Incident Response in Cloud Quiz

What you'll be asked

1. Which cloud security service is primarily used to provide continuous monitoring and automated alerts for suspicious activity in an AWS environment?
2. During an incident response process in the cloud, what is the recommended first step after confirming a potential security compromise of an EC2 instance?
3. Why is it important to enable 'Object Lock' or 'Versioning' on cloud storage buckets used for storing incident response logs?
4. When responding to a credential leakage incident, which action should be prioritized to maintain the principle of least privilege?
5. You discover that an attacker has gained persistence in your cloud environment by creating a rogue IAM role with broad permissions. Which forensic strategy best supports post-incident analysis?

Answers and explanations come after you submit.