Get the Preplance app for a seamless learning experience. Practice offline, get daily streaks, and stay ahead with real-time interview updates.
Get it on
Google Play
4.9/5 Rating on Store
Incident Response · Question Set
Cloud IR & Hybrid interview questions for placements and exams.
Questions
13
Included in this set
Subject
Incident Response
Explore more sets
Difficulty
Mixed
Level of this set
Go through each question and its explanation. Use this set as a focused practice pack for Incident Response.
The shared responsibility model outlines how security is divided between the cloud provider and the customer. Providers secure the cloud infrastructure, while customers secure their data, applications, and configurations within it.
For complete preparation, combine this set with full subject-wise practice for Incident Response. You can also explore other subjects and sets from the links below.
AWS Detective automatically analyzes CloudTrail logs, VPC flow data, and GuardDuty findings. It helps security teams visualize connections between resources and investigate suspicious activity faster.
Microsoft Sentinel is a cloud-native SIEM and SOAR platform. It collects data across Azure, on-prem, and other cloud platforms, enabling analytics, automation, and cross-environment incident response.
GCP’s Security Command Center provides visibility into assets, misconfigurations, and active threats. It centralizes event data to support incident detection and cloud environment investigations.
Centralized logging aggregates data from multiple platforms, helping analysts correlate alerts and detect patterns. It avoids data silos, reduces response time, and ensures consistent visibility across on-prem and cloud assets.
Cloud IR playbooks must include API-based actions like disabling IAM keys, stopping virtual machines, or revoking roles. They rely heavily on native services such as AWS Lambda or Azure Logic Apps to execute automated containment steps across distributed environments.
Misconfigured S3 buckets, open ports, or overly permissive IAM policies are leading causes of cloud breaches. They expose sensitive data and create easy entry points for attackers. Continuous auditing and automated compliance tools help prevent such risks.
AWS CloudTrail provides detailed event logs showing who did what and when. It’s essential for identifying unauthorized access or suspicious API activity during investigations.
Lambda functions can automatically execute containment or remediation steps — like revoking credentials or isolating EC2 instances — as part of SOAR-driven workflows in hybrid environments.
In cloud forensics, investigators have limited control over hardware and rely on provider logs, snapshots, and APIs for evidence. Unlike on-prem systems, physical access to servers is restricted. Therefore, timely log collection and data preservation agreements with providers become critical for legal compliance and integrity.
1. **Detection:** Identify anomalies through cloud-native monitoring (e.g., GuardDuty, Sentinel). 2. **Containment:** Isolate affected accounts, instances, or containers. 3. **Eradication:** Remove malicious files or misconfigurations. 4. **Recovery:** Restore clean resources and reapply IAM controls. 5. **Review:** Conduct lessons learned and update automation workflows.
Least privilege ensures users and services have only the permissions they need. During IR, it limits the blast radius by reducing lateral movement possibilities. In prevention, it stops attackers from exploiting over-permissioned roles and APIs.
Each cloud provider uses unique log formats and APIs. This inconsistency makes correlating and automating incident detection across AWS, Azure, and GCP more complex for security teams.