CloudSec-Pro Data Protection And Incident Response IN Cloud Practice Test 4 — 15 Questions

Question 1

A CloudSec-Pro administrator is configuring Prisma Cloud to automatically remediate S3 buckets that are publicly accessible. They want to ensure that any bucket policy that grants public access is automatically modified to remove the public grant. Which Prisma Cloud feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Prisma Cloud CSPM auto-remediation. CSPM auto-remediation is designed to automatically correct misconfigurations in cloud resources. By defining a remediation policy for publicly accessible S3 buckets, Prisma Cloud can modify the bucket policy or ACL to remove public access. This ensures that the bucket is secured as soon as the misconfiguration is detected, without requiring manual intervention. Other features like Compute admission controllers, Data Security, and IAM Security do not perform this type of resource configuration remediation.

Answer

Prisma Cloud Compute admission controllers

Answer

Prisma Cloud Data Security DLP policies

Answer

Prisma Cloud IAM Security permission boundaries

Question 2

A CloudSec-Pro analyst is reviewing a data breach that exposed customer records stored in an Amazon S3 bucket. The bucket had default encryption enabled, but the analyst finds that objects uploaded before the encryption policy was applied are unencrypted. The organization requires that all data at rest be encrypted with no exceptions. Which action should the analyst recommend to meet this requirement?

Accepted Answer

Use S3 Batch Operations to copy the existing objects back into the same bucket, which will apply the default encryption.. To encrypt existing unencrypted objects in an S3 bucket, you must perform a copy operation on those objects. S3 Batch Operations can copy objects in bulk, and during the copy, the destination bucket's default encryption is applied. This ensures all objects become encrypted. Simply enabling default encryption or bucket policies only affects new uploads, so they do not address the legacy data. The correct approach is to use S3 Batch Operations to copy the objects.

Answer

Enable S3 Bucket Keys to reduce encryption costs.

Answer

Modify the bucket policy to deny uploads of unencrypted objects.

Answer

Enable default encryption with AWS KMS and wait for S3 to automatically encrypt existing objects.

Question 3

During a CloudSec-Pro incident response engagement, a security team determines that an attacker used a compromised service account to read objects from a Cloud Storage bucket containing customer PII. The bucket has Object Versioning enabled and uniform bucket-level access enforced. The team wants to remove the attacker's access and preserve the ability to prove which object versions were accessed. Which sequence of actions is most appropriate?

Accepted Answer

Remove the service account's IAM binding on the bucket, capture the relevant Cloud Audit Logs entries, and export the bucket's object version metadata to a separate forensic project.. The priority is to sever the attacker's access path by removing the service account's IAM binding on the bucket, then preserve evidence. Capturing Cloud Audit Logs and exporting object version metadata to a separate forensic project maintains integrity and chain of custody. Key rotation, versioning changes, or retention settings do not revoke the read permission and may destroy or fail to protect evidence.

Answer

Enable Bucket Lock on the bucket and set a retention policy, then review access logs after 24 hours.

Answer

Disable Object Versioning on the bucket, then delete the compromised service account.

Answer

Rotate the service account's keys and leave the IAM binding in place to avoid disrupting legitimate workloads.

Question 4

During a cloud incident response, an analyst needs to preserve volatile evidence from a running EC2 instance before containment. The instance is in a private subnet and cannot reach the internet. Which action best preserves volatile memory evidence while maintaining forensic integrity?

Accepted Answer

Use AWS Systems Manager Run Command to execute a memory acquisition tool on the instance and store the output in an S3 bucket via a VPC endpoint.. Capturing memory from a running instance is necessary to preserve volatile evidence such as process lists, network connections, and in-memory credentials. AWS Systems Manager Run Command can execute a trusted acquisition tool without internet access, and a VPC endpoint for S3 enables secure storage of the captured image. Stopping, rebooting, or imaging the instance loses volatile data and weakens the investigation.

Answer

Stop the instance, detach the EBS volume, and create a snapshot for offline analysis.

Answer

Create an AMI of the instance and launch a copy in an isolated VPC for analysis.

Answer

Reboot the instance and capture the boot logs to analyze for indicators of compromise.

Question 5

A CloudSec-Pro consultant is advising a client on best practices for responding to a data breach in a cloud environment. The client wants to ensure they can effectively contain and eradicate the threat. Which TWO actions should be prioritized during the incident response process? (Choose two.)

Accepted Answer

Immediately revoke all IAM credentials associated with the compromised account.. During a cloud data breach, immediate containment is critical. Revoking compromised IAM credentials stops the attacker from further access, while preserving forensic evidence ensures that the investigation can proceed and root cause can be identified. These two actions balance stopping the attack and gathering necessary information. Deleting logs, shutting down all services, and notifying the ISP are either harmful or ineffective in this context.

Answer

Notify the attacker's ISP to trace the source of the attack.

Answer

Immediately shut down all cloud services to prevent further data loss.

Answer

Delete all logs from the affected cloud services to prevent the attacker from covering their tracks.

Question 6

A CloudSec-Pro practitioner is building an incident response runbook for a cloud environment. The runbook must define the first action when a cloud-native detection indicates that a workload is actively exfiltrating data to an unknown external endpoint. Which action best aligns with the containment phase of cloud incident response?

Accepted Answer

Isolate the workload by applying a restrictive network security policy or quarantine security group that blocks outbound traffic, while preserving the instance for forensics.. Containment in cloud incident response should stop the harmful activity while preserving evidence. Applying a restrictive network policy or quarantine security group blocks outbound exfiltration immediately and keeps the workload available for forensic examination. Deleting the workload, disabling logging, or relying on a third party either destroys evidence, blinds the investigation, or delays containment.

Answer

Disable all logging in the account to prevent the attacker from learning the detection occurred.

Answer

Notify the external endpoint's hosting provider and wait for them to block the traffic.

Answer

Immediately delete the workload and all associated storage to stop the exfiltration.

Question 7

A CloudSec-Pro consultant is designing a data protection strategy for an Azure Storage account that hosts regulated data. The requirement is to ensure that data cannot be read if the storage account keys are compromised, and to maintain the ability to revoke access immediately. Which control should be implemented?

Accepted Answer

Configure customer-managed keys in Azure Key Vault and use Azure RBAC for data plane access.. To protect data when storage account keys are compromised, the encryption keys must be under customer control. Azure Key Vault customer-managed keys allow immediate revocation by disabling or deleting the key, and Azure RBAC for data plane access enforces least privilege. Microsoft-managed keys do not offer this control, and SAS tokens or soft delete do not prevent unauthorized reads.

Answer

Enable soft delete and versioning on the storage account to protect against ransomware.

Answer

Use shared access signatures (SAS) with short expiry for all access to the storage account.

Answer

Enable Azure Storage Service Encryption with Microsoft-managed keys.

Question 8

A CloudSec-Pro administrator is reviewing Prisma Cloud alerts and notices that a large number of sensitive files were downloaded from an Azure Blob Storage container by an unauthorized user. The administrator wants to quickly identify the source IP address and the exact time of the downloads. Which Prisma Cloud feature should they use?

Accepted Answer

Prisma Cloud Audit and Forensic tools. Prisma Cloud Audit and Forensic tools ingest and correlate cloud audit logs, providing detailed access records including source IP, user, and timestamp. This is exactly what the administrator needs to investigate the unauthorized downloads from Azure Blob Storage. Data Security, Compute, and CSPM serve different purposes and do not offer the granular access logging required for this forensic inquiry.

Answer

Prisma Cloud Data Security dashboard

Answer

Prisma Cloud CSPM compliance reports

Answer

Prisma Cloud Compute runtime security

Question 9

A CloudSec-Pro assessor is evaluating a cloud data protection program. The organization stores sensitive data in object storage and managed databases across multiple cloud providers. Which two capabilities are essential for meeting the data protection and incident response requirements of the CloudSec-Pro domain? (Choose two.)

Accepted Answer

Centralized key management with customer-managed keys and automated rotation across all cloud providers.. Customer-managed key management and comprehensive data access logging with immutable retention are core to protecting data and responding to incidents. Keys enable revocation and consistent encryption control across providers, while access logs provide detection, scoping, and forensic evidence. Tagging, shared admin accounts, and manual firewall reviews do not deliver those protection and response outcomes.

Answer

A single shared administrator account with MFA for all cloud providers to simplify management.

Answer

Uniform resource tagging enforced through policy as code for all data stores.

Answer

Periodic manual review of firewall rules by the network team.

Question 10

A CloudSec-Pro incident responder is investigating a suspected data exfiltration from an AWS S3 bucket. The bucket has server access logging enabled and AWS CloudTrail data events enabled. Which two log sources should be correlated to determine the identity and the specific objects accessed? (Choose two.)

Accepted Answer

AWS CloudTrail data events for S3, which record the identity and the API call made to the bucket.. Correlating S3 server access logs with CloudTrail data events provides both the object-level access details and the authenticated identity. Server access logs show the object key and requester, while CloudTrail data events map the request to an IAM principal and API call. Management events, VPC Flow Logs, and AWS Config do not capture object-level reads with identity context.

Answer

AWS Config configuration history for the S3 bucket, which records changes to bucket properties over time.

Answer

AWS CloudTrail management events, which record bucket-level configuration changes such as policy updates.

Answer

Amazon VPC Flow Logs for the subnet containing the S3 endpoint, which record IP-level traffic metadata.

Question 11

A CloudSec-Pro auditor is evaluating a cloud service provider's data protection controls. The auditor needs to verify that the provider implements appropriate measures for data remanence and secure disposal in a multi-tenant environment. Which TWO of the following are essential controls to validate? (Choose two.)

Accepted Answer

Logical separation of tenant data with access controls that prevent cross-tenant data leakage.. Cryptographic erasure and logical separation are essential controls for data remanence and secure disposal in multi-tenant cloud environments. Cryptographic erasure ensures data is unrecoverable by destroying keys, while logical separation prevents cross-tenant data leakage. Physical destruction and transit encryption do not directly address these concerns.

Answer

Physical destruction of all storage media upon tenant offboarding, with certificates of destruction.

Answer

Encryption of data in transit using TLS 1.2 or higher for all tenant communications.

Answer

Regular third-party audits of the provider's data center physical security.

Question 12

A CloudSec-Pro incident responder is notified that a managed database instance containing regulated data may have been accessed using stolen credentials. The database supports native audit logging and automated backups. Which action best preserves forensic evidence while allowing the investigation to proceed?

Accepted Answer

Capture the database audit logs and a snapshot of the instance to a restricted forensic account before making any changes.. Preserving evidence before remediation is critical. Capturing audit logs and a snapshot to a restricted forensic account freezes the relevant state and access records, enabling analysis and chain of custody. Deleting the instance, waiting to collect logs, or disabling logging would destroy or degrade the evidence needed to scope the breach and support any legal or regulatory follow-up.

Answer

Disable audit logging to reduce storage costs and rely on the cloud provider's internal monitoring.

Answer

Immediately delete the database instance and restore from the most recent automated backup.

Answer

Rotate the database credentials and wait for the attacker to stop accessing the data before collecting logs.

Question 13

A CloudSec-Pro security engineer is investigating a potential data exfiltration incident in an AWS environment. The engineer suspects that an IAM role was used to copy sensitive data from an S3 bucket to an external account. Which AWS service should the engineer use to identify the API calls made by that IAM role and the source IP addresses?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that logs all API activity in an AWS account, including the identity, timestamp, source IP, and request details. To investigate which API calls an IAM role made and from which IP addresses, the engineer should analyze CloudTrail logs. GuardDuty provides threat findings but not raw API logs. AWS Config tracks resource configurations, and Macie focuses on sensitive data discovery, not API auditing.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon Macie

Question 14

A CloudSec-Pro incident responder is handling a security breach in a cloud environment where an attacker has gained access to a privileged IAM role. The responder needs to revoke the attacker's access immediately while preserving evidence for forensic analysis. Which of the following actions should be taken FIRST?

Accepted Answer

Disable the compromised IAM role and revoke all active sessions, then capture the role's policy documents and CloudTrail logs for analysis.. Disabling the compromised IAM role and revoking active sessions immediately stops the attacker's access while preserving the role's configuration and logs for forensic analysis. This is the most direct and effective first step in containing an IAM-based breach.

Answer

Isolate the affected cloud resources by applying a deny-all network security group, then investigate the IAM role's permissions.

Answer

Delete the compromised IAM role to prevent further use, then review CloudTrail logs to determine the scope of the breach.

Answer

Change the password of all users associated with the compromised role and enable multi-factor authentication (MFA) for all accounts.

Question 15

A CloudSec-Pro incident responder is handling a security event in which an EC2 instance was compromised and is potentially exfiltrating data. The responder needs to isolate the instance for forensic analysis while preserving evidence. Which two actions should the responder take? (Choose two.)

Accepted Answer

Move the instance to a quarantine subnet with no route to the internet.. For containment and evidence preservation, the responder should create an EBS snapshot to capture disk evidence and move the instance to a quarantine subnet with no internet route to isolate it. These actions prevent further exfiltration while allowing forensic analysis. Modifying security groups, terminating, or detaching IAM roles do not provide the same level of isolation and evidence preservation.

Answer

Terminate the instance to stop the exfiltration immediately.

Answer

Modify the security group to allow only inbound traffic from the incident responder's IP.

Answer

Detach the IAM role from the instance to revoke permissions.