machine (VM) to prevent lateral movement. Which of the following actions is the MOST effective and immediate way to isolate an Azure VM from other resources while preserving its state for forensic analysis?

Accepted Answer

Apply a network security group (NSG) to the VM's network interface that denies all inbound and outbound traffic except for management access from a secure jump host.. Applying a restrictive NSG to the VM's network interface is the most effective immediate isolation method in Azure. It blocks all traffic except management access, preserves the VM's running state for forensics, and is reversible. Other options either shut down the VM, delete resources, or require a restart, which can destroy evidence.

Answer

Stop (deallocate) the VM to sever all network connections and prevent further communication.

Answer

Delete the VM's network interface to disconnect it from the virtual network.

Answer

Move the VM to a different subnet with no route to the internet or other subnets.

Question 9

A CloudSec-Pro consultant is designing an incident response plan for a multi-cloud environment. The requirement is to ensure that if a cloud storage bucket is made public, the security team is alerted within 1 minute and can automatically remediate by removing public access. Which combination of cloud-native services should the consultant recommend for AWS?

Accepted Answer

Amazon EventBridge for detection and AWS Lambda for remediation.. To detect S3 bucket public access in near real-time and automatically remediate, use Amazon EventBridge to capture CloudTrail management events related to S3 bucket policy changes. EventBridge can trigger an AWS Lambda function that removes public access. This provides sub-minute detection and automated response. Other services like CloudTrail alone, GuardDuty, or AWS Config do not offer the same real-time detection and remediation combination required.

Answer

AWS CloudTrail for detection and AWS Lambda for remediation.

Answer

AWS Config for detection and AWS Lambda for remediation.

Answer

Amazon GuardDuty for detection and AWS Config for remediation.

Question 10

A CloudSec-Pro administrator must ensure that data stored in a Google Cloud Storage bucket is protected against accidental deletion and can be recovered for up to 30 days after deletion. Which feature should be configured?

Accepted Answer

Bucket Lock with a retention policy of 30 days.. Google Cloud Storage Bucket Lock enforces a retention policy that prevents deletion or modification of objects for a defined period. A 30-day retention policy ensures that even if an object is deleted, it cannot be permanently removed until the retention expires, allowing recovery. Versioning alone, IAM conditions, and KMS rotation do not provide an enforced retention window.

Answer

Object Versioning with a lifecycle rule to delete noncurrent versions after 30 days.

Answer

Customer-managed encryption keys in Cloud KMS with a 30-day rotation period.

Answer

Uniform bucket-level access with IAM conditions restricting delete permissions.