350-201 Question 222
Select 4Your security operations team has detected unusual data exfiltration from an organization's cloud storage. You suspect potential data loss and need to investigate further. Which steps should you take to determine the source and impact of the data loss?
- A
Analyze cloud access logs for unusual login patterns or unauthorized access attempts.
- B
Perform endpoint scans to identify malware or unauthorized data transfer tools.
- C
Review database query logs to detect anomalous data extraction requests.
- D
Immediately block all traffic to the cloud storage service to prevent further data loss.
- E
Inspect user activity within the associated application for abnormal file sharing or downloads.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
Investigating potential data loss requires a methodical approach that includes analyzing logs from various sources (cloud, endpoint, databases, and applications) to identify anomalies and pinpoint the root cause. Blocking services entirely without understanding the scope of the incident could cause unnecessary disruptions and hinder legitimate operations.
- A. Correct.
Analyzing cloud access logs can help identify unauthorized logins, compromised accounts, or other anomalies that point to the source of the data exfiltration.
- B. Correct.
Endpoint scans can reveal malware or unauthorized tools that might be used to facilitate data exfiltration, providing critical clues for the investigation.
- C. Correct.
Database query logs can indicate whether large or unusual queries were executed to extract sensitive data, which may be associated with the data loss incident.
- D. Incorrect.
Blocking all traffic to the cloud storage service without proper investigation can disrupt legitimate business operations and is not a recommended first step in this scenario.
- E. Correct.
Inspecting user activity within the application can reveal abnormal behaviors, such as excessive file downloads or unauthorized sharing, which might contribute to data loss.