1.8 Identify the Challenges of Data Visibility (network, Host, and Cloud) in Detection 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard · select all that apply

   A security team is moving to a cloud-based infrastructure and wants to maintain visibility for detection. The team is concerned about the shared responsibility model and ephemeral resources. Which of the following are valid challenges that the team should address? (Select all that apply.)

   • ANetwork traffic between cloud resources is always encrypted and cannot be monitored.
   • BCloud resources can be created and deleted quickly, making it difficult to collect logs.
   • CThe cloud provider is responsible for securing the underlying infrastructure, but the customer must monitor their own workloads.
   • DThe cloud provider automatically provides full visibility into all customer data.
   • EAPI-based access to cloud resources may not generate traditional network logs.
   Check answers Discussion Select an answer first
2. 22application · medium

   A company is moving its on-premises data center to a public cloud. The security team is concerned about losing visibility into network traffic. The cloud provider offers virtual network flow logs, but the team is unsure what they will see. What is the primary limitation of using only cloud flow logs for detection?

   • AFlow logs are encrypted and cannot be read by the customer.
   • BFlow logs provide metadata, not the full content of the traffic.
   • CFlow logs only capture traffic between cloud resources, not to the internet.
   • DFlow logs are not available in the cloud.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security team is monitoring a hybrid environment with on-premises servers and cloud workloads. The team uses a network IDS that is deployed at the internet perimeter. The team notices that the IDS is not detecting malicious traffic between the on-premises servers and the cloud workloads. What is the most likely reason for this visibility gap?

   • AThe IDS is not capable of detecting cloud traffic.
   • BThe traffic between on-premises and cloud workloads may traverse a private connection that bypasses the IDS.
   • CThe cloud workloads are not generating any malicious traffic.
   • DThe on-premises servers are not sending logs to the IDS.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst is investigating a potential data exfiltration. The analyst sees that a host on the internal network is sending large amounts of data to an external IP address. However, the analyst cannot determine if the data is sensitive because the traffic is encrypted. What is the most likely impact of this visibility gap?

   • AThe analyst can block the traffic without further investigation.
   • BThe analyst can use the external IP to identify the attacker immediately.
   • CThe analyst cannot confirm whether the data is sensitive, delaying the response.
   • DThe analyst can rely on host logs to see the file names.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company uses a public cloud provider for its web application. The security team wants to monitor network traffic between the application and its users. The team has access to the cloud provider's flow logs, but the traffic is encrypted. What is the most effective way to gain visibility into the content of this traffic?

   • ADeploy a reverse proxy that terminates TLS and forwards decrypted traffic to a monitoring tool.
   • BRely on flow logs to see the full content of the traffic.
   • CUse the cloud provider's native DDoS protection to inspect traffic.
   • DAsk the cloud provider to decrypt all traffic for the customer.
   Reveal Solution Discussion Select an answer first