Data Protection And Incident Response IN Cloud practice questions

Delete the storage bucket

Why it fails: This causes massive data loss and is not a standard containment procedure.

Change the bucket encryption keys

Why it fails: This prevents access but disrupts legitimate business operations without addressing the root cause.

Update the firewall rules of the VPC

Why it fails: Cloud storage is typically accessed via APIs, not VPC firewall rules.

Disable the snapshot feature

Why it fails: Disabling features is not a verification method.

Enable VPC flow logs

Why it fails: VPC flow logs monitor network traffic, not storage encryption.

Use the AWS CLI to manually check each snapshot

Why it fails: This is manual and not integrated with Prisma Cloud's automated reporting.

Delete the pod immediately

Why it fails: This destroys volatile data.

Rotate the cluster credentials

Why it fails: This does not preserve the incident state.

SSH into the container and clear logs

Why it fails: This destroys evidence.

The number of users in the account

Why it fails: User count is irrelevant to policy evaluation.

The cloud provider's billing status

Why it fails: Billing does not impact policy evaluation.

The network latency to the cloud provider

Why it fails: Latency does not prevent policy execution.

Host Security

Why it fails: Focuses on the node, not the image.

Runtime Security

Why it fails: Focuses on active containers, not image build history.

Compliance Reporting

Why it fails: Focuses on posture, not image forensics.

Capture a memory dump of the running instance before it is terminated.

Why it fails: The instance has already been terminated by the attacker, so capturing a memory dump is impossible. Memory dumps are valuable for live analysis, but they must be taken before shutdown. Since the instance is gone, this action cannot be performed. The analyst must focus on what can still be recovered.

Create an EBS snapshot of the root volume and the instance store volume.

Why it fails: EBS snapshots only capture EBS volumes, not instance store volumes. Since the attacker used the ephemeral instance store for staging, an EBS snapshot would not preserve that data. Additionally, the instance was terminated, so the instance store data is already lost. This action would not recover the needed evidence and may waste time.

Enable termination protection on the instance to prevent further data loss.

Why it fails: Termination protection prevents accidental termination but does not help after the instance has already been terminated. It also does not preserve volatile data. Enabling it now would have no effect on the already terminated instance and would not aid in forensic recovery. This is a preventive control, not a corrective one.

Enable automatic rotation on the AWS-managed key aws/rds used by the database.

Why it fails: AWS-managed keys such as aws/rds are rotated automatically by AWS on a fixed schedule that the customer cannot set to 90 days, and the customer cannot enable or configure rotation on them. The scenario requires a customer-defined 90-day rotation, so a customer-managed key is required.

Configure an AWS Lambda function to call the KMS GenerateDataKey API every 90 days and rotate the database password.

Why it fails: Rotating a database password is unrelated to rotating the encryption key that protects the database storage. GenerateDataKey only produces data keys for client-side encryption; it does not rotate the customer-managed KMS key used for the database. This does not satisfy the key rotation requirement.

Create a new KMS key every 90 days and re-encrypt the database with the new key.

Why it fails: Creating a new key every 90 days and re-encrypting the database requires application or operational changes, downtime, and a re-encryption workflow. It does not meet the requirement of no application changes and introduces risk of data unavailability. Automatic rotation of the existing key is the appropriate control.

Stop (deallocate) the VM to sever all network connections and prevent further communication.

Why it fails: Stopping (deallocating) the VM severs network connections but also shuts down the VM, losing volatile memory and potentially disrupting forensic artifacts. It is not the most effective for preserving state. Additionally, deallocation may release the public IP, complicating reconnection for analysis. Isolation should preserve the VM's running state when possible.

Delete the VM's network interface to disconnect it from the virtual network.

Why it fails: Deleting the network interface disconnects the VM from the network but is a destructive action that may prevent reconnection and complicate forensic analysis. It also does not preserve the VM's configuration. This is not a recommended isolation method because it is irreversible and can hinder investigation.

Move the VM to a different subnet with no route to the internet or other subnets.

Why it fails: Moving the VM to a different subnet requires stopping the VM, which loses volatile state. It also may not immediately isolate if the new subnet has unintended routes. This approach is slower and less direct than applying a restrictive NSG. It does not meet the requirement for immediate isolation while preserving state.

AWS CloudTrail for detection and AWS Lambda for remediation.

Why it fails: CloudTrail records API activity, including changes to bucket policies, but it does not provide real-time alerting or automatic remediation. It typically delivers logs to S3 within minutes, and you would need additional services like CloudWatch Events to trigger alerts. CloudTrail alone cannot meet the 1-minute alerting requirement. Lambda can remediate, but without a real-time event source, the detection latency would be too high.

AWS Config for detection and AWS Lambda for remediation.

Why it fails: AWS Config can detect changes to S3 bucket policies and evaluate compliance, but it is not real-time; it typically evaluates within minutes, and alerts may be delayed. While Lambda can remediate, the detection latency of AWS Config may exceed the 1-minute requirement. Therefore, this combination is not suitable for the strict timing specified in the scenario.

Amazon GuardDuty for detection and AWS Config for remediation.

Why it fails: GuardDuty is a threat detection service that can identify suspicious activity, including S3 bucket public access, but it may not provide immediate alerts within 1 minute and is not designed for automatic remediation. AWS Config can evaluate compliance and trigger remediation via Systems Manager Automation, but it is not a real-time detection service; it evaluates periodically. This combination would not reliably meet the 1-minute alerting and automatic remediation requirement.

Object Versioning with a lifecycle rule to delete noncurrent versions after 30 days.

Why it fails: Object Versioning retains noncurrent versions, but without a retention policy, objects can still be permanently deleted by removing all versions. A lifecycle rule to delete noncurrent versions after 30 days actually shortens retention and does not guarantee recovery for 30 days after deletion.

Customer-managed encryption keys in Cloud KMS with a 30-day rotation period.

Why it fails: Cloud KMS key rotation changes the encryption key material but does not prevent object deletion or provide a recovery window. Encryption key management is unrelated to protecting against accidental deletion, so this does not meet the requirement to recover data for 30 days.

Uniform bucket-level access with IAM conditions restricting delete permissions.

Why it fails: Uniform bucket-level access and IAM conditions control who can delete objects, but they do not prevent accidental deletion by an authorized user or provide a recovery window. They are access control measures, not retention or recovery features, so they do not satisfy the 30-day recovery requirement.

Restore the storage account from a previous snapshot and compare file hashes to identify modified blobs.

Why it fails: Restoring from a snapshot and comparing hashes is a technique for detecting data integrity changes, not for identifying read access or exfiltration. Exfiltration does not modify the blobs, so hashes would remain unchanged. This approach would not reveal which service principal read the data, and it could disrupt the live environment.

Enable Azure Defender for Storage and wait for security alerts to appear in Microsoft Defender for Cloud.

Why it fails: Azure Defender for Storage generates security alerts based on anomalous access patterns, but it is a detective control that may not provide the granular, per-blob access logs needed for immediate forensic analysis. Enabling it now would not retroactively capture the 72 hours of access history already suspected. The responder needs audit logs that were already being recorded.

Use Azure Monitor metrics to check the Ingress and Egress bytes for the storage account during the suspected period.

Why it fails: Azure Monitor metrics such as Ingress and Egress provide aggregate volume data, not per-blob or per-identity access details. While they could indicate a spike in data transfer, they cannot identify which blobs were accessed or which service principal performed the reads. Metrics alone are insufficient for forensic attribution in this scenario.

Vulnerability Logs

Why it fails: Vulnerability logs record CVEs and misconfiguration findings against hosts, images and workloads, containing no caller identity or API request context. They would be the right source for triaging an unpatched package, but identifying the principal behind suspicious API calls requires audit or CloudTrail-style activity logs.

Flow Logs

Why it fails: Flow logs capture network metadata such as source and destination IPs, ports and bytes transferred, which can show exfiltration traffic but not the authenticated identity issuing API calls. They suit network-path investigations; attributing API activity to a specific principal requires audit logs recording the caller's identity.

Compliance Logs

Why it fails: Compliance logs report posture against benchmarks and regulatory controls, such as failed CIS checks, rather than per-request API activity. They are the correct source for audit-readiness reporting, but they do not record which identity invoked an API, so they cannot attribute the exfiltration calls.

Manually update the AWS RDS console setting

Why it fails: Console changes are manual, so they cannot satisfy Prisma Cloud's automated remediation requirement and leave drift undetected. Manual fixes suit one-off corrections where no policy engine or automation pipeline exists, which is not this compliance workflow.

Create a new Alert Rule without an action

Why it fails: An alert rule without an action only notifies; it cannot remediate the public accessibility flag. Such rules suit monitoring and reporting where analysts triage manually, but this question requires an automated workflow that actually changes the RDS setting.

Change the IAM role of the Prisma Cloud service account

Why it fails: Altering the service account's IAM role changes Prisma Cloud's own permissions; it never modifies the RDS public accessibility setting. Role changes are for granting the platform read or remediate rights, not for correcting a resource's configuration.

Cloud Discovery

Why it fails: Cloud Discovery inventories and onboards cloud accounts and workloads; it does not scan object contents for card-number patterns. It is tempting because discovery must precede data security configuration, but the correct feature is a Data Security policy whose rule defines the detection logic itself.

Network Security Groups

Why it fails: Network Security Groups filter IP traffic at the Azure virtual network layer and never inspect stored blob contents, so they cannot detect card numbers. They are tempting because NSGs are a familiar Azure control, and they would be the right choice for restricting network reachability to a storage account.

IAM Policies

Why it fails: IAM Policies govern identity permissions and resource access, not content inspection, so they cannot define regex or keyword logic for detecting card numbers. They are tempting because Prisma Cloud does use IAM policies to flag overly permissive roles, which is the right tool for entitlement risk rather than data-pattern matching.

Identity-Based Micro-segmentation

Why it fails: Identity-Based Micro-segmentation enforces east-west traffic rules between workloads, so it cannot read bucket encryption configuration at all. It is tempting because it also provides continuous, policy-driven cloud visibility, but that visibility concerns network flows; it would be the right choice when the requirement is containing lateral movement after a workload compromise.

Threat Detection

Why it fails: Threat Detection identifies malicious network activity, anomalies and compromised resources; it does not read bucket encryption configuration state. It is correct when hunting active threats, while continuous configuration auditing of storage encryption belongs to the posture management component.

Cloud Workload Protection

Why it fails: Cloud Workload Protection secures hosts, containers and serverless runtimes against runtime threats; it does not enumerate bucket encryption configuration. It is the right component when defending compute workloads, whereas posture management continuously audits storage encryption settings.

Update the AWS Security Group to block all inbound traffic

Why it fails: Blocking inbound traffic leaves the containerised process running and reachable outbound, so no memory or filesystem artefacts are captured for examination. It is tempting because Security Groups are the standard AWS network control, and would be correct for cutting off an external attacker's access, not for forensic acquisition.

Restart the container to clear memory

Why it fails: Restarting the container discards the running process's memory and any resident malware, erasing the volatile evidence forensic analysis requires. It is tempting as a quick remediation step, and would be correct when restoring a known-good service state, but it destroys exactly the artefacts Prisma Cloud Compute would capture.

Delete the EC2 instance immediately to stop the breach

Why it fails: Terminating the instance destroys volatile memory, container filesystem state and network connections before any evidence is captured, defeating the forensic goal entirely. It is tempting as breach containment, and would be right when stopping active exfiltration outweighs evidence preservation, but here analysis is the stated objective.

Enable full bucket deep scanning for all objects

Why it fails: Deep scanning every object in the bucket inspects data that may contain no PII, consuming scanning capacity and adding latency, which contradicts the minimise-latency requirement. It is tempting because full deep scanning gives the broadest detection coverage, and it would be correct where complete assurance over all stored objects outweighs performance cost.

Deploy a CloudFormation template to encrypt all bucket contents

Why it fails: Encrypting bucket contents with CloudFormation addresses data at rest, not the identification of PII, so no object is actually scanned for sensitive data. It is tempting because encryption is a genuine S3 security control, and it would be the right choice when the requirement is to protect stored objects rather than discover PII within them.

Disable the Data Security module for S3

Why it fails: Disabling the Data Security module for S3 stops all scanning, so PII is never detected and the stated objective cannot be met. It is tempting because turning off scanning removes the latency that scanning introduces, and it would be correct only where S3 data discovery is explicitly out of scope or prohibited.

Admission Control

Why it fails: Admission Control evaluates Kubernetes manifests at deploy time, blocking non-compliant workloads before they run; it cannot observe processes already executing on a host. It is tempting because it governs what runs, and would be correct for enforcing pod security policy during deployment.

Compliance Scanning

Why it fails: Compliance Scanning checks host and container configuration against CIS-style benchmarks; it inspects settings, not runtime process activity, so an unexpected process is never flagged. It is tempting because it reports on host state, and would be correct for auditing configuration drift or hardening baselines.

Vulnerability Scanning

Why it fails: Vulnerability Scanning matches installed packages against CVE databases; it never records runtime process trees, so unexpected execution stays invisible. It is tempting because it does surface risky software, and would be the right tool for finding unpatched packages rather than live backdoor behaviour.

Data processed in memory

Why it fails: Data in memory is being actively processed, so it is data in use, not at rest. The distinction is the storage state: at rest means data held on persistent media such as disks, object stores or backups. Memory processing is the tempting answer because it is transient, but it is a processing state.

Data being sent over TLS

Why it fails: TLS transmission means data is moving between endpoints, so it is data in transit, not at rest. At rest refers to data stored on persistent media such as volumes, buckets or backups. Encryption in transit is tempting because it protects confidentiality, but the storage state, not the protection, defines the category.

Data being analyzed by an IDS

Why it fails: IDS analysis means data is being actively read and inspected, so it is data in use rather than at rest. At rest concerns data stored on persistent media, not data under active processing. The scenario is tempting because analysis sounds passive, but the data is being accessed by a running process.

Admission Control

Why it fails: Admission Control blocks non-compliant Kubernetes workloads at deploy time via webhook; it never observes Security Group modifications in the cloud control plane. Automating response to those changes needs audit-log-driven rules. Admission Control is correct when preventing misconfigured containers from ever starting in a cluster.

Vulnerability Management

Why it fails: Vulnerability Management scans workloads and hosts for CVEs; it holds no event-driven logic for Security Group changes. Automating response requires a rule engine that ingests cloud audit events and triggers actions. Vulnerability Management is the right choice when the goal is identifying and tracking software flaws, not reacting to configuration drift.

Network Policy

Why it fails: Network Policy builds and enforces microsegmentation rules for workloads; it does not monitor Security Group API calls or fire remediation. Automating incident response needs an event-driven rule that detects the change and acts. Network Policy would be correct when the requirement is defining allowed traffic flows between cloud workloads.