1.8 Identify the Challenges of Data Visibility (network, Host, and Cloud) in Detection 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security team is monitoring a cloud environment that uses auto-scaling to launch and terminate virtual machines based on demand. The team notices that some VMs are terminated before the security monitoring agent can send its logs to the central SIEM. What is the most likely challenge this scenario illustrates?

   • AThe cloud provider is responsible for collecting logs from all VMs.
   • BAuto-scaling is not compatible with security monitoring.
   • CEphemeral resources can disappear before logs are collected.
   • DThe SIEM is not capable of receiving cloud logs.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst is investigating a potential compromise in a cloud environment. The analyst notices that a virtual machine was created, used, and deleted within a few hours. The cloud provider's API logs show the creation and deletion, but no network flow logs are available for that VM. What is the primary challenge this scenario illustrates?

   • AEphemeral resources can be gone before sufficient data is collected.
   • BThe cloud provider is responsible for all security monitoring.
   • CAPI logs are not useful for security investigations.
   • DNetwork flow logs are not available in any cloud environment.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company is migrating a critical application to a cloud provider. The security team wants full visibility into the application's network traffic and host activity. The provider offers a managed Kubernetes service, and the team does not have access to the underlying nodes. Which approach provides the most comprehensive visibility within the shared responsibility model?

   • AInstall a host-based EDR agent on the Kubernetes nodes
   • BUse only the provider's built-in monitoring dashboards
   • CEnable the provider's audit logging for the Kubernetes API and use a sidecar container to collect application logs
   • DDeploy a network TAP in the cloud to capture all traffic to and from the pods
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   An organization has no visibility into traffic between internal servers because it only monitors the internet edge. An attacker moves laterally between servers and exfiltrates data. What is the most direct impact of this visibility gap on detection?

   • AThe attack will be detected immediately by the edge monitor
   • BThe attack will be detected by cloud API logs
   • CThe attack may go undetected until the exfiltration is noticed
   • DThe attack will be detected by host logs automatically
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   A security operations center (SOC) relies on a single network tap at the internet edge to monitor traffic. Which network visibility challenge is most likely to arise from this architecture?

   • AInability to observe traffic that stays within the internal network
   • BInability to decrypt TLS-encrypted traffic
   • CInability to collect logs from endpoints
   • DInability to identify the source IP of external traffic
   Reveal Solution Discussion Select an answer first