Google Professional Cloud Security Engineer Question 431
Select 3Google Cloud PlatformYour company has deployed a multi-tier application on Google Cloud. Recently, unusual activity was detected from one of the virtual machines in the application, indicating a potential security incident. As a Professional Cloud Security Engineer, you need to respond to the incident while ensuring that no further malicious activity occurs and evidence is preserved for investigation. What steps should you take to address this situation effectively?
- A
Isolate the affected virtual machine by removing it from the network while preserving its current state for forensic analysis.
- B
Delete the affected virtual machine immediately to prevent further malicious activity.
- C
Use Cloud Logging and Cloud Monitoring to investigate the logs and identify suspicious activities or patterns.
- D
Create a snapshot of the affected virtual machine for forensic purposes before making any changes.
- E
Restart the affected virtual machine to resolve any potential malicious processes running on it.
Show answer and explanation
Correct answers: A, C, D
Explanation
When responding to a security incident, it is critical to isolate the affected resource to prevent further damage, preserve evidence for investigation, and gather as much information as possible to understand the scope and impact of the incident. Deleting or restarting resources prematurely can compromise the investigation and remediation efforts.
- A. Correct.
Isolating the affected virtual machine from the network is crucial to prevent further malicious activity. Preserving its state ensures that evidence is retained for forensic analysis.
- B. Incorrect.
Deleting the affected virtual machine could result in the loss of critical evidence needed to investigate the root cause of the incident, making this a poor choice.
- C. Correct.
Using Cloud Logging and Cloud Monitoring helps identify the scope of the issue and trace malicious activities, which is an essential step in responding to security incidents.
- D. Correct.
Creating a snapshot of the affected virtual machine ensures that you have a copy of its state for detailed forensic analysis, which is a best practice in incident response.
- E. Incorrect.
Restarting the virtual machine could destroy evidence or allow malicious processes to disguise themselves or reinitialize, making this an inappropriate action during a security incident.