350-201 Question 221
Select 4Your organization recently detected unusual activity involving a large amount of sensitive customer data being accessed on a cloud storage service. As part of the investigation, you are tasked with identifying the potential data loss vector. Which of the following steps should you take to investigate the incident effectively?
- A
Review cloud access logs for anomalous login patterns or access from unusual IP addresses.
- B
Analyze endpoint devices for unauthorized file transfers or malware presence.
- C
Immediately block all user access to the cloud service to prevent further data loss.
- D
Verify application-level logs to check for unauthorized API calls or data exfiltration attempts.
- E
Perform a database audit to identify unauthorized queries or data exports.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
Investigating potential data loss requires a multi-faceted approach that involves examining logs, devices, and systems potentially involved in the incident. Cloud access logs, endpoint analysis, application logs, and database audits provide complementary insights into different vectors of data exfiltration. Blocking all access immediately is not a recommended first step, as it could disrupt operations and erase valuable forensic evidence.
- A. Correct.
Reviewing cloud access logs can reveal unauthorized access attempts, abnormal login patterns, or access from unusual geographic locations, which are critical in identifying the source of the data loss.
- B. Correct.
Analyzing endpoint devices can uncover if malware or unauthorized software facilitated the data exfiltration or if a compromised endpoint was involved.
- C. Incorrect.
Blocking all user access immediately could disrupt legitimate business operations and hinder the investigation by removing evidence. Instead, access restrictions should be applied surgically based on findings.
- D. Correct.
Application-level logs are valuable for identifying unauthorized API calls or actions that may have led to data exfiltration, especially in SaaS or cloud-hosted applications.
- E. Correct.
Performing a database audit is essential to verify if data was extracted directly from the database, as this is a common vector for data breaches.